In computing, a hex dump is a textual hexadecimal view (on screen or paper) of (often, but not necessarily binary) computer data, from memory or from a computer file or storage device. Looking at a hex dump of data is usually done in the context of either debugging, reverse engineering or digital forensics. [1] Interactive editors that provide a similar view but also manipulating the data in question are called hex editors.
In a hex dump, each byte (8 bits) is represented as a two-digit hexadecimal number. Hex dumps are commonly organized into rows of 8 or 16 bytes, sometimes separated by whitespaces. Some hex dumps have the hexadecimal memory address at the beginning.
Some common names for this program function are hexdump
, hd
, od
, xxd
and simply dump
or even D
.
A sample text file:
0123456789ABCDEF /* ********************************************** */ Table with TABs (09) 1 2 3 3.14 6.28 9.42
as displayed by Unix hexdump
:
00000003031323334353637383941424344454600000100a2f2a202a2a2a2a2a2a2a2a2a2a2a2a00000202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a*00000402a2a202a2f0a095461626c6520776974000005068205441427320283039290a093109090000060320909330a09332e313409362e3238090000070392e34320a0000075
The leftmost column is the hexadecimal displacement (or address) for the values of the following columns. Each row displays 16 bytes, with the exception of the row containing a single *. The * is used to indicate multiple occurrences of the same display were omitted. The last line displays the number of bytes taken from the input.
An additional column shows the corresponding ASCII character translation with hexdump -C
or hd
:
0000000030313233343536373839414243444546|0123456789ABCDEF|000000100a2f2a202a2a2a2a2a2a2a2a2a2a2a2a|./* ************|000000202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a|****************|*000000402a2a202a2f0a095461626c6520776974|** */..Table wit|0000005068205441427320283039290a09310909|h TABs (09)..1..|00000060320909330a09332e313409362e323809|2..3..3.14.6.28.|00000070392e34320a|9.42.|00000075
This is helpful when trying to locate TAB characters in a file which is expected to use multiple spaces.
The -v
option causes hexdump to display all data verbosely:
0000000030313233343536373839414243444546|0123456789ABCDEF|000000100a2f2a202a2a2a2a2a2a2a2a2a2a2a2a|./* ************|000000202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a|****************|000000302a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a|****************|000000402a2a202a2f0a095461626c6520776974|** */..Table wit|0000005068205441427320283039290a09310909|h TABs (09)..1..|00000060320909330a09332e313409362e323809|2..3..3.14.6.28.|00000070392e34320a|9.42.|00000075
The POSIX [2] command od
can be used to display a hex dump with the -t x2 option.
# od-tx2tableOfTabs.txt 00000000: 1f8b 0808 d2e9 9766 0203 6461 7461 322e 00000010: 6269 6e00 0141 02be fd42 5a68 3931 4159 00000020: 2653 59ea 2468 ae00 0017 7fff dadb b7fb 00000030: dbff 5ffb f3fb d776 3d6f fffb dbea fdbd 00000040: 85db edfc ffa9 7def faaf efdf b001 386c 00000050: 1001 a0d0 6d40 01a0 1a00 0006 8006 8000 00000060: 0000 d034 01a1 a34d 0034 3d43 40d0 0d34 00000070: d034 34da 9ea1 b49e a7a8 f29e 5106 4326 00000080: 9a19 1934 d1a0 341a 6234 d018 d468 6834 00000090: 00c9 a308 6434 0000 0308 d068 0680 1900 000000a0: 0034 d068 1a34 d068 c3a7 a41a 0c9a 0d34 000000b0: 641a 0646 8346 4003 4d34 1a68 6806 9a06 000000c0: 9a64 d064 001a 0681 a343 10d0 d00d 1840 000000d0: 01a3 21a0 68c9 a050 008a 0009 619a 9541 000000e0: 25d5 8bc0 0ff3 e679 7fd0 31b2 c784 e7f7 000000f0: 8fcb 33b8 28a5 bf86 4ac4 274f ce21 eeea 00000100: 2c19 2633 60e9 ddd1 8d60 18e9 b189 4a94 00000110: 3a14 ee61 ac8d d369 f545 a964 2617 f1fd 00000120: 72dc 51d1 e601 1071 745d 846c 4677 4ba2 00000130: 0562 5d79 894a 9150 dfe1 8083 e4c0 896f 00000140: b75c d58b 4264 021c 625c c4f2 816a 8907 00000150: 8b80 2b3e 4d2a f1b3 4fb4 6cee a869 1316 00000160: c318 cdb5 b1cd 21c4 a23a 0297 65ae 8a2a 00000170: 0cd2 0864 8a47 ed68 48f3 a65f 5803 dc9f 00000180: b2e5 bbe0 daac 3d56 8c8b 4181 510f 017f 00000190: 1328 9a47 6027 62c1 e4b4 db74 bb3a 9455 000001a0: 07dd fd5b 19b5 e522 32e0 9b3e a3cf 0189 000001b0: 4d9a 5edb 27be 1855 880f 7517 0ec0 a878 000001c0: 2ee0 92a3 e339 4138 5cb7 517a a8b7 4dab 000001d0: 8645 a681 214b 7f27 0cee 8ee5 3f4b 3a60 000001e0: 530a 74b2 8acf 9044 e73c ca09 0d28 e5b4 000001f0: 1471 0963 4a9c 3b75 73c0 4057 0c9c d0f2 .00000200: 132a bb2c cc84 29cf 3568 9101 0a77 f033 00000210: 41a4 8cfa f520 3ed5 8a4a 9528 1314 7b32 00000220: 87c6 4825 698a 921e e1da 8f2d 4237 2da1 00000230: 3f68 051d fe05 08cb 096d 4a17 ed35 2130 00000240: 9d75 6c2f a414 8003 e650 ea14 4eb1 5fe2 00000250: ee48 a70a 121d 448d 15c0 8914 1b20 4102 .00000260: 0000
Character evaluations can be added with the -c option:
0000000 0 1 2 3 4 5 6 7 8 9 A B C D E F 30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 0000020 \n / * * * * * * * * * * * * * 0a 2f 2a 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0000040 * * * * * * * * * * * * * * * * 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0000100 * * * / \n \t T a b l e w i t 2a 2a 20 2a 2f 0a 09 54 61 62 6c 65 20 77 69 74 0000120 h T A B s ( 0 9 ) \n \t 1 \t \t 68 20 54 41 42 73 20 28 30 39 29 0a 09 31 09 09 0000140 2 \t \t 3 \n \t 3 . 1 4 \t 6 . 2 8 \t 32 09 09 33 0a 09 33 2e 31 34 09 36 2e 32 38 09 0000160 9 . 4 2 \n 39 2e 34 32 0a 0000165
In this output the TAB characters are displayed as \t and NEWLINE characters as \n.
In the CP/M 8-bit operating system used on early personal computers, the standard DUMP program would list a file 16 bytes per line with the hex offset at the start of the line and the ASCII equivalent of each byte at the end. [3] : 1-41, 5-40–5-46 Bytes outside the standard range of printable ASCII characters (20 to 7E) would be displayed as a single period for visual alignment. This same format was used to display memory when invoking the D command in the standard CP/M debugger DDT. [3] : 4-5 Later incarnations of the format (e.g. in the DOS debugger DEBUG) changed the space between the 8th and 9th byte to a dash, without changing the overall width.
This notation has been retained in operating systems that were directly or indirectly derived from CP/M, including DR-DOS, MS-DOS/PC DOS, OS/2 and Windows. On Linux systems, the command hexcat produces this classic output format, too. The main reason for the design of this format is that it fits the maximum amount of data on a standard 80-character-wide screen or printer, while still being very easy to read and skim visually.
1234:0000:57696B6970656469612C207468652066Wikipedia, the f1234:0010:72656520656E6379636C6F7065646961ree encyclopedia1234:0020:207468617420616E796F6E652063616Ethat anyone can1234:0030:20656469740000000000000000000000edit...........
Here the leftmost column represents the address at which the bytes represented by the following columns are located. CP/M and various DOS systems ran in real mode on the x86 CPUs, where addresses are composed of two parts (base and offset).
In the above examples the final 00s are non-existent bytes beyond the end of the file. Some dump tools display other characters so that it is clear they are beyond the end of the file, typically using spaces or asterisks, e.g.:
1234:0000:57696B6970656469612C207468652066Wikipedia, the f1234:0010:72656520656E6379636C6F7065646961ree encyclopedia1234:0020:207468617420616E796F6E652063616Ethat anyone can1234:0030:2065646974edit
or
1234:0000:57696B6970656469612C207468652066Wikipedia, the f1234:0010:72656520656E6379636C6F7065646961ree encyclopedia1234:0020:207468617420616E796F6E652063616Ethat anyone can1234:0030:2065646974**********************edit
In mathematics and computing, the hexadecimal numeral system is a positional numeral system that represents numbers using a radix (base) of sixteen. Unlike the decimal system representing numbers using ten symbols, hexadecimal uses sixteen distinct symbols, most often the symbols "0"–"9" to represent values 0 to 9 and "A"–"F" to represent values from ten to fifteen.
The Arctic Archipelago, also known as the Canadian Arctic Archipelago, is an archipelago lying to the north of the Canadian continental mainland, excluding Greenland and Iceland.
Abstract Syntax Notation One (ASN.1) is a standard interface description language (IDL) for defining data structures that can be serialized and deserialized in a cross-platform way. It is broadly used in telecommunications and computer networking, and especially in cryptography.
In computer programming, a magic number is any of the following:
A World Wide Name (WWN) or World Wide Identifier (WWID) is a unique identifier used in storage technologies including Fibre Channel, Parallel ATA, Serial ATA, SCSI and Serial Attached SCSI (SAS).
Peel Association Football Club is a football club from Peel on the Isle of Man. The team competes in the Isle of Man Football League and the players wear red, white and black kits. The Peel A.F.C. plays its home games at the Peel A.F.C. Football Ground, on Douglas Road in Peel.
Snappy is a fast data compression and decompression library written in C++ by Google based on ideas from LZ77 and open-sourced in 2011. It does not aim for maximum compression, or compatibility with any other compression library; instead, it aims for very high speeds and reasonable compression. Compression speed is 250 MB/s and decompression speed is 500 MB/s using a single core of a circa 2011 "Westmere" 2.26 GHz Core i7 processor running in 64-bit mode. The compression ratio is 20–100% lower than gzip.
Transaction Capabilities Application Part, from ITU-T recommendations Q.771-Q.775 or ANSI T1.114 is a protocol for Signalling System 7 networks. Its primary purpose is to facilitate multiple concurrent dialogs between the same sub-systems on the same machines, using Transaction IDs to differentiate these, similar to the way TCP ports facilitate multiplexing connections between the same IP addresses on the Internet.
Intel hexadecimal object file format, Intel hex format or Intellec Hex is a file format that conveys binary information in ASCII text form, making it possible to store on non-binary media such as paper tape, punch cards, etc., to display on text terminals or be printed on line-oriented printers. The format is commonly used for programming microcontrollers, EPROMs, and other types of programmable logic devices and hardware emulators. In a typical application, a compiler or assembler converts a program's source code to machine code and outputs it into a object or executable file in hexadecimal format. In some applications, the Intel hex format is also used as a container format holding packets of stream data. Common file extensions used for the resulting files are .HEX or .H86. The HEX file is then read by a programmer to write the machine code into a PROM or is transferred to the target system for loading and execution. There are various tools to convert files between hexadecimal and binary format, and vice versa.
The women's 3000 m speed skating competition at the 2006 Winter Olympics in Turin, Italy, was held on 12 February, the second day of competition at the Olympics.
QTCH (.qtch) is a filetype used by QuickTime to store audio or video files streamed from a server on the client's computer hard drive.
Motorola S-record is a file format, created by Motorola in the mid-1970s, that conveys binary information as hex values in ASCII text form. This file format may also be known as SRECORD, SREC, S19, S28, S37. It is commonly used for programming flash memory in microcontrollers, EPROMs, EEPROMs, and other types of programmable logic devices. In a typical application, a compiler or assembler converts a program's source code to machine code and outputs it into a HEX file. The HEX file is then imported by a programmer to "burn" the machine code into non-volatile memory, or is transferred to the target system for loading and execution.
OTA Bitmap was a specification designed by Nokia for black and white images for mobile phones.
The first world record in the 400 metres individual medley in long course (50 metres) swimming was recognized by the International Swimming Federation (FINA) in 1957, followed by the women a year later. In the short course (25 metres) swimming events the world's governing body recognizes world records since March 3, 1991.
expand
is a program that converts tab characters into groups of space characters, while maintaining correct alignment. It is available in Unix operating systems and many Unix-like operating systems. The command is available as a separate package for Microsoft Windows as part of the UnxUtils collection of native Win32 ports of common GNU Unix-like utilities.
Boot Service Discovery Protocol (BSDP) is an Apple-developed, standards-conforming extension of DHCP. It allows Macintosh computers to boot from bootable images on a network instead of local storage media such as CD, DVD, or hard disk. The DHCP options used are the "vendor-specific information" option and the "vendor class identifier" option . There are three versions of BSDP, though usually version 1.0 is used. All versions enable a client to choose from several bootable images offered by a server. The reference implementation of BSDP is Darwin's BOOTP server, which is part of Mac OS's NetBoot feature.
The 2003 Hasseröder Premier League was a professional non-ranking snooker tournament that was played from 11 January to 11 May 2003.
Avro is a row-oriented remote procedure call and data serialization framework developed within Apache's Hadoop project. It uses JSON for defining data types and protocols, and serializes data in a compact binary format. Its primary use is in Apache Hadoop, where it can provide both a serialization format for persistent data, and a wire format for communication between Hadoop nodes, and from client programs to the Hadoop services. Avro uses a schema to structure the data that is being encoded. It has two different types of schema languages: one for human editing and another which is more machine-readable based on JSON.