Ir al contenido
1337skills 1337skills - Hojas de Trucos

Xxd Commands

xxd is a powerful tool for creating hex dumps of files and for conversion to/from hexadecimal. It can also be used to patch files by creating binary diffs. This cheat sheet covers essential commands for binary file inspection and editing.

Installation

Linux/Ubuntu

sudo apt update
sudo apt install vim-common
# xxd comes with vim

macOS

brew install vim
# or use pre-installed version

Basic Hex Dumping

Simple Hex Dumps

# Create hex dump of file
xxd file.bin

# Create hex dump of specific file
xxd /bin/ls | head

# Hex dump with addresses
xxd file.bin

# Include ASCII representation
xxd file.bin

# Show first 256 bytes
xxd -l 256 file.bin

# Dump entire file
xxd largefile.bin | tail

Output Formatting

# Compact format (16 bytes per line)
xxd file.bin

# Extended format (32 bytes per line)
xxd -c 32 file.bin

# Minimal format (8 bytes per line)
xxd -c 8 file.bin

# Very wide format (256 bytes per line)
xxd -c 256 file.bin

# Plain hex output only (no ASCII)
xxd -p file.bin

# Hex only with addresses
xxd file.bin | cut -d' ' -f1-9

# ASCII only
xxd file.bin | cut -d'|' -f2 | sed 's/\.//g'

Address and Offset Control

# Start at specific offset
xxd -s 100 file.bin

# Skip first 0x100 bytes (hex offset)
xxd -s 0x100 file.bin

# Dump from offset 512 bytes
xxd -s 512 file.bin

# Length of 256 bytes from offset
xxd -s 256 -l 256 file.bin

# Show decimal addresses
xxd -A d file.bin

# Show octal addresses
xxd -A o file.bin

# Show hexadecimal addresses (default)
xxd -A x file.bin

Hex to Binary Conversion

Reverse Operation (-r)

# Convert hex dump back to binary
xxd -r file.hex > file.bin

# Reverse from plain hex
xxd -r -p hexdata.txt > binary.bin

# Reverse hex dump to file
xxd -r dump.hex original.bin

# Reverse specific hex file
cat hexdump.txt | xxd -r > output.bin

# Reverse and save output
xxd -r input.hex output.bin

Batch Conversion

# Convert multiple files
for file in *.hex; do
  xxd -r "$file" "${file%.hex}.bin"
done

# Convert all hex dumps in directory
for f in *.txt; do
  xxd -r -p "$f" "${f%.txt}.bin"
done

# Process hex data from stdin
echo "48656C6C6F" | xxd -r -p

Creating Patches

Generate Binary Diffs

# Create patch between two files
xxd file1.bin > file1.hex
xxd file2.bin > file2.hex
diff file1.hex file2.hex > patch.diff

# Create patch file
diff <(xxd original.bin) <(xxd modified.bin) > changes.patch

# Apply patch to restore file
patch < changes.patch

Binary File Patching

# Apply hex changes with ed
echo -e "H\n1,.s/oldpattern/newpattern/g\nw" | ed file.bin

# Replace bytes at offset
echo -e "48656C6C6F" | xxd -r -s 0 -o file.bin -

# Patch using xxd and diff
xxd -r < patch.hex > output.bin

C Include File Format

Generate C Headers

# Create C include file (char array)
xxd -i file.bin file.h

# Include file with custom name
xxd -i -n mydata file.bin > include.h

# View C include output
xxd -i small_file.bin | head -20

# Large file to C include
xxd -i large_binary > large.h

# Generate with extern declaration
xxd -i -n array_name file.bin > header.h

Using Generated Headers

# Example C code using generated header
cat > use_data.c << 'EOF'
#include "file.h"

int main() {
    printf("Data size: %d\n", file_bin_len);
    return 0;
}
EOF

# Compile with generated header
gcc use_data.c -o use_data

Plain Hex Mode Operations

Plain Hexadecimal Mode (-p)

# Plain hex output (no formatting)
xxd -p file.bin

# Plain hex on one line
xxd -p file.bin | tr -d '\n'

# Plain hex with newlines every 32 chars
xxd -p file.bin | fold -w 32

# Convert plain hex to binary
echo "48656C6C6F576F726C64" | xxd -r -p

# Count hex characters
xxd -p file.bin | wc -c

# Combine multiple hex strings
(xxd -p file1.bin && xxd -p file2.bin) | xxd -r -p > combined.bin

Binary File Comparison

Comparing Files

# Compare binary files as hex
diff <(xxd file1.bin) <(xxd file2.bin)

# Show differences in hex
colordiff <(xxd file1.bin) <(xxd file2.bin)

# Find first difference
diff <(xxd file1.bin) <(xxd file2.bin) | head -5

# Side-by-side comparison
paste <(xxd file1.bin) <(xxd file2.bin) | grep '|'

# Show only changed lines
diff <(xxd old.bin) <(xxd new.bin) | grep '^<\|^>'

Advanced Operations

Binary Search and Replace

# Find hex pattern
xxd file.bin | grep "68656c6c"  # "hell" in hex

# Search for pattern
xxd file.bin | grep -E "[0-9a-f]{32}" | head

# Find and replace with sed
xxd -p file.bin | sed 's/oldpattern/newpattern/' | xxd -r -p > new.bin

# Extract specific bytes
xxd -s 0x100 -l 16 file.bin

# Find all occurrences of pattern
xxd -p file.bin | fold -w 2 | paste -sd '' | grep -o '48656c6c'

Data Extraction

# Extract specific section as binary
xxd -r -s 0x100 -l 64 hexdump.hex > section.bin

# Extract hex range
xxd file.bin | sed -n '10,20p' | xxd -r -p

# Get header bytes
xxd -l 64 file.bin > header.hex
xxd -r header.hex > header.bin

# Extract and convert to ASCII
xxd -r -p < <(xxd -p -s 0 -l 256 file.bin)

String Extraction from Binary

# Find printable strings with positions
xxd -p file.bin | fold -w 2 | paste -sd '' | \
  sed 's/../0x& /g' | od -A x -t c | grep -E '[a-zA-Z]'

# Extract ASCII strings
strings file.bin

# Combined: hex dump with string filter
xxd file.bin | grep -i '[a-f]'

# Show context around printable strings
xxd file.bin | awk '/[a-zA-Z0-9]{4}/'

Performance Tips

Efficient Dumping

# Skip lines starting with zeros
xxd file.bin | grep -v ' 0*$'

# Limit output for large files
xxd -l 1024 largefile.bin

# Process in chunks
split -b 1M large.bin chunk_
for f in chunk_*; do
  xxd "$f" > "${f}.hex"
done

# Memory-efficient processing
head -c 4096 file.bin | xxd

Batch Processing

# Hex dump all files in directory
for file in *.bin; do
  xxd "$file" > "${file}.hex"
done

# Process multiple files
find . -name "*.bin" -exec xxd {} + > alldumps.txt

# Create index of all dumps
for f in *.bin; do
  echo "=== $f ===" >> index.txt
  xxd -l 64 "$f" >> index.txt
done

Troubleshooting and Tips

# Verify file integrity with hex dumps
diff <(xxd file1.bin) <(xxd file2.bin) || echo "Files differ"

# Check file size
xxd file.bin | tail -1

# Find file offset for specific data
xxd -A x file.bin | grep "pattern"

# Create minimal binary file for testing
echo -ne "\x00\x01\x02\x03" | xxd

# Validate hex dump format
xxd -r dump.hex /dev/null && echo "Valid hex"

# Show statistics
xxd file.bin | wc -l

Real-World Examples

# Check file magic bytes
xxd -l 16 /usr/bin/ls

# View PNG header
xxd -l 32 image.png

# Check ZIP file signature
xxd -l 4 archive.zip

# Inspect ELF binary header
xxd -l 64 /bin/bash

# View file metadata
xxd -s 0 -l 256 document.pdf

# Patch configuration file
xxd config.bin | head -5
# (identify bytes to change, then use sed)

Best Practices

  • Use -l to limit output for large files
  • Use -s to skip to relevant file sections
  • Use plain hex (-p) for piping to other tools
  • Preserve hex dumps before binary modifications
  • Always backup original files before patching
  • Use side-by-side comparison for manual verification
  • Document binary format changes with version information
  • Use meaningful naming for generated C header files
  • Validate converted files after hex-to-binary conversion
  • Use address output (-A) consistent across all operations

Last updated: 2026-03-30