xxd

What it does

xxd creates a hexadecimal representation of binary data and, uniquely, can reverse that representation back into the original binary. This makes it ideal for inspection and controlled modification.

How it works (mechanical)

xxd reads input as a stream of bytes and formats it into a structured hex layout with offsets and ASCII. In reverse mode (-r), it parses the hex back into raw bytes, enabling round‑trip edits.

• Byte‑accurate hex formatting
• Fixed‑width rows with offsets
• Reversible text ↔ binary conversion
• Designed to integrate with editors (vim)

10 Practical Examples

# 1) Standard hex + ASCII view
xxd myfile.bin

# 2) Canonical hex format (like hexdump -C)
xxd -g 1 myfile.bin

# 3) View only first 128 bytes
xxd -l 128 myfile.bin

# 4) Skip first 512 bytes
xxd -s 512 myfile.bin

# 5) Continuous hex stream (no offsets)
xxd -p myfile.bin

# 6) Reverse hex back into binary
xxd -r hex.txt output.bin

# 7) Patch a binary safely
xxd myfile.bin > hex.txt
# edit hex.txt
xxd -r hex.txt myfile.bin

# 8) Inspect executable header
xxd -l 64 /bin/ls

# 9) Compare binaries at byte level
diff <(xxd -g 1 file1) <(xxd -g 1 file2)

# 10) Pipe structured data for analysis
xxd -p myfile.bin | tr -d '\n'

Notes & Gotchas

• -r makes edits permanent — keep backups.
• Maintain formatting when reversing hex.
• Byte alignment matters when editing.
• Prefer xxd over hexdump for patching.
• Small edits can have large effects.

Historical Context

xxd originated with the Vim editor as a way to view and edit binary files safely. Its reversible design made it a favorite for low‑level debugging, reverse engineering, and firmware work.

Modern Equivalent / Related Tools

• hexdump — read‑only hex views
• od — alternate numeric formats
• vim -b — binary editing mode
• binwalk — firmware extraction
• patchelf — structured ELF modification