How To View Binary File In Linux : Hex Dump Analysis Techniques

Binary files in Linux require special tools like `hexdump` or `xxd` to interpret their raw data. If you’ve ever wondered how to view binary file in linux, you’re not alone—many users need to peek inside executables, images, or compressed archives. This guide will show you the most effective methods, from simple command-line tools to advanced hex editors.

Unlike text files, binary files contain data that isn’t meant to be read directly. When you try to open a binary file with a text editor, you’ll see garbled characters. That’s because binary data uses bytes that don’t map to readable text. But don’t worry—Linux provides several built-in utilities to handle this.

In this article, you’ll learn multiple approaches to view binary files. We’ll cover tools like `xxd`, `hexdump`, `od`, and even GUI options. Each method has its strengths, and by the end, you’ll know exactly which one to use for your situation.

How To View Binary File In Linux

The first step in learning how to view binary file in linux is understanding the core tools. The most common commands are `xxd`, `hexdump`, and `od`. Each displays binary data in hexadecimal format, but they have different options and output styles.

Using Xxd For Binary File Viewing

`xxd` is part of the vim package and is widely available. It can convert binary files to hex and back. To view a binary file, simply run:

xxd filename.bin

This shows the file offset, hexadecimal bytes, and ASCII representation. For example, if you have a file named `data.bin`, the output might look like:

00000000: 7f45 4c46 0201 0300 0000 0000 0000 0000  .ELF............

You can also limit the output to a specific number of bytes. Use the `-l` option:

xxd -l 256 filename.bin

This shows only the first 256 bytes. If you want to skip some bytes, use `-s`:

xxd -s 100 filename.bin

This starts from byte 100. Combining both options gives you precise control over what you see.

Using Hexdump For Detailed Analysis

`hexdump` is another powerful tool, often used for more detailed analysis. It’s part of the `bsdmainutils` package on Debian-based systems. The basic syntax is:

hexdump filename.bin

By default, `hexdump` shows the offset in hexadecimal, followed by the bytes in groups. But you can customize the format. For example, to show only the hex values without ASCII:

hexdump -C filename.bin

The `-C` option gives a canonical format with both hex and ASCII. This is similar to `xxd` but with a different layout. You can also use `-n` to limit bytes:

hexdump -C -n 512 filename.bin

This shows the first 512 bytes. For large files, this is very usefull.

Using Od (Octal Dump) For Binary Files

`od` is the oldest of these tools and uses octal by default. But you can change it to hex with the `-t x1` option:

od -t x1 filename.bin

This outputs each byte as a two-digit hexadecimal number. For a more readable format, use `-A x` to show addresses in hex:

od -A x -t x1z filename.bin

The `z` option adds ASCII representation at the end. `od` is great for scripting because its output is consistent.

Comparing The Tools

Each tool has its niche. `xxd` is best for quick views and converting back to binary. `hexdump` offers more formatting options. `od` is reliable and works on all Unix systems. Here’s a quick comparison:

xxd: Easy to use, can reverse hex to binary
hexdump: Detailed formatting, good for analysis
od: Portable, works on minimal systems

Choose based on your needs. If you’re just starting, `xxd` is the most straightforward.

Advanced Techniques For Binary File Viewing

Beyond basic hex dumps, there are more advanced ways to view binary files. These include using GUI tools, scripting, and understanding file structures.

Using Gui Hex Editors

If you prefer a graphical interface, Linux has several hex editors. The most popular are:

Bless: A full-featured hex editor with a clean interface
Okteta: Part of KDE, works well on any desktop
GHex: Simple and lightweight

To install Bless on Ubuntu:

sudo apt install bless

Then open it and load your binary file. You can navigate, search, and edit bytes directly. This is easier for large files because you can scroll through the data.

Viewing Specific Sections Of A Binary File

Sometimes you only need to see a part of the file. For example, the header of an executable. Use `head` and `tail` with `xxd`:

head -c 100 filename.bin | xxd

This pipes the first 100 bytes to `xxd`. You can also use `dd` to extract a range:

dd if=filename.bin bs=1 skip=100 count=50 | xxd

This skips 100 bytes and reads 50 bytes. This is very usefull for analyzing file formats.

Understanding Binary File Structures

Binary files often have a specific structure. For example, ELF executables start with a magic number `7f 45 4c 46`. Knowing these patterns helps you interpret the data. Use `file` command to identify the type:

file filename.bin

This tells you if it’s an ELF, PNG, or other format. Then you can use tools like `readelf` for ELF files or `pngcheck` for images.

Scripting Binary File Viewing

For repetitive tasks, write a script. Here’s a simple bash function:

view_bin() {
    xxd "$1" | less
}

Add this to your `.bashrc` and use `view_bin filename.bin`. You can also use `awk` or `sed` to process the output.

Common Use Cases For Viewing Binary Files

Knowing how to view binary file in linux is useful in many scenarios. Here are some practical examples.

Analyzing Executable Files

When you download a binary, you might want to check its contents. Use `xxd` to look for suspicious strings:

xxd program.bin | grep -i "http"

This searches for URLs in the binary. You can also check for embedded data or malware signatures.

Debugging File Corruption

If a file is corrupted, viewing its hex can help. Compare the hex dump with a known good version. Use `diff` on the hex outputs:

xxd good.bin > good.hex
xxd bad.bin > bad.hex
diff good.hex bad.hex

This shows exactly where the differences are.

Reverse Engineering Protocols

For network protocols or custom file formats, hex dumps are essential. Capture data with `tcpdump` and analyze it with `xxd`. You can see packet headers and payloads.

Frequently Asked Questions

Q: What is the easiest way to view a binary file in Linux?
A: The easiest way is using `xxd filename.bin` in the terminal. It shows hex and ASCII side by side.

Q: Can I view binary files without installing extra tools?
A: Yes, `xxd`, `hexdump`, and `od` are usually pre-installed. If not, install them via your package manager.

Q: How do I convert hex back to binary?
A: Use `xxd -r` to reverse the hex dump. For example: `xxd -r file.hex > file.bin`.

Q: Why do I see strange characters when I open a binary file in a text editor?
A: Text editors interpret bytes as characters, but binary data isn’t meant for display. Use hex tools instead.

Q: Is there a GUI tool for viewing binary files?
A: Yes, tools like Bless, Okteta, and GHex provide graphical hex editing.

Tips For Efficient Binary File Viewing

Here are some tips to make your work easier:

Use `less` with `xxd` to scroll through large files: `xxd bigfile.bin | less`
Search for specific byte patterns with `grep`: `xxd file.bin | grep “48656c6c6f”`
Save hex dumps to files for later analysis: `xxd file.bin > dump.hex`
Use `watch` to monitor changes: `watch -n 1 ‘xxd file.bin’`

These techniques save time and make the process smoother.

Conclusion

Now you know how to view binary file in linux using multiple tools. Start with `xxd` for quick views, use `hexdump` for detailed analysis, and try `od` for portability. For complex tasks, GUI editors like Bless are excellent. Remember to identify the file type first with `file` to understand its structure.

Practice with different files—executables, images, or archives. The more you use these tools, the more comfortable you’ll become. Binary file viewing is a fundamental skill for any Linux user, whether you’re debugging, reverse engineering, or just curious.

If you run into issues, check the man pages: `man xxd`, `man hexdump`, `man od`. They have all the options you need. Happy hex dumping!