Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why hex-edit is not reversible?

I've two identical .fit image.

Linux@Linux:~/imgs/ImageTesting# sha256sum hexd_ss.fit ss.fit

dff6b019b590edb3e9c61c984205c5f49a4064be34feb6207c88dc920aad17e0 hexd_ss.fit dff6b019b590edb3e9c61c984205c5f49a4064be34feb6207c88dc920aad17e0 ss.fit

I've changed one bit of hexd_ss.fit

Linux@Linux:~/imgs/ImageTesting# vi hexd_ss.fit

From

0000 0000

To

0000 0001

So I've got two different file size and different hash

> Linux@Linux:~/imgs/ImageTesting# ls -l total 9344
> -rw-r--r-- 1 root root 4781261 Jun 16 15:45 hexd_ss.fit
> -rw-r--r-- 1 root root 4781260 Jun 16 15:33 ss.fit
> 

Linux@Linux:~/imgs/ImageTesting# sha256sum hexd_ss.fit ss.fit

f3277110043b4170c111fa7d4291aa7df23de68c9e504259ae6158e5133faf1a hexd_ss.fit dff6b019b590edb3e9c61c984205c5f49a4064be34feb6207c88dc920aad17e0 ss.fit

But when I've changed that bit 0 again, like before, it remain unchanged in size and as well two different hash.

After changing

> 0000 0001  to > 0000 0000

Linux@Linux:~/imgs/ImageTesting# ls -l

-rw-r--r-- 1 root root 4781261 Jun 16 15:47 hexd_ss.fit
-rw-r--r-- 1 root root 4781260 Jun 16 15:33 ss.fit

Even if I've change two zero bytes to two one bytes the size remain also same. As,

0000 1111

Linux@Linux:~/imgs/ImageTesting# ls -l

-rw-r--r-- 1 root root 4781261 Jun 16 15:47 hexd_ss.fit
-rw-r--r-- 1 root root 4781260 Jun 16 15:33 ss.fit

So my questions are -

  1. Why its not possible to reverse HexEdit ?
  2. How or what other way to reverse the edit to origin ?
like image 456
meAbab Avatar asked Dec 01 '25 09:12

meAbab


1 Answers

I opened my python3.5 binary with vi python3.5, then did :%!xxd, :%!xxd -r, :wq ... and ended up with a file that's 1 byte larger. Note how I didn't even edit anything. You shall use

vi -b <file>

to open binary files with vi... or they get converted when you open them :P

My python3.5 binary got a 0a appended to it - a line feed. After removing this byte, the file was exactly the same as the original again.

like image 125
Arjan Avatar answered Dec 04 '25 01:12

Arjan



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!