はじめに

よく忘れるのでメモ

xxd コマンド チートシート

概要

xxd コマンドは、バイナリデータを16進ダンプとして表示したり、逆に16進ダンプからバイナリデータに変換するツール。

16進ダンプの表示

指定したファイルのバイナリデータを16進ダンプとして表示する。

xxd <file>

出力を1行あたり8バイト単位に変更する。

xxd -c 8 <file>

オフセットを非表示にする。

xxd -p <file>

16進ダンプをバイナリに変換

16進ダンプをバイナリに変換する。

xxd -r -p <hex_file> <output_file>

xxd の標準出力を xxd -r にパイプで渡して元のデータを復元する。 下記で、fileとoutput_fileは完全に一致する。

xxd <file> | xxd -r > <output_file>

16進ダンプの一部を表示

指定したバイト数だけ出力する (例: 16バイトのみ表示)。

xxd -l 16 <file>

指定したオフセットから16バイト表示する。

xxd -s 0x10 -l 16 <file>

(0xプレフィックスで16進数を指定できるのは便利)

ビット単位の表示

バイナリデータをビット単位で表示する。

xxd -b <file>

これと-pを組み合わせたところ、-bより-pが後の場合でのみ、正しくplainモードになった。順番が大事なよう。

よく使うオプション

説明 オプション
16進ダンプを表示 xxd <file>
1行のバイト数を指定 -c <bytes>
オフセットを省略 -p
16進ダンプをバイナリに変換 -r
指定バイト数のみ出力 -l <length>
指定オフセットから出力 -s <offset>
ビット単位で表示 -b

個人的によく使うオプション

ASCIIや、行番号を表示しないには

-p,--plain

xxd -p /usr/bin/echo

改行をなくすには

xxd -p /usr/bin/echo | tr -d '\n'

改行位置を変えるには

8バイトで折り返す。 -c <改行バイト数>

xxd -c 8 /usr/bin/echo

参考リンク

man xxdより引用

XXD(1)                                                        General Commands Manual                                                       XXD(1)

NAME
       xxd - make a hex dump or do the reverse.

SYNOPSIS
       xxd -h[elp]
       xxd [options] [infile [outfile]]
       xxd -r[evert] [options] [infile [outfile]]

DESCRIPTION
       xxd  creates  a  hex  dump of a given file or standard input.  It can also convert a hex dump back to its original binary form.  Like uuen‐
       code(1) and uudecode(1) it allows the transmission of binary data in a `mail-safe' ASCII representation, but has the advantage of  decoding
       to standard output.  Moreover, it can be used to perform binary file patching.

OPTIONS
       If  no infile is given, standard input is read.  If infile is specified as a `-' character, then input is taken from standard input.  If no
       outfile is given (or a `-' character is in its place), results are sent to standard output.

       Note that a "lazy" parser is used which does not check for more than the first option letter, unless the option is followed by a parameter.
       Spaces between a single option letter and its parameter are optional.  Parameters to options can be specified in  decimal,  hexadecimal  or
       octal notation.  Thus -c8, -c 8, -c 010 and -cols 8 are all equivalent.

       -a | -autoskip
              Toggle autoskip: A single '*' replaces NUL-lines.  Default off.

       -b | -bits
              Switch  to  bits  (binary  digits) dump, rather than hex dump.  This option writes octets as eight digits "1"s and "0"s instead of a
              normal hexadecimal dump. Each line is preceded by a line number in hexadecimal and followed by an ASCII (or EBCDIC)  representation.
              The command line switches -p, -i do not work with this mode.

       -c cols | -cols cols
              Format  <cols>  octets  per line. Default 16 (-i: 12, -ps: 30, -b: 6). Max 256.  No maximum for -ps. With -ps, 0 results in one long
              line of output.

       -C | -capitalize
              Capitalize variable names in C include file style, when using -i.

       -E | -EBCDIC
              Change the character encoding in the righthand column from ASCII to EBCDIC.  This does not change  the  hexadecimal  representation.
              The option is meaningless in combinations with -r, -p or -i.

       -e     Switch  to  little-endian hex dump.  This option treats byte groups as words in little-endian byte order.  The default grouping of 4
              bytes may be changed using -g.  This option only applies to the hex dump, leaving the ASCII (or  EBCDIC)  representation  unchanged.
              The command line switches -r, -p, -i do not work with this mode.

       -g bytes | -groupsize bytes
              Separate  the output of every <bytes> bytes (two hex characters or eight bit digits each) by a whitespace.  Specify -g 0 to suppress
              grouping.  <Bytes> defaults to 2 in normal mode, 4 in little-endian mode and 1 in bits mode.  Grouping does not apply to  PostScript
              or include style.

       -h | -help
              Print a summary of available commands and exit.  No hex dumping is performed.

       -i | -include
              Output  in  C  include file style. A complete static array definition is written (named after the input file), unless xxd reads from
              stdin.

       -l len | -len len
              Stop after writing <len> octets.

       -n name  |  -name name
              Override the variable name output when -i is used. The array is named name and the length is named name_len.

       -o offset
              Add <offset> to the displayed file position.

       -p | -ps | -postscript | -plain
              Output in PostScript continuous hex dump style. Also known as plain hex dump style.

       -r | -revert
              Reverse operation: convert (or patch) hex dump into binary.  If not writing to stdout, xxd writes into its output file without trun‐
              cating it. Use the combination -r -p to read plain hexadecimal dumps without line number information and without a particular column
              layout. Additional whitespace and line breaks are allowed anywhere. Use the combination -r -b to read a bits dump instead of  a  hex
              dump.

       -R when
              In output the hex-value and the value are both colored with the same color depending on the hex-value. Mostly helping to differenti‐
              ate  printable  and non-printable characters.  when is never, always, or auto.  When the $NO_COLOR environment variable is set, col‐
              orization will be disabled.

       -seek offset
              When used after -r: revert with <offset> added to file positions found in hex dump.

       -s [+][-]seek
              Start at <seek> bytes abs. (or rel.) infile offset.  + indicates that the seek is relative to the current stdin file position (mean‐
              ingless when not reading from stdin).  - indicates that the seek should be that many characters from the end of  the  input  (or  if
              combined with +: before the current stdin file position).  Without -s option, xxd starts at the current file position.

       -u     Use upper-case hex letters. Default is lower-case.

       -v | -version
              Show version string.

CAVEATS
       xxd  -r  has  some  built-in  magic while evaluating line number information.  If the output file is seekable, then the line numbers at the
       start of each hex dump line may be out of order, lines may be missing, or overlapping. In these cases xxd will lseek(2) to the  next  posi‐
       tion. If the output file is not seekable, only gaps are allowed, which will be filled by null-bytes.

       xxd -r never generates parse errors. Garbage is silently skipped.

       When  editing  hex  dumps, please note that xxd -r skips everything on the input line after reading enough columns of hexadecimal data (see
       option -c). This also means that changes to the printable ASCII (or EBCDIC) columns are always ignored. Reverting a plain  (or  PostScript)
       style  hex dump with xxd -r -p does not depend on the correct number of columns. Here, anything that looks like a pair of hex digits is in‐
       terpreted.

       Note the difference between
       % xxd -i file
       and
       % xxd -i < file

       xxd -s +seek may be different from xxd -s seek, as lseek(2) is used to "rewind" input.  A '+' makes a difference if  the  input  source  is
       stdin, and if stdin's file position is not at the start of the file by the time xxd is started and given its input.  The following examples
       may help to clarify (or further confuse!):

       Rewind stdin before reading; needed because the `cat' has already read to the end of stdin.
       % sh -c "cat > plain_copy; xxd -s 0 > hex_copy" < file

       Hex  dump  from file position 0x480 (=1024+128) onwards.  The `+' sign means "relative to the current position", thus the `128' adds to the
       1k where dd left off.
       % sh -c "dd of=plain_snippet bs=1k count=1; xxd -s +128 > hex_snippet" < file

       Hex dump from file position 0x100 (=1024-768) onwards.
       % sh -c "dd of=plain_snippet bs=1k count=1; xxd -s +-768 > hex_snippet" < file

       However, this is a rare situation and the use of `+' is rarely needed.  The author prefers to monitor the effect of xxd with  strace(1)  or
       truss(1), whenever -s is used.

EXAMPLES
       Print everything but the first three lines (hex 0x30 bytes) of file.
       % xxd -s 0x30 file

       Print 3 lines (hex 0x30 bytes) from the end of file.
       % xxd -s -0x30 file

       Print 120 bytes as a continuous hex dump with 20 octets per line.
       % xxd -l 120 -ps -c 20 xxd.1
       2e54482058584420312022417567757374203139
       39362220224d616e75616c207061676520666f72
       20787864220a2e5c220a2e5c222032317374204d
       617920313939360a2e5c22204d616e2070616765
       20617574686f723a0a2e5c2220202020546f6e79
       204e7567656e74203c746f6e79407363746e7567

       Hex dump the first 120 bytes of this man page with 12 octets per line.
       % xxd -l 120 -c 12 xxd.1
       0000000: 2e54 4820 5858 4420 3120 2241  .TH XXD 1 "A
       000000c: 7567 7573 7420 3139 3936 2220  ugust 1996"
       0000018: 224d 616e 7561 6c20 7061 6765  "Manual page
       0000024: 2066 6f72 2078 7864 220a 2e5c   for xxd"..\
       0000030: 220a 2e5c 2220 3231 7374 204d  "..\" 21st M
       000003c: 6179 2031 3939 360a 2e5c 2220  ay 1996..\"
       0000048: 4d61 6e20 7061 6765 2061 7574  Man page aut
       0000054: 686f 723a 0a2e 5c22 2020 2020  hor:..\"
       0000060: 546f 6e79 204e 7567 656e 7420  Tony Nugent
       000006c: 3c74 6f6e 7940 7363 746e 7567  <tony@sctnug

       Display just the date from the file xxd.1
       % xxd -s 0x36 -l 13 -c 13 xxd.1
       0000036: 3231 7374 204d 6179 2031 3939 36  21st May 1996

       Copy input_file to output_file and prepend 100 bytes of value 0x00.
       % xxd input_file | xxd -r -s 100 > output_file

       Patch the date in the file xxd.1
       % echo "0000037: 3574 68" | xxd -r - xxd.1
       % xxd -s 0x36 -l 13 -c 13 xxd.1
       0000036: 3235 7468 204d 6179 2031 3939 36  25th May 1996

       Create a 65537 byte file with all bytes 0x00, except for the last one which is 'A' (hex 0x41).
       % echo "010000: 41" | xxd -r > file

       Hex dump this file with autoskip.
       % xxd -a -c 12 file
       0000000: 0000 0000 0000 0000 0000 0000  ............
       *
       000fffc: 0000 0000 40                   ....A

       Create  a  1  byte file containing a single 'A' character.  The number after '-r -s' adds to the line numbers found in the file; in effect,
       the leading bytes are suppressed.
       % echo "010000: 41" | xxd -r -s -0x10000 > file

       Use xxd as a filter within an editor such as vim(1) to hex dump a region marked between `a' and `z'.
       :'a,'z!xxd

       Use xxd as a filter within an editor such as vim(1) to recover a binary hex dump marked between `a' and `z'.
       :'a,'z!xxd -r

       Use xxd as a filter within an editor such as vim(1) to recover one line of a hex dump.  Move the cursor over the line and type:
       !!xxd -r

       Read single characters from a serial line
       % xxd -c1 < /dev/term/b &
       % stty < /dev/term/b -echo -opost -isig -icanon min 1
       % echo -n foo > /dev/term/b

RETURN VALUES
       The following error values are returned:

       0      no errors encountered.

       -1     operation not supported (xxd -r -i still impossible).

       1      error while parsing options.

       2      problems with input file.

       3      problems with output file.

       4,5    desired seek position is unreachable.

SEE ALSO
       uuencode(1), uudecode(1), patch(1)

WARNINGS
       The tool's weirdness matches its creator's brain.  Use entirely at your own risk. Copy files. Trace it. Become a wizard.

VERSION
       This manual page documents xxd version 1.7

AUTHOR
       (c) 1990-1997 by Juergen Weigert
       <[email protected]>

       Distribute freely and credit me,
       make money and share with me,
       lose money and don't ask me.

       Manual page started by Tony Nugent
       <[email protected]> <[email protected]>
       Small changes by Bram Moolenaar.  Edited by Juergen Weigert.

Manual page for xxd                                                 August 1996                                                             XXD(1)