Hex dump - AbsoluteAstronomy.com

Computing

Computing is usually defined as the activity of using and improving computer hardware and software. It is the computer-specific part of information technology...

, a hex dump is a hexadecimal

Hexadecimal

In mathematics and computer science, hexadecimal is a positional numeral system with a radix, or base, of 16. It uses sixteen distinct symbols, most often the symbols 0–9 to represent values zero to nine, and A, B, C, D, E, F to represent values ten to fifteen...

view (on screen or paper) of computer data, from RAM

Ram

-Animals:*Ram, an uncastrated male sheep*Ram cichlid, a species of freshwater fish endemic to Colombia and Venezuela-Military:*Battering ram*Ramming, a military tactic in which one vehicle runs into another...

or from a file or storage device. Each byte

Byte

The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer...

(8-bit

Bit

A bit is the basic unit of information in computing and telecommunications; it is the amount of information stored by a digital device or other physical system that exists in one of two possible distinct states...

s) is represented as a two-digit hexadecimal

Hexadecimal

number. Hex dumps are commonly organized into rows of 8 or 16 bytes, sometimes separated by whitespaces. Some hex dumps have the hexadecimal memory address

Memory address

A digital computer's memory, more specifically main memory, consists of many memory locations, each having a memory address, a number, analogous to a street address, at which computer programs store and retrieve, machine code or data. Most application programs do not directly read and write to...

at the beginning and checksum

Checksum

A checksum or hash sum is a fixed-size datum computed from an arbitrary block of digital data for the purpose of detecting accidental errors that may have been introduced during its transmission or storage. The integrity of the data can be checked at any later time by recomputing the checksum and...

byte at the end of each line.

Although the name implies the use of base-16 output, some hex dumping software may have options for base-8 (octal) or base-10 (decimal) output. Some common names for this program function are hexdump, od

Od (Unix)

od is an octal dumping program for Unix and Unix-like systems. It can also dump hexadecimal or decimal data.od is one of the earliest Unix programs, having appeared in version 1 AT&T Unix. It is also specified in the POSIX standards...

and simply dump or even D.

Samples

A sample partial hex dump of a program, as produced by the Unix

Unix

Unix is a multitasking, multi-user computer operating system originally developed in 1969 by a group of AT&T employees at Bell Labs, including Ken Thompson, Dennis Ritchie, Brian Kernighan, Douglas McIlroy, and Joe Ossanna...

program hexdump:



 00105e0 e6b0 343b 9c74 0804 e7bc 0804 e7d5 0804

 00105f0 e7e4 0804 e6b0 0804 e7f0 0804 e7ff 0804

 0010600 e80b 0804 e81a 0804 e6b0 0804 e6b0 0804

The above example, however, represents an ambiguous form of hex dump, as the byte order may be uncertain. Such hex dumps are good only in the context of a well-known byte order standard or when values are intentionally given in their full form (and may result in variable number of bytes), such as:



 00105e0 e6 b008 04e79e08 04e7bc 08 04 e7 d50804

When explicit byte sequence is required (for example for hex dump of machine code

Machine code

Machine code or machine language is a system of impartible instructions executed directly by a computer's central processing unit. Each instruction performs a very specific task, typically either an operation on a unit of data Machine code or machine language is a system of impartible instructions...

programs or ROM

Read-only memory

Read-only memory is a class of storage medium used in computers and other electronic devices. Data stored in ROM cannot be modified, or can be modified only slowly or with difficulty, so it is mainly used to distribute firmware .In its strictest sense, ROM refers only...

content) a byte-by-byte representation is favoured, commonly organized in 16-byte rows with an optional divider between 8-byte groups:



 00105e0 e6 b0 08 04 e7 9e 08 04-e7 bc 08 04 e7 d5 08 04

 00105f0 e7 e4 08 04 e6 b0 08 04-e7 f0 08 04 e7 ff 08 04

 0010600 e8 0b 08 04 e8 1a 08 04-e6 b0 08 04 e6 b0 08 04

Rarely a condensed form is also used, without whitespaces between values:



 00105e0 e6b00804e79e0804e7bc0804e7d50804

 00105f0 e7e40804e6b00804e7f00804e7ff0804

 0010600 e80b0804e81a0804e6b00804e6b00804

A Unix default display of those same bytes as two-byte words on a modern x86 (little-endian) computer would usually look like this:



 00105e0 b0e6 0408 9ee7 0408 bce7 0408 d5e7 0408

 00105f0 e4e7 0408 b0e6 0408 f0e7 0408 ffe7 0408

 0010600 0be8 0408 1ae8 0408 b0e6 0408 b0e6 0408

Often an additional column shows the corresponding ASCII

ASCII

The American Standard Code for Information Interchange is a character-encoding scheme based on the ordering of the English alphabet. ASCII codes represent text in computers, communications equipment, and other devices that use text...

text translation:



0000: FF D8 FF E0 00 10 4A 46-49 46 00 01 02 01 00 48  ......JFIF.....H

0010: 00 48 00 00 FF ED 0A 96-50 68 6F 74 6F 73 68 6F  .H......Photosho

0020: 70 20 33 2E 30 00 38 42-49 4D 04 04 07 43 61 70  p 3.0.8BIM...Cap

When hex dumps are intended to be manually entered into a computer, such as was the case with print magazine articles of home computer

Home computer

Home computers were a class of microcomputers entering the market in 1977, and becoming increasingly common during the 1980s. They were marketed to consumers as affordable and accessible computers that, for the first time, were intended for the use of a single nontechnical user...

era a checksum

Checksum

byte (or two) would be added at the end of each row, commonly calculated as simple 256 modulo

Modulo operation

In computing, the modulo operation finds the remainder of division of one number by another.Given two positive numbers, and , a modulo n can be thought of as the remainder, on division of a by n...

of sum of all values in the row or a more sophisticated CRC

Cyclic redundancy check

A cyclic redundancy check is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data...

. This checksum would be used to determine whether users entered the row correctly or not.

Compression of duplicate lines

In the Unix programs od and hexdump, not all lines of display output that contain the same data as the previous line are shown; instead, a line containing just one asterisk is displayed. For example, a block of all zeros is printed as:



 0000000 0000 0000 0000 0000 0000 0000 0000 0000

 *

 0000030

This compression feature makes a useful tool for inspecting large files or complete devices for irregularities. In a modern Linux system, it is convenient to scan an entire hard drive to check if it is all blank:



 # hexdump /dev/sda (replace sda with the proper name for the device to be scanned)

The -v option causes hexdump and od to display all input data, explicitly:



 0000000 0000 0000 0000 0000 0000 0000 0000 0000

 0000010 0000 0000 0000 0000 0000 0000 0000 0000

 0000020 0000 0000 0000 0000 0000 0000 0000 0000

od and hexdump

On Unix/POSIX/GNU systems: "The utilities od and hexdump output octal, hex, or otherwise encoded bytes from a file or stream... Depending on your system type, either or both of these two utilities will be available--BSD systems deprecate od for hexdump , GNU systems the reverse. The two utilities, however, have exactly the same purpose, just slightly different switches."http://gnosis.cx/publish/programming/text_utils.html

DUMP, DDT and DEBUG

In the CP/M

CP/M

CP/M was a mass-market operating system created for Intel 8080/85 based microcomputers by Gary Kildall of Digital Research, Inc...

8 bit operating system used on early personal computers, the standard DUMP program would list a file 16 bytes per line with the hex offset at the start of the line and the ASCII equivalent of each byte at the end . Bytes outside the standard range of printable ASCII characters (20 to 7E) would be displayed as a single period for visual alignment. This same format was used to display memory when invoking the D command in the standard CP/M debugger DDT. Later incarnations of the format changed the space between the 8th and 9th byte to a dash without changing the overall width.

This notation has been retained in operating systems that were directly or indirectly derived from CP/M, including DR-DOS

DR-DOS

DR-DOS is an MS-DOS-compatible operating system for IBM PC-compatible personal computers, originally developed by Gary Kildall's Digital Research and derived from Concurrent PC DOS 6.0, which was an advanced successor of CP/M-86...

, MS-DOS

MS-DOS

MS-DOS is an operating system for x86-based personal computers. It was the most commonly used member of the DOS family of operating systems, and was the main operating system for IBM PC compatible personal computers during the 1980s to the mid 1990s, until it was gradually superseded by operating...

, OS/2

OS/2

OS/2 is a computer operating system, initially created by Microsoft and IBM, then later developed by IBM exclusively. The name stands for "Operating System/2," because it was introduced as part of the same generation change release as IBM's "Personal System/2 " line of second-generation personal...

and MS-Windows. On Linux systems, the command hexcat produces this classic output format too. The main reason for the design of this format is that it fits the maximum amount of data on a standard 80 character wide screen or printer, while still being very easy to read and skim visually.



1234:0100 FF D8 FF E0 00 10 4A 46-49 46 00 01 02 01 00 48  ......JFIF.....H

1234:0110 00 48 00 00 FF ED 0A 96-50 68 6F 74 6F 73 68 6F  .H......Photosho

1234:0120 70 20 33 2E 30 00 38 42-49 4D 04 04 07 43 61 70  p 3.0.8BIM...Cap

External links

hexdump Linux in a Nutshell
Manual on How to Use the Hexdump Unix Utility Argument Description
HEXDUMP(1) BSD General Commands Manual
Online Hex Dump
Doing a Reverse Hex Dump using xxd command
Online Hex Dump and Binary Dump from Rankophiliacs You can upload a file up to 20 megabytes, and download the text.
hdr Hexdump with colored ranges to ease visualization. Options to skip data, displaying bitfields, complex range definition, ... follow the link to 'hdr_examples.pod'.
Data::HexDump::Range Module used by the hdr command. Use it to create applications that display complex binary data.
hexd Hexdump with colored ranges application part of libma.

The source of this article is wikipedia, the free encyclopedia. The text of this article is licensed under the GFDL.