The Wall of Unreadable Garbage
In the Linux operating system, files are generally divided into two categories: human-readable text files (like a Python script or a configuration file) and machine-readable binary files (like an executable program, a compressed ZIP archive, or a JPEG image).
If you use a standard text-reading tool like cat or nano to open a binary file, the terminal will violently explode. It will print thousands of unreadable, chaotic symbols (like and ♠), completely destroying the formatting of your terminal screen. The terminal is trying to force raw, mathematical machine code into English letters, and it fails catastrophically.
If you are a cybersecurity researcher analyzing a suspicious executable file for malware, or a systems administrator trying to mathematically prove that a compiled software package is corrupted, you must read the file exactly as the computer reads it. To safely view the absolute, raw mathematical foundation of any file, you must use the hexdump command.
Step 1: Understanding Hexadecimal
Computers process data in binary (1s and 0s). However, trying to read a screen filled with millions of 1s and 0s is impossible for a human brain to parse. To make binary code slightly more manageable, computer scientists use “Hexadecimal” (Base-16) math.
Hexadecimal compresses long strings of binary into pairs of letters and numbers (e.g., 4F, 2A, FF). The hexdump command translates the unreadable binary data of a file into this strictly formatted, highly organized hexadecimal matrix.
Step 2: The Basic Hex Dump
Assume you have an executable software program named malware.exe.
To safely view the raw code of the file without accidentally running the virus, execute the standard command:
hexdump malware.exe
The terminal will instantly output a massive wall of hexadecimal numbers. The output is divided into highly specific columns. The left column acts as a “line number” (showing the exact byte offset). The middle columns contain the actual hexadecimal translation of the file’s binary data.
Because the output will likely be massive, you should always pipe the command into more so you can scroll through it page by page.
hexdump malware.exe | more
Step 3: The Canonical View (The Holy Grail)
The basic hexdump command is mathematically accurate, but it is incredibly difficult to read. The true power of the command is unlocked by using the -C (Canonical) flag.
hexdump -C malware.exe | more
This completely transforms the output into the legendary “hacker matrix” layout. It displays three highly distinct columns:
- Column 1: The Byte Offset (exactly how deep into the file you are).
- Column 2: The raw Hexadecimal math (e.g.,
4d 5a 90 00). - Column 3: The ASCII Translation.
Column 3 is the most important part of the tool. It attempts to translate the hexadecimal math back into English letters. Most of it will just be dots (.), indicating the math does not translate to English. However, if a hacker hard-coded an IP address or a secret password into the malware, it will suddenly appear in plain English in the right-hand column, completely exposing their secret code.
Step 4: Extracting Specific Chunks
If you are analyzing a 10-gigabyte database file, running a full hexdump will take hours. If you only want to look at the very first few bytes of a file to verify its “Magic Number” (the hidden digital signature that proves what type of file it is), you can restrict the command’s output.
Use the -n (length) flag to tell Linux exactly how many bytes of data to translate before stopping.
hexdump -C -n 16 malware.exe
This command translates exactly the first 16 bytes of the file and instantly stops, providing a lightning-fast forensic snapshot of the file’s header. By mastering the hexdump command, you gain the ability to strip away the illusion of the graphical operating system and stare directly into the mathematical soul of the machine.