Hexdump is a very useful Linux command for developers and application debuggers. It has ability to dump file contents into many formats like hexadecimal, octal, ASCII and decimal. This command takes a file, or any standard input, as input parameter and converts it to the format of your choice. Let’s assume you work with binary data and you are unable to understand the format of a file, you can make use of Hexdump command to get file contents in much better readable format. This command comes pre-installed with all modern day Linux operating systems like CentOS, Fedora, Ubuntu, Debian, Arch Linux etc. In this article, we will be demonstrating the use of hexdump command using various examples. Written in C language, this command might be easy to understand by professional C programmers, but for other IT professionals, it might be a tricky command. We will try to do our best to demonstrate its usage and purpose here in this article.
1) Hexdump -b
Using “-b” switch with Hexdump will display the input offset in hexadecimal format. This option is also called “One-byte octal display”. The output will be followed by sixteen space-separated, three column, zero-filled, bytes of input data, in octal, per line. Here is the example output we received when we run this command with “-b” switch on a file named “Linuxthegreat”.
# hexdump -b Linuxthegreat
0000000 124 150 151 163 040 151 163 040 040 141 040 164 145 163 164 040
0000010 114 151 156 157 170 151 144 145 040 106 151 154 145 012 125 163
0000020 145 144 040 146 157 162 040 144 145 155 157 156 163 164 162 141
0000030 164 151 157 156 040 160 165 162 160 157 163 145 163 012 012
000003f
2) Hexdump -c
This option is referred to as “One-byte character display”. You can use this command parameter to display the input offset in hexadecimal. The output string will be followed by sixteen space-separated, three column, space-filled, characters of input data per line. Here is the example output of this command.
hexdump -c Linuxthegreat
0000000 T h i s i s a t e s t
0000010 L i n o x i d e F i l e \n U s
0000020 e d f o r d e m o n s t r a
0000030 t i o n p u r p o s e s \n \n
000003f
3) Hexdump -C
Also known as “Canonical hex+ASCII display”, this shows the input offset in hexadecimal, the output is followed by sixteen space-separated, two column, hexadecimal bytes, along with the same sixteen bytes in %_p format enclosed in “|” characters. Here is working example of this command option.
# hexdump -C Linuxthegreat
00000000 54 68 69 73 20 69 73 20 20 61 20 74 65 73 74 20 |This is a test |
00000010 4c 69 6e 6f 78 69 64 65 20 46 69 6c 65 0a 55 73 |Linuxthegreat File.Us|
00000020 65 64 20 66 6f 72 20 64 65 6d 6f 6e 73 74 72 61 |ed for demonstra|
00000030 74 69 6f 6e 20 70 75 72 70 6f 73 65 73 0a 0a |tion purposes..|
0000003f
4) Hexdump -d
This switch/option shows the input offset in hexadecimal, along with eight space-separated, five column, zero-filled, two-byte units of input data. The output is in unsigned decimal per line. It is also referred to as “Two-byte decimal display” mode. Here is example output of this command.
hexdump -d Linuxthegreat
0000000 26708 29545 26912 08307 24864 29728 29541 08308
0000010 26956 28526 27000 25956 17952 27753 02661 29525
0000020 25701 26144 29295 25632 28005 28271 29811 24946
0000030 26996 28271 28704 29301 28528 25971 02675 00010
000003f
5) Hexdump -o
Also known as “Two-byte octal display”, it shows the specified input offset in hexadecimal. The output of the command is followed by eight space-separated, six column, zero-filled, two byte quantities of input data, in octal, per line.
# hexdump -o Linuxthegreat
0000000 064124 071551 064440 020163 060440 072040 071545 020164
0000010 064514 067556 064570 062544 043040 066151 005145 071525
0000020 062145 063040 071157 062040 066545 067157 072163 060562
0000030 064564 067157 070040 071165 067560 062563 005163 000012
000003f
6) Hexdump -x
It shows the offset in hexadecimal, followed by eight, space separated, four column, zero filled, two-byte quantities of input data, in hexadecimal. It is referred to as “Two-byte hexadecimal display”.
# hexdump -x Linuxthegreat
0000000 6854 7369 6920 2073 6120 7420 7365 2074
0000010 694c 6f6e 6978 6564 4620 6c69 0a65 7355
0000020 6465 6620 726f 6420 6d65 6e6f 7473 6172
0000030 6974 6e6f 7020 7275 6f70 6573 0a73 000a
000003f
7) Hexdump -v
By default, hexdump uses the asterisk sign (*) to replace the identical line in the output string, but -v option causes hexdump to display all input data. This option is useful when performing the analysis of complete output of any string or text. This command can be used in shell /bash scripts as well for better automation of your desired tasks.
8) Hexdump -s
“Hexdump -s” displays only specified number of bytes from a file, the general syntax to use this option is as follows.
hexdump -s n -c File
Where, replace “n” with number of lines you want displayed, and “File” with your actual file name. Following example output should further clarify this concept.
# hexdump -s 1 -c Linuxthegreat
0000001 h i s i s a t e s t L
0000011
The above command will display only one line of output.
You can get more details about hexdump using its help manual. Simply type following command on your Linux system’s terminal and it will display all possibilities and option which can be used with hexdump.
man hexdump
Conclusion
Hexdump is pretty useful utility for system administrators and programmers. It makes analyzing and decoding the various file formats a piece of cake. It can be easily used in bash programming or C programming language scripts to perform complex tasks of file format conversions or analysis and reverse engineering. In this article, we have introduced to hexdump, its useful options and some useful demonstration of the commands related to this utility. Hope you enjoyed this article. If you have any comments or questions, feel free to let us know in comments.
Linux the great 
Reblogged this on A Passionate Techie.
LikeLike