Hex Comparison: Which Code Wins? In the world of development, debugging, and reverse engineering, analyzing raw binary data is a daily necessity. Two of the most popular terminal-based hex tools for Unix-like systems are xxd and hexdump. Both allow you to peer into the machine code of files, but they serve different workflows.
Here is how they stack up so you can decide which tool wins a permanent spot in your terminal toolkit. The Contenders: xxd vs. hexdump
xxd: Created by Juergen Weigert, this tool is famously bundled with the Vim text editor. It creates a hex dump of a given file or standard input and, crucially, can perform the reverse operation to turn hex text back into a binary file.
hexdump: Part of the util-linux package, this is a native, lightweight utility present on almost every Linux system by default. It is designed for filtering and displaying files in a variety of user-specified formats. Round 1: Default Readability
When you run a command without any flags, readability matters most.
xxd output: Highly structured and intuitive. It displays the file offset, followed by the hex representation grouped in two-byte chunks, and concludes with a human-readable ASCII translation column on the right.
hexdump output: By default, hexdump displays data in 2-byte hexadecimal units separated by spaces, but without the ASCII translation column. This makes it difficult to quickly spot strings or text patterns hidden inside code.
Winner: xxd. Out of the box, xxd gives you the complete visual picture immediately. Round 2: Reversibility (The Killer Feature)
Sometimes you do not just want to read machine code—you need to patch it.
xxd: Features a powerful “revert” flag (-r). You can export a binary to text, edit the hex values using any basic text editor, and then run xxd -r to stitch it back into a working binary file.
hexdump: Strictly a one-way street. It can read and format data flawlessly, but it cannot convert a text-based hex dump back into a binary payload.
Winner: xxd. The ability to patch binaries on the fly makes it indispensable for reverse engineers. Round 3: Customization and Formatting Different debugging tasks require different data views.
xxd: Offers reliable, standard flags. You can change the column count with -c or switch to a continuous bit stream using -b. However, its output structure remains relatively rigid.
hexdump: Features a highly flexible format string argument (-e). This allows you to write custom scripts to parse data structures precisely how you want them, controlling exactly how many bytes are processed per iteration.
Winner: hexdump. For advanced scripting and custom data parsing, its formatting engine is vastly superior. Round 4: Speed and Availability
Efficiency matters when parsing massive firmware dumps or multi-gigabyte logs.
xxd: Requires Vim to be installed on the system to guarantee its presence. While common, it is occasionally absent in ultra-minimal Docker containers or embedded environments.
hexdump: Written in C as a core utility, it is incredibly lightweight, blindingly fast, and virtually guaranteed to exist on any Linux machine you SSH into.
Winner: hexdump. It takes the crown for raw speed and universal availability. The Verdict: Which Code Wins?
The winner depends entirely on your specific mission objective:
Choose xxd if you are reverse engineering, modifying files, or need to quickly read ASCII strings alongside raw hex. Its two-way conversion makes it the supreme tool for binary patching.
Choose hexdump if you are writing automation scripts, working on minimal embedded systems, or need to parse custom data structures with extreme precision.
For the everyday developer, xxd wins the convenience battle, while hexdump wins the system administration war.
To help tailor this breakdown for your specific project, tell me:
What operating system or environment are you deploying these tools on?
Leave a Reply