How to Use the Command 'hexdump' (with Examples)

The hexdump command is a convenient tool found in Unix-like operating systems for displaying binary file content in various human-readable formats. It is particularly useful for those who need to inspect data at a byte level, assisting in debugging, analyzing binary files or even reverse-engineering data structures.

Use case 1: Print the Hexadecimal Representation of a File, Replacing Duplicate Lines by ‘*’

Code:

hexdump path/to/file

Motivation:

This command is ideal when you want a quick hex overview of a file, helping spot patterns or anomalies within the binary data. By replacing consecutive, identical lines with an asterisk, it provides a concise view, making it easier to identify meaningful changes or content within large, repetitive files.

Explanation:

• hexdump: The command itself, initiating the operation to display file contents in hexadecimal form.
• path/to/file: The path to the target file you wish to examine, which specifies the source of the data for the command.

Example Output:

0000000 4865 6c6c 6f2c 2057 6f72 6c64 210a 2a2a
0000010 2a48 656c 6c6f 2c20 576f 726c 6421 0a00
*
0000020 0000

Here, the ‘Hello, World!’ repeated content is replaced with asterisks between 0000010 to 0000020, condensing repetitive output.

Use case 2: Display the Input Offset in Hexadecimal and its ASCII Representation in Two Columns

Code:

hexdump -C path/to/file

Motivation:

This use case shines in situations where both hexadecimal representation and ASCII conversion are necessary, such as when debugging programs or interpreting binary protocols. It offers a detailed juxtaposition of both encoded and human-readable data, enhancing comprehension of the file’s structure.

Explanation:

• hexdump: Initiates the hex view of the file.
• -C: Option to print the full-width hex byte values alongside ASCII representations, aiding in visual identification of text within binary formats.
• path/to/file: Specifies the file to be investigated.

Example Output:

00000000  48 65 6c 6c 6f 2c 20 57  6f 72 6c 64 21 0a 00 00  |Hello, World!...|
00000010  48 65 6c 6c 6f 2c 20 57  6f 72 6c 64 21 0a 00 00  |Hello, World!...|
...

Here, the offset 00000000 is followed by each byte’s hex value and its ASCII, providing a clear, readable format.

Use case 3: Display the Hexadecimal Representation of a File, but Interpret Only n Bytes of the Input

Code:

hexdump -C -nnumber_of_bytes path/to/file

Motivation:

You may not need to inspect an entire file, especially when it is large, or if you know the relevant data is at the beginning. This approach focuses on a specific number of bytes, making it efficient for examining header information or part of binary files without processing unnecessary data.

Explanation:

• hexdump: Initiates the hex decoding process.
• -C: Offers a dual output of hex values and their ASCII equivalents.
• -nnumber_of_bytes: Limits the output to the specified number of bytes, a precise means of analyzing a data slice.
• path/to/file: File location to be inspected, providing the input source.

Example Output for -n16:

00000000  48 65 6c 6c 6f 2c 20 57  6f 72 6c 64 21 0a        |Hello, World!.|

Only the first 16 bytes are revealed, focusing on initial data.

Use case 4: Don’t Replace Duplicate Lines with ‘*’

Code:

hexdump --no-squeezing path/to/file

Motivation:

In contrast to suppressing identical lines with an asterisk, this command is beneficial when you need an exhaustive, line-by-line view of file contents, essential for exacting data analysis or reverse engineering where every byte’s detail is crucial.

Explanation:

• hexdump: Engages the command to convert file data into hexadecimal format.
• --no-squeezing: Ensures full output without line-condensing, so no data patterns are hidden.
• path/to/file: Refers to the file path that provides data for inspection.

Example Output:

0000000 4865 6c6c 6f2c 2057 6f72 6c64 210a 0000
0000010 4865 6c6c 6f2c 2057 6f72 6c64 210a 0000
0000020 4865 6c6c 6f2c 2057 6f72 6c64 210a 0000
0000030 0000

Each repeated sequence is shown in full, providing comprehensive visibility into redundant content.

Conclusion:

Understanding and mastering the hexdump command can significantly aid in file inspection, debugging, data analysis, and much more. Whether you need a condensed overview of repetitive binary data or intricate full disclosure, hexdump offers flexibility and insights critical to various tech fields.