Linux "xxd" Command Line Options and Examples
make a hexdump or do the reverse.

xxd creates a hex dump of a given file or standard input. It can also convert a hex dump back to its original binary form. Like uuencode(1) and uudecode(1) it allows the transmission of binary data in a `mail-safe' ASCII representation, but has the advantage of decoding to standard output.


Usage:

xxd -h[elp]
    xxd [options] [infile [outfile]]
    xxd -r[evert] [options] [infile [outfile]]




Command Line Options:

-cols
8 are all equivalent.
xxd -cols ...
-a
toggle autoskip: A single '*' replaces nul-lines. Default off.
xxd -a ...
-b
Switch to bits (binary digits) dump, rather than hexdump. This option writes octets as eight digits"1"s and "0"s instead of a normal hexadecimal dump. Each line is preceded by a line number in hexadeci‐mal and followed by an ascii (or ebcdic) representation. The command line switches -r, -p, -i do notwork with this mode.
xxd -b ...
-c
format <cols> octets per line. Default 16 (-i: 12, -ps: 30, -b: 6). Max 256.
xxd -c ...
-E
Change the character encoding in the righthand column from ASCII to EBCDIC. This does not change thehexadecimal representation. The option is meaningless in combinations with -r, -p or -i.
xxd -E ...
-g
separate the output of every <bytes> bytes (two hex characters or eight bit-digits each) by a white‐space. Specify -g 0 to suppress grouping. <Bytes> defaults to 2 in normal mode, 4 in little-endianmode and 1 in bits mode. Grouping does not apply to postscript or include style.
xxd -g ...
-h
print a summary of available commands and exit. No hex dumping is performed.
xxd -h ...
-i
output in C include file style. A complete static array definition is written (named after the inputfile), unless xxd reads from stdin.
xxd -i ...
-l
stop after writing <len> octets.
xxd -l ...
-o
add <offset> to the displayed file position.
xxd -o ...
-p
output in postscript continuous hexdump style. Also known as plain hexdump style.
xxd -p ...
-r
reverse operation: convert (or patch) hexdump into binary. If not writing to stdout, xxd writes intoits output file without truncating it. Use the combination -r -p to read plain hexadecimal dumps with‐out line number information and without a particular column layout. Additional Whitespace and line-breaks are allowed anywhere.
xxd -r ...
-seek
When used after -r: revert with <offset> added to file positions found in hexdump.
xxd -seek ...
-s
start at <seek> bytes abs. (or rel.) infile offset. + indicates that the seek is relative to the cur‐rent stdin file position (meaningless when not reading from stdin). - indicates that the seek shouldbe that many characters from the end of the input (or if combined with +: before the current stdin fileposition). Without -s option, xxd starts at the current file position.
xxd -s ...
-u
use upper case hex letters. Default is lower case.
xxd -u ...
-v
show version string.CAVEATSxxd -r has some builtin magic while evaluating line number information. If the output file is seekable, thenthe linenumbers at the start of each hexdump line may be out of order, lines may be missing, or overlapping.In these cases xxd will lseek(2) to the next position. If the output file is not seekable, only gaps areallowed, which will be filled by null-bytes.xxd -r never generates parse errors. Garbage is silently skipped.When editing hexdumps, please note that xxd -r skips everything on the input line after reading enough columnsof hexadecimal data (see option -c). This also means, that changes to the printable ascii (or ebcdic) columnsare always ignored. Reverting a plain (or postscript) style hexdump with xxd -r -p does not depend on the cor‐rect number of columns. Here anything that looks like a pair of hex-digits is interpreted.Note the difference between% xxd -i fileand% xxd -i < filexxd -s +seek may be different from xxd -s seek, as lseek(2) is used to "rewind" input. A '+' makes a differ‐ence if the input source is stdin, and if stdin's file position is not at the start of the file by the timexxd is started and given its input. The following examples may help to clarify (or further confuse!)...Rewind stdin before reading; needed because the `cat' has already read to the end of stdin.% sh -c "cat > plain_copy; xxd -s 0 > hex_copy" < fileHexdump from file position 0x480 (=1024+128) onwards. The `+' sign means "relative to the current position",thus the `128' adds to the 1k where dd left off.% sh -c "dd of=plain_snippet bs=1k count=1; xxd -s +128 > hex_snippet" < fileHexdump from file position 0x100 ( = 1024-768) on.% sh -c "dd of=plain_snippet bs=1k count=1; xxd -s +-768 > hex_snippet" < fileHowever, this is a rare situation and the use of `+' is rarely needed. The author prefers to monitor theeffect of xxd with strace(1) or truss(1), whenever -s is used.EXAMPLESPrint everything but the first three lines (hex 0x30 bytes) of file.% xxd -s 0x30 filePrint 3 lines (hex 0x30 bytes) from the end of file.% xxd -s -0x30 filePrint 120 bytes as continuous hexdump with 20 octets per line.% xxd -l 120 -ps -c 20 xxd.12e5448205858442031202241756775737420313939362220224d616e75616c207061676520666f7220787864220a2e5c220a2e5c222032317374204d617920313939360a2e5c22204d616e207061676520617574686f723a0a2e5c2220202020546f6e79204e7567656e74203c746f6e79407363746e7567Hexdump the first 120 bytes of this man page with 12 octets per line.% xxd -l 120 -c 12 xxd.10000000: 2e54 4820 5858 4420 3120 2241 .TH XXD 1 "A000000c: 7567 7573 7420 3139 3936 2220 ugust 1996"0000018: 224d 616e 7561 6c20 7061 6765 "Manual page0000024: 2066 6f72 2078 7864 220a 2e5c for xxd"..\0000030: 220a 2e5c 2220 3231 7374 204d "..\" 21st M000003c: 6179 2031 3939 360a 2e5c 2220 ay 1996..\"0000048: 4d61 6e20 7061 6765 2061 7574 Man page aut0000054: 686f 723a 0a2e 5c22 2020 2020 hor:..\"0000060: 546f 6e79 204e 7567 656e 7420 Tony Nugent000006c: 3c74 6f6e 7940 7363 746e 7567 <tony@sctnugDisplay just the date from the file xxd.1% xxd -s 0x36 -l 13 -c 13 xxd.10000036: 3231 7374 204d 6179 2031 3939 36 21st May 1996Copy input_file to output_file and prepend 100 bytes of value 0x00.% xxd input_file | xxd -r -s 100 > output_filePatch the date in the file xxd.1% echo "0000037: 3574 68" | xxd -r - xxd.1% xxd -s 0x36 -l 13 -c 13 xxd.10000036: 3235 7468 204d 6179 2031 3939 36 25th May 1996Create a 65537 byte file with all bytes 0x00, except for the last one which is 'A' (hex 0x41).% echo "010000: 41" | xxd -r > fileHexdump this file with autoskip.% xxd -a -c 12 file0000000: 0000 0000 0000 0000 0000 0000 ............*000fffc: 0000 0000 40 ....ACreate a 1 byte file containing a single 'A' character. The number after '-r -s' adds to the linenumbersfound in the file; in effect, the leading bytes are suppressed.% echo "010000: 41" | xxd -r -s -0x10000 > fileUse xxd as a filter within an editor such as vim(1) to hexdump a region marked between `a' and `z'.:'a,'z!xxdUse xxd as a filter within an editor such as vim(1) to recover a binary hexdump marked between `a' and `z'.:'a,'z!xxd -rUse xxd as a filter within an editor such as vim(1) to recover one line of a hexdump. Move the cursor overthe line and type:!!xxd -rRead single characters from a serial line% xxd -c1 < /dev/term/b &% stty < /dev/term/b -echo -opost -isig -icanon min 1% echo -n foo > /dev/term/bRETURN VALUESThe following error values are returned:0 no errors encountered.
xxd -v ...
-1
1 error while parsing options.2 problems with input file.3 problems with output file.4,5 desired seek position is unreachable.
xxd -1 ...