Linux xxd Command: Create and Reverse Hex Dumps

The xxd command is a standard command-line utility in the Linux operating system used to create hexadecimal representations of binary data, commonly known as hex dumps, and to perform the exact reverse operation. This guide covers how Linux leverages xxd to read files, format raw bytes into human-readable hex and ASCII formats, and reconstruct binary files from existing hex dumps for debugging, analysis, and data patching.

Creating Hex Dumps with xxd

In Linux, xxd generates a hex dump by taking input from a file or standard input and translating every byte into its corresponding two-digit hexadecimal value. By default, running the command against a target file displays three columns: the byte offset in hexadecimal, the hex representations of the data grouped in two-byte pairs, and the printable ASCII equivalents (with non-printable characters represented by periods).

To create a basic hex dump and output it to the terminal, use:

xxd input.bin

To redirect the generated hex dump into a text file for inspection or editing, supply an output filename:

xxd input.bin dump.hex

Linux users can customize this output using various flags:

• Limit Length (-l): Restricts the dump to a specified number of bytes (e.g., xxd -l 64 input.bin reads only the first 64 bytes).
• Group Bytes (-g): Controls the number of bytes grouped together (e.g., xxd -g 1 input.bin outputs individual bytes separated by spaces).
• Plain Hex (-p): Outputs a continuous stream of hexadecimal digits without offsets or ASCII representation.
• C Include Style (-i): Formats the binary data into a C-compatible array definition, which is useful when embedding binary assets into source code.

Reversing Hex Dumps to Binary

The reverse operation, often called "reverting" or "unpacking," uses the -r flag. In this mode, xxd parses standard hex dump formatting—ignoring byte offsets and trailing ASCII characters—and writes the reconstructed raw binary data directly to an output file.

To convert an edited or existing hex dump back into a binary file:

xxd -r dump.hex output.bin

When working with continuous hex strings generated via the plain format (-p), the -p flag must be combined with the reverse flag:

xxd -r -p plain.hex output.bin

Patching and Offset Control

The reverse functionality also allows targeted patching. When an offset is specified in the hex file, xxd -r can write data to specific positions within an existing file without rewriting the entire payload:

• Targeted Write (-seek): Adjusts the file offset before writing the reversed output.
• In-place Patching: Applying an edited hex dump to an existing binary alters only the modified bytes, provided the offset columns match the target locations.

Through this bidirectional translation, Linux utilizes xxd as an essential utility for inspecting compiled code, analyzing corrupted files, modifying payloads, and automating binary file generation within shell scripts.