How to Read a Hexdump

A hexdump displays binary file contents as hexadecimal values alongside their ASCII character equivalents. It is the primary tool for inspecting binary data in files, network packets, and memory.

Anatomy of a hexdump line:

00000010  48 65 6C 6C 6F 20 57 6F  72 6C 64 21 0A 00 FF FE  |Hello World!....|

• Offset (00000010): The byte position in the file (hex). This line starts at byte 16.
• Hex data (48 65 6C...): 16 bytes shown as 2-digit hex values, split into two groups of 8 for readability.
• ASCII column (|Hello World!....|): The printable ASCII representation. Non-printable bytes are shown as dots.

Key hex values to recognize instantly:

• 00 = null byte (string terminator in C)
• 0A = newline (\n, Unix line ending)
• 0D 0A = carriage return + newline (\r\n, Windows line ending)
• 20 = space character
• FF = 255, often used as a marker or maximum value
• 7F = DEL character (127)

Reading file signatures (magic bytes):

Files have identifying byte sequences at the start:

• 89 50 4E 47 = PNG image (.PNG in ASCII)
• 50 4B 03 04 = ZIP archive (and DOCX, XLSX, JAR)
• 25 50 44 46 = PDF file (%PDF)
• FF D8 FF = JPEG image
• 7F 45 4C 46 = ELF executable (.ELF)

Tools for creating hexdumps:

• xxd file.bin — standard on Linux/macOS
• hexdump -C file.bin — canonical format
• od -A x -t x1z file.bin — octal dump with hex output

Being able to read a hexdump fluently is an indispensable skill for debugging file format issues, analyzing network protocols, performing digital forensics, and reverse engineering software.