Skip to content

xxd

Practical xxd usage for hex dumping, binary inspection, firmware and EFI variable analysis, random data generation, ASCII↔hex conversion, and reverse reconstruction workflows

View hex mode in vim

:%!xxd

Geberate 30x30 matrix

xxd -p /dev/urandom |fold -60|head -30|sed 's/\(..\)/\1 /g'

Convert ascii string to hex

xxd -p <<< <string>

Convert ascii string to hex

echo -n 'text' | xxd -ps | sed -e ':a' -e 's/\([0-9]\{2\}\|^\)\([0-9]\{2\}\)/\1\\x\2/;ta'

Generate a 20-byte random hex string from /dev/urandom

xxd -l 20 -p /dev/urandom

Print exactly 20 bytes → 40 hex chars on one line

xxd -l 20 -p -c 40 /dev/urandom

Read output with 200 columns rather den default

xxd -g 1 -c 200 /sys/firmware/dmi/tables/DMI | head -n5

Hexdump the DMI table with byte-level grouping and wide output (200 columns)

xxd -g 1 -c 200 /sys/firmware/dmi/tables/DMI

Extract ASCII columns for 200 bytes lines

xxd -g 1 -c 200 /sys/firmware/dmi/tables/DMI \
| sed -E 's/^.*  //' \
| tr -cd '[:print:]\n'

Read our BootOrder file in efivars

xxd -g 4 /sys/firmware/efi/efivars/BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c
00000000: 07000000 04000000                    ....

Read bios rom exposed via sysfs (raw dump preview)

xxd -g 1 -c 128 /sys/firmware/dmi/tables/DMI | head -n10

Read legacy bios memory region via /dev/mem (first 1 KB)

dd if=/dev/mem bs=1 count=1024 skip=$((0xF0000)) 2>/dev/null | xxd -g 1

Read option rom area from /dev/mem (C0000h VGA ROM)

dd if=/dev/mem bs=1 count=512 skip=$((0xC0000)) 2>/dev/null | xxd -g 1

Read EFI BootCurrent variable (hex + ASCII)

xxd -g 2 /sys/firmware/efi/efivars/BootCurrent-8be4df61-93ca-11d2-aa0d-00e098032b8c

Read EFI SecureBoot state

xxd -g 1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c

Read EFI SetupMode flag

xxd -g 1 /sys/firmware/efi/efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c

Inspect raw EFI variable payload (skip attributes)

xxd -g 1 -s 4 /sys/firmware/efi/efivars/BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c

Read a binary firmware blob

xxd -g 1 -c 64 firmware.bin | head -n20

Compare two binary files visually

diff <(xxd -g 1 fileA.bin) <(xxd -g 1 fileB.bin)

Reverse hex dump back into binary

xxd -r dump.hex restored.bin

Matrix style (red color)

xxd -p -c1 /dev/urandom \
| awk -v cols="${COLUMNS:-$(tput cols)}" '{b=strtonum("0x"$1); printf (b%8?" ":"%c",48+(b%10)); if(++n%cols==0) print ""}' \
| grep --color=always '[0-9]'

Matrix style (colorless)

xxd -p -c1 /dev/urandom \
| awk -v cols="${COLUMNS:-$(tput cols)}" '{b=strtonum("0x"$1); printf (b%8?" ":"%c",48+(b%10)); if(++n%cols==0) print ""}'

Matrix style (random colors)

xxd -p -c1 /dev/urandom \
| awk -v cols="${COLUMNS:-$(tput cols)}" '
BEGIN {
  split("31 32 33 34 35 36 37 90 92 93 94 95 96", C)
}
{
  b = strtonum("0x"$1)
  if (b % 8) {
    printf " "
  } else {
    color = C[int(rand()*length(C))+1]
    printf "\033[%sm%c\033[0m", color, 48+(b%10)
  }
  if (++n % cols == 0) printf "\n"
}'

The Entropy Scanner

xxd -p -c1 /dev/urandom | awk -v cols="${COLUMNS:-$(tput cols)}" '
BEGIN {
    # Using Unicode block elements for a "solid" high-res look
    split("░ ▒ ▓ █", B)
    # Using a 256-color gradient (Greyscale to Blue/Purple)
    C = "232 235 238 241 244 247 250 253 63 105 147"
    split(C, Colors)
}
{
    v = strtonum("0x"$1)
    # Map 0-255 to our color/block arrays
    b_idx = int(v / 64) + 1
    c_idx = int(v / 24) + 1

    # Print the "pixel"
    printf "\033[38;5;%sm%s\033[0m", Colors[c_idx], B[b_idx]

    if (++n % cols == 0) printf "\n"
}'

The snake variant (Geometric Randomness)

xxd -p -c1 /dev/urandom | awk -v cols=$(tput cols) -v lines=$(tput lines) '
BEGIN { x=int(cols/2); y=int(lines/2); printf "\033[2J" }
{
    v = strtonum("0x"$1)
    # Use the byte to determine direction (UP, DOWN, LEFT, RIGHT)
    dir = v % 4
    if (dir == 0) y--
    else if (dir == 1) y++
    else if (dir == 2) x--
    else x++
    
    # Keep within bounds
    if (x<1) x=1; if (x>cols) x=cols; if (y<1) y=1; if (y>lines) y=lines
    
    # Print at coordinate
    printf "\033[%d;%dH\033[48;5;%dm \033[0m", y, x, (v % 231 + 16)
}'