XXD — Command line hex wizardry

xxd is a hex editor for the command line. Its man page states the following:

WARNINGS
The tools weirdness matches its creators brain. Use entirely at your own risk. Copy files. Trace it. Become a wizard.

I love this tool, and I often use it when I need to tweak files. Aside from normal hex dumps, you can also patch binaries quite easily.

Let’s demonstrate this by creating a super simple C program:

#include <stdio.h>
int main(int argc, char **argv) {
  int x = 12345;
  printf(“found value on stack: %d\n”, x);
}

Then let’s compile it:

$ make test
cc     test.c   -o test
$ ./test
found value on stack: 12345
$

Now, 12345 in decimal is 0x3039 in hex.

Due to the little-endian nature of the computer I am using, it’ll be stored as 3930, so let’s do a dirty command to find the offset.

$ xxd -a -g 0 ./test | grep 3930
0000f30: 7dfc488975f0c745ec393000008b75ec }.H.u..E.90…u.

Let’s patch this little guy using xxd and make the number 65535 instead (or 0xffff in hex):

$ echo \
 "0000f30: 7dfc488975f0c745ecffff00008b75ec" | xxd -g 0 -r - ./test

Now let’s run it:

$ ./test
found value on stack: 65535

This is just a tiny example of what xxd can do. Another neat example (this is from xxd’s man-page) is using xxd to read single characters from a serial line.

 $ xxd -c1 < /dev/term/b &
 $ stty < /dev/term/b -echo -opost -isig -icanon min 1
 $ echo -n foo > /dev/term/b

The above is a bit specialized but it’s still cool to see how flexible xxd is.