Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Endianness in Unix hexdump

The following *nix command pipes a hex representation of an IP and port (127.0.0.1:80) into the hexdump command.

printf "\x7F\x00\x00\x01\x00\x50" | hexdump -e '3/1 "%u." /1 "%u:" 1/2 "%u" "\n"'

The -e flag allows an arbitrary format to parse the input. In this case, we are parsing the first three octets of the IP into unsigned decimals followed by a dot. The final octet is also parsed into an unsigned decimal but it is followed by a colon. Finally -- and this is where the problem lies -- the 2 bytes for the port are parsed as a single unsigned decimal followed by a newline.

Depending on the endianness of the system executing this command, the result will differ. A big-endian system will properly show port 80; whereas a little-endian system will show port 20480.

Is there any way to manipulate hexdump to be aware of endianness while still allowing the arbitrary format specification via -e?

like image 409
shrizza Avatar asked Nov 20 '09 16:11

shrizza


People also ask

What does Hexdump do in Unix?

Hexdump is a utility that displays the contents of binary files in hexadecimal, decimal, octal, or ASCII. It's a utility for inspection and can be used for data recovery, reverse engineering, and programming.

What does Hexdump mean in Linux?

In computing, a hex dump is a hexadecimal view (on screen or paper) of computer data, from memory or from a computer file or storage device. Looking at a hex dump of data is usually done in the context of either debugging or reverse engineering.

What is the endianness of Linux?

Although Power already has Linux distributions and supporting applications that run in big endian mode, the Linux application ecosystem for x86 platforms is much larger and Linux on x86 uses little endian mode.

Is Unix big endian?

In the SAS System, the following platforms are considered big endian: IBM mainframe, HP-UX, AIX, Solaris, and Macintosh. The following platforms are considered little endian: VAX/VMS, AXP/VMS, Digital UNIX, Intel ABI, OS/2, and Windows.


1 Answers

I don't know that it can be done with hexdump, but it's easy enough in perl:

$ printf '\x00\x50' | perl -nE 'say unpack "S>"'
80
$ printf '\x00\x50' | perl -nE 'say unpack "S<"'
20480

You can tweak that to get the format you desire. ('say' requires perl 5.10. Use print for perl < 5.10)

(To clarify for the person who wishes to downvote because I didn't "answer the question". I'm suggesting that the OP replace hexdump with perl. Downvote if you must.)

like image 134
William Pursell Avatar answered Sep 30 '22 22:09

William Pursell