Thursday, September 22, 2011

visual dump, dump hex bytes in a sane way.

In Unix/Linux OD wants to dump out hex bytes in little endian format.
What this means in the output of the hex bytes is swapped.

Notice the first line, 4047 is really  0x47 0x40 but each pair of bytes is swapped.

$ od -xc dump-263.ts | head
0000000 4047 1231 0000 e001 0000 8083 2113 39c1
          G   @   1 022  \0  \0 001   à  \0  \0 203 200 023   !   Á   9
0000020 5153 ffff ffff ffff ffff ffff ffff ffff
          S   Q   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ
0000040 0000 0001 9f01 fbff 00b8 0100 82b5 4b42
         \0  \0 001  \0 001 237   ÿ   û   ¸  \0  \0 001   µ 202   B   K
0000060 8051 0000 b201 4147 3439 4a03 fdff 8080
          Q 200  \0  \0 001   ²   G   A   9   4 003   J   ÿ   ý 200 200
0000100 00fa fa00 0000 00fa fa00 0000 00fa fa00
          ú  \0  \0   ú  \0  \0   ú  \0  \0   ú  \0  \0   ú  \0  \0   ú

So I have created a little script vd (yea get over it, it stands for visual dump)

$cat vd
od -txC -c -N 128 $1

$vd dump-263.ts
0000000 47 40 31 12 00 00 01 e0 00 00 83 80 13 21 c1 39
          G   @   1 022  \0  \0 001   à  \0  \0 203 200 023   !   Á   9
0000020 53 51 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
          S   Q   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ   ÿ
0000040 00 00 01 00 01 9f ff fb b8 00 00 01 b5 82 42 4b
         \0  \0 001  \0 001 237   ÿ   û   ¸  \0  \0 001   µ 202   B   K
0000060 51 80 00 00 01 b2 47 41 39 34 03 4a ff fd 80 80
          Q 200  \0  \0 001   ²   G   A   9   4 003   J   ÿ   ý 200 200
0000100 fa 00 00 fa 00 00 fa 00 00 fa 00 00 fa 00 00 fa
          ú  \0  \0   ú  \0  \0   ú  \0  \0   ú  \0  \0   ú  \0  \0   ú
0000120 00 00 fa 00 00 fa 00 00 fa 00 00 ff 00 00 01 01
         \0  \0   ú  \0  \0   ú  \0  \0   ú  \0  \0   ÿ  \0  \0 001 001
0000140 43 7c b7 7b 2e b6 5e f6 5d 7b e5 ef 97 7e d4 24
          C   |   ·   {   .   ¶   ^   ö   ]   {   å   ï 227   ~   Ô   $
0000160 f3 40 dd 2e de 6b df 2e b7 7c bd ec bd ef fd 5c
          ó   @   Ý   .   Þ   k   ß   .   ·   |   ½   ì   ½   ï   ý   \

No comments: