xxd

xxd creates a hex dump of a binary file, or converts a hex dump back into binary. It ships with Vim and is therefore present on virtually every Linux system — a useful fallback when hexdump, od, or hexedit are unavailable.

Basic usage

# Create a hex dump of a binary file
xxd $BINARY $HEXDUMP
 
# Reconstitute the binary from the dump
xxd -r $HEXDUMP $BINARY

Useful flags

Flag	Effect
-l $N	Dump only the first $N bytes
-s $OFFSET	Start at byte offset $OFFSET
-g 1	Group output in single bytes (default is 2-byte groups)
-c 16	16 bytes per line (the classic hex-editor layout)
-i	Output as a C include file (array definition)
-b	Binary digit dump instead of hex

Practical example

# Inspect the first 256 bytes of a suspicious binary
xxd -l 256 suspicious.bin
 
# Patch a byte at offset 0x40 and write back
xxd -s 0x40 -l 1 suspicious.bin
# ... edit the hex ...
xxd -r -s 0x40 -l 1 patch.hex suspicious.bin

Security relevance

• Malware triage: Quick header inspection before running strings or disassemblers.
• Cheat-sheet favorite: xxd is standard on minimal containers and rescue images where heavier tools are missing.
• File carving: xxd -r can reassemble fragments extracted from memory dumps or packet captures.

Related

• unix-file-descriptors — pipes and redirection are how you feed data into xxd
• bash-port-scanning — another tool in the “available everywhere” UNIX toolkit

Sources

• xxd(1) - make a hexdump or do the reverse - Linux man page
• xxd - Linux Command Library