Showing posts with label hex. Show all posts
Showing posts with label hex. Show all posts

Tuesday, July 22, 2008

Hex edit on linux

There are several useful tools which can be used to view and edit a binary file in hex mode.
(1) xxd (make a hexdump or do the reverse)
xxd infile        //hex dump. By default, in every line 16 bytes are displayed.
xxd -b infile    //bitdump instead of hexdump
xxd -c 10 infile //in every line 10 bytes are displayed instead of default value 16.
xxd -g 4 infile  //every 4 bytes form a group and groups are separated by whitespace.
xxd -l 100 infile     //just output 100 bytes
xxd -u infile    //use upper case hex letters.
xxd -p infile    //hexdump is displayed in plain format, no line numbers.
xxd -i infile     // output in C include file style.
E.g. output looks like:
unsigned char __1[] = {
  0x74, 0x65, 0x73, 0x74, 0x0a
};
unsigned int __1_len = 5;

xxd -r -p infile //convert from hexdump into binary. This requires a plain hex dump format(without line numbers).
E.g. in the infile, content should look like: 746573740a.
Note: additional whitespace and new-breaks are allowed. So 74 65 73 740a is also legal.
xxd -r infile     //similar to last command except line numbers should be specified also.
E.g. in the infile, content should look like: 0000000: 7465 7374 0a.

xxd can easily be used in vim which is described here.

(2) od(dump files in octal and other formats)
Switches:
    -A  how offsets are printed
    -t  specify output format
        (d:decimal; u:unsigned decimal;o:octet; x: hex; a: characters; c:ASCII characters or escape sequences.
        Adding a z suffix  to any type adds a display of printable characters to the end of each line of output)
    -v  Output consecutive lines that are identical.
    -j   skip specified number of bytes first.
    -N  only output specified number of bytes.

Example:
dd bs=512 count=1 if=/dev/hda1 | od -Ax -tx1z -v

(3) hexdump/hd
Currently, I have not used this command. Maybe in the near future I will update this part if I get experience about hexdump.