Hexdump reverse command

问题

The hexdump command converts any file to hex values.

But what if I have hex values and I want to reverse the process, is this possible?

回答1:

There is a similar tool called xxd. If you run xxd with just a file name it dumps the data in a fairly standard hex dump format:

# xxd bdata
0000000: 0001 0203 0405
......

Now if you pipe the output back to xxd with the -r option and redirect that to a new file, you can convert the hex dump back to binary:

# xxd bdata | xxd -r >bdata2
# cmp bdata bdata2
# xxd bdata2
0000000: 0001 0203 0405

回答2:

If you have only a hexdump generated with hexdump you can use the following command

sed -E 's/ /: /;s/ (..)(..)/ \2\1/g;$d' dump | xxd -r

The sed part converts hexdump's format into xxd's format, at least so far that xxd -r works.

Known Bugs (see comment section)

A trailing null byte is added if the original file was of odd length (e.g. 1, 3, 5, 7, ..., byte long).
Repeating sections of the original file are not restored correctly if they were hexdumped using a *.

回答3:

I've written a short AWK script which reverses hexdump -C output back to the original data. Use like this:

reverse-hexdump.sh hex.txt > data

Handles '*' repeat markers and generating original data even if binary. hexdump -C and reverse-hexdump.sh make a data round-trip pair. It is available here:

GitHub reverse-hexdump repo
Direct to reverse-hexdump.sh

来源：https://stackoverflow.com/questions/43724144/hexdump-reverse-command

标签

Linux

reverse-engineering

hexdump