Linux command Xxd

Xxd, you can view the Linux file binary representation, man xxd, you can get the following information

NAME
Xxd-make a hexdump or do the reverse.


Synopsis
XXD-H[ELP]
xxd [Options] [infile [outfile]]
Xxd-r[evert] [options] [infile [outfile]]


DESCRIPTION
XXD creates a hex dump of a given file or standard input.  It can also convert a hex dump back to its original binary form. Like Uuencode (1) and UUDecode (1) It allows the
Transmission of binary data in a ' mail-safe ' ASCII representation, but have the advantage of decoding to standard output. Moreover, it can used to perform binary file
Patching.


OPTIONS
If no infile is given, standard input is read.  If infile is specified as a '-' character and then input was taken from standard input. If no outfile is given (or a '-' charac‐
TER is in it place), results was sent to standard output.


Note that a "lazy" parser are used which does not check for more than the first option letter, unless the option is Followe  D by a parameter. Spaces between a single option
Letter and its parameter is optional.  Parameters to options can is specified in decimal, hexadecimal or octal notation. THUS-C8,-C 8,-C 010 and-cols 8 is all equiva‐
Lent.


-A | -autoskip
Toggle autoskip:a Single ' * ' Replaces nul-lines. Default off.


-B | -bits
Switch to bits (binary digits) dump, rather than hexdump. This option writes octets as eight digits "1" s and "0" s instead of a normal hexadecimal dump. Each line is
Preceded by a line number in hexadecimal and followed by an ASCII (or EBCDIC) representation. The command line Switches-r,-p,-I do not work with this mode.


-C cols | -cols cols
Format <cols> octets per line. Default (-i:12,-ps:30,-b:6). Max 256.


-E | -ebcdic
The character encoding in the righthand column from ASCII to EBCDIC. This does the hexadecimal representation. The option is meaningless in combi‐
Nations With-r,-P or-i.


-G Bytes | -groupsize bytes
Separate the output of every <bytes> bytes (both hex characters or eight bit-digits each) by a whitespace.  Specify-g 0 to suppress grouping. <Bytes> defaults to 2
In normal mode and 1 in bits mode. Grouping does not an apply to PostScript or include style.


-H | -help
Print a summary of available commands and exit. No hex dumping is performed.

-I. | -include
Output in C include the file style. A complete static array definition was written (named after the input file), unless Xxd reads from stdin.


-L Len | -len Len
Stop after writing <len> octets.


-P | -ps | -postscript | -plain
Output in PostScript continuous hexdump style. Also known as plain hexdump style.


-r | -revert
Reverse Operation:convert (or patch) hexdump into binary. If not writing to stdout, Xxd writes into its output file without truncating it. Use the Combination-r-p
To read plain hexadecimal dumps without line number information and without a particular column layout. Additional whitespace and Line-breaks are allowed anywhere.


-seek Offset
When used After-r: revert with <offset> added to file positions found in Hexdump.


-S [+][-]seek
Start at <seek> bytes abs. (or rel.) infile offset. + indicates that the seek was relative to the current stdin file position (meaningless if not reading from
stdin). -Indicates that the seek should is that many characters from the end of the input (or if combined with +: before the Curr  ent stdin file position). Without
-S option, Xxd starts at the current file position.


-U use upper case hex letters. Default is lower case.


-V | -version
Show version string.

To illustrate:

For example, the following file is called Proces_watch, and it doesn't matter if you can't remember the options.

1), because some files relatively large, if the direct xxd, then brush screen brush You also do not see what you want, you can combine the more command to view

That

Xxd Input File | More

This time, you can screen one screen view!!!

2), command option-l, you can see how many bytes are viewed from the beginning of the file, such as viewing the first 16 bytes of content

can be as follows

Xxd-l Length input file

[Email protected]-machine:/tftpboot# xxd-l process_watch0000000:7f45 4c46 0101 0103 0400 0000 0000 0000  . ELF .......

3), if, this display style looks uncomfortable, you can use the-G option, select the number of bytes in the packet, the default is 2

[Email protected]:/tftpboot# xxd-g1-l Process_watch

0000000:7f 4c, at the xx xx, xx  . ELF .......

4), if you want to position the input file as an array form, then select the-i option

[email protected]:/tftpboot# xxd-i Process_watch | moreunsigned char process_watch[] = {0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x03, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00  , 0x00, 0x00, 0x02, 0x00, 0x28, 0x00, 0x01, 0x00, 0x00, 0x00, 0x20, 0xf6, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x02, 0x00, 0x00, 0x04, 0x34, 0x00, 0x20, 0x00, 0x02, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x7f, 0x7e, 0x00, 0x00, 0x7f, 0x7e, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x60, 0x2e, 0x00, 0x00, 0x60, 0x2e, 0x02, 0x00, 0x60, 0x2e, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0xf2, 0xa0, 0xad, 0xd4, 0x55, 0x50, 0x58, 0x21, 0x7c, 0x08, 0x0d, 0x17, 0x00, 0x00, 0x00, 0x00, 0x40, 0x87, 0x01, 0x00, 0x40, 0x87, 0x01, 0x00, 0x34, 0x01, 0x00, 0x00, 0x92, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0xf9, 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x64, 0x00, 0x3f, 0x02, 0x00, 0x28, 0x00, 0x7e, 0x0d, 0XBC, 

5), if you want to start displaying data from a file offset, you need to use the-s option, that is, S=seek

[e-mail protected]:/tftpboot# xxd-g1-s 16-l-process_watch0000010:02-xx-xx-xx-f6-xx-00
   
    .. (..... ... 4 ...
   

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Linux command Xxd