hexdump
Display file contents in hexadecimal format
TLDR
Print the hexadecimal representation of a file, replacing duplicate lines by '*'
Display the input offset in hexadecimal and its ASCII representation in two columns
Display the hexadecimal representation of a file, but interpret only n bytes of the input
Don't replace duplicate lines with '*'
SYNOPSIS
hexdump [options] file...
PARAMETERS
-b
One-byte octal display. Display the input offset in hexadecimal, followed by sixteen space-separated, three-column, zero-filled, bytes in octal, per line.
-C
Canonical hex+ASCII display. Display the offset in hexadecimal, followed by sixteen space-separated hex bytes, followed by the equivalent ASCII characters in the right margin. This is the most common and useful format.
-c
One-byte character display. Display the input offset in hexadecimal, followed by sixteen space-separated, three-column, space-filled, characters per line.
-d
Two-byte decimal display. Display the input offset in hexadecimal, followed by eight space-separated, five-column, zero-filled, two-byte units in unsigned decimal, per line.
-e
Specify a format string to be used to display data. Allows fine-grained control over output formatting.
-f
Read format strings from a file.
-n
Interpret only the first
-o
Two-byte octal display. Display the input offset in hexadecimal, followed by eight space-separated, six-column, zero-filled, two-byte quantities in octal, per line.
-s
Skip
-v
Do not suppress duplicate output lines.
-x
Two-byte hexadecimal display. Display the input offset in hexadecimal, followed by eight space-separated, four-column, zero-filled, two-byte quantities in hexadecimal, per line.
file...
The file(s) to hexdump. If no files are specified, `hexdump` reads from standard input.
DESCRIPTION
The `hexdump` command in Linux is a powerful utility for displaying the raw byte contents of a file or standard input in hexadecimal (and optionally other formats) along with corresponding ASCII representation. It's invaluable for debugging binary files, reverse engineering, analyzing data formats, and understanding how data is structured at a low level. `hexdump` reads the specified input and prints each byte's hexadecimal value.
It groups these bytes into sections, typically 16 bytes per line. Alongside the hex values, it often displays the equivalent ASCII characters when available, making it easier to identify text strings or patterns within the data. It provides various formatting options to customize the output, such as byte grouping, address display, and character set selection.
By understanding how to use `hexdump`, you can gain a deeper understanding of the underlying structure of files and data.
CAVEATS
The behavior of `hexdump` can vary slightly depending on the specific implementation (e.g., BusyBox, GNU). Always consult the manual page for your system for definitive information.
FORMAT STRINGS
The `-e` option offers powerful control using format strings. These strings are composed of conversion specifications that define how data is interpreted and displayed.
Conversion specifications follow the general form: count/units "format", where count is the number of iterations, units specifies the size of the data unit (e.g., 'b' for byte, 'd' for short), and format is a printf-style format string.
For Example: 2/1 "%X" displays two iterations of 1-byte values using hexadecimal
ADDRESSES
Hexdump shows the offset of the first byte of each line, displayed on the left. By default it's in hexadecimal, but options to change the format are not exposed.
HISTORY
The `hexdump` command has been a staple of Unix-like systems for many years. Its origins can be traced back to the early days of Unix, where it provided a crucial tool for inspecting and debugging binary data. Over time, various implementations and enhancements have been developed, but the core functionality has remained consistent.