LinuxCommandLibrary

hexdump

Display file contents in hexadecimal format

TLDR

Print the hexadecimal representation of a file, replacing duplicate lines by '*'

$ hexdump [path/to/file]
copy

Display the input offset in hexadecimal and its ASCII representation in two columns
$ hexdump -C [path/to/file]
copy

Display the hexadecimal representation of a file, but interpret only n bytes of the input
$ hexdump -C -n[number_of_bytes] [path/to/file]
copy

Don't replace duplicate lines with '*'
$ hexdump --no-squeezing [path/to/file]
copy

SYNOPSIS

hexdump [options] file...

PARAMETERS

-b
    One-byte octal display. Display the input offset in hexadecimal, followed by sixteen space-separated, three-column, zero-filled, bytes in octal, per line.

-C
    Canonical hex+ASCII display. Display the offset in hexadecimal, followed by sixteen space-separated hex bytes, followed by the equivalent ASCII characters in the right margin. This is the most common and useful format.

-c
    One-byte character display. Display the input offset in hexadecimal, followed by sixteen space-separated, three-column, space-filled, characters per line.

-d
    Two-byte decimal display. Display the input offset in hexadecimal, followed by eight space-separated, five-column, zero-filled, two-byte units in unsigned decimal, per line.

-e
    Specify a format string to be used to display data. Allows fine-grained control over output formatting.

-f
    Read format strings from a file.

-n
    Interpret only the first bytes of input.

-o
    Two-byte octal display. Display the input offset in hexadecimal, followed by eight space-separated, six-column, zero-filled, two-byte quantities in octal, per line.

-s
    Skip bytes from the beginning of the input.

-v
    Do not suppress duplicate output lines.

-x
    Two-byte hexadecimal display. Display the input offset in hexadecimal, followed by eight space-separated, four-column, zero-filled, two-byte quantities in hexadecimal, per line.

file...
    The file(s) to hexdump. If no files are specified, `hexdump` reads from standard input.

DESCRIPTION

The `hexdump` command in Linux is a powerful utility for displaying the raw byte contents of a file or standard input in hexadecimal (and optionally other formats) along with corresponding ASCII representation. It's invaluable for debugging binary files, reverse engineering, analyzing data formats, and understanding how data is structured at a low level. `hexdump` reads the specified input and prints each byte's hexadecimal value.
It groups these bytes into sections, typically 16 bytes per line. Alongside the hex values, it often displays the equivalent ASCII characters when available, making it easier to identify text strings or patterns within the data. It provides various formatting options to customize the output, such as byte grouping, address display, and character set selection.
By understanding how to use `hexdump`, you can gain a deeper understanding of the underlying structure of files and data.

CAVEATS

The behavior of `hexdump` can vary slightly depending on the specific implementation (e.g., BusyBox, GNU). Always consult the manual page for your system for definitive information.

FORMAT STRINGS

The `-e` option offers powerful control using format strings. These strings are composed of conversion specifications that define how data is interpreted and displayed.
Conversion specifications follow the general form: count/units "format", where count is the number of iterations, units specifies the size of the data unit (e.g., 'b' for byte, 'd' for short), and format is a printf-style format string.
For Example: 2/1 "%X" displays two iterations of 1-byte values using hexadecimal

ADDRESSES

Hexdump shows the offset of the first byte of each line, displayed on the left. By default it's in hexadecimal, but options to change the format are not exposed.

HISTORY

The `hexdump` command has been a staple of Unix-like systems for many years. Its origins can be traced back to the early days of Unix, where it provided a crucial tool for inspecting and debugging binary data. Over time, various implementations and enhancements have been developed, but the core functionality has remained consistent.

SEE ALSO

od(1), xxd(1), dd(1)

Copied to clipboard