How to Use the hexyl Command in Linux for Coloured Hex Viewing and Binary Analysis

Debugging corrupted data files, reverse engineering proprietary file structures, and inspecting raw firmware images in Linux often requires a hex viewer. While venerable CLI tools like xxd, hexdump, and od have existed for decades, their monochrome, dense text displays make distinguishing between ASCII text, null bytes, and non-printable control characters mentally taxing. The hexyl command Linux utility modernises binary analysis by introducing vibrant terminal colours that automatically categorize bytes according to their character type.

What Is the hexyl Command in Linux?

Written in Rust, hexyl is an open-source command-line hex viewer designed specifically for human readability. Rather than displaying uniform columns of numbers, hexyl renders a beautifully formatted table with clean Unicode borders, colour-coding each byte based on its category:

• NULL Bytes (0x00): Dimmed grey to make sparse memory regions and zero-padding fade into the background.
• Printable ASCII Characters (0x20–0x7E): Vibrant cyan or green to help you locate embedded strings, URLs, and headers instantly.
• ASCII Whitespace (0x09, 0x0A, 0x0D): Soft green indicators for spaces, tabs, and line breaks.
• ASCII Control Characters (0x01–0x1F): Distinct purple or magenta highlights.
• Non-ASCII and High Bytes (0x80–0xFF): Yellow and red tones representing binary payload data or UTF-8 multi-byte sequences.

How to Install hexyl on Linux

Because hexyl is distributed widely across official repositories, installing it is straightforward on most distributions.

Installing on Debian, Ubuntu, and Linux Mint

On modern Debian and Ubuntu releases, install the pre-compiled binary package directly via APT:

sudo apt update
sudo apt install hexyl

Installing on Arch Linux and Fedora

On Arch Linux, install hexyl from the extra repository:

sudo pacman -S hexyl

On Fedora, install it through DNF:

sudo dnf install hexyl

Installing via Cargo

If you prefer maintaining CLI utilities via Rust’s toolchain, run:

cargo install hexyl

Viewing Binary Files with hexyl

To inspect any binary file, executable, or compressed archive, pass the file path to hexyl:

hexyl image.png

Hexyl outputs a three-part table:

1. Offset Column: The hexadecimal memory byte address along the left edge.
2. Hexadecimal Byte Grid: Sixteen bytes per row grouped into two eight-byte blocks, colour-coded by category.
3. ASCII Representation: The right-hand column displaying the decoded printable characters or placeholder dots for non-printable bytes.

Controlling Output Scope and Offsets

When analysing multi-gigabyte disk images or large executables, viewing the entire file is inefficient. Hexyl provides precise slicing options:

Limiting Byte Length

To view only the first 256 bytes of a file (such as inspecting file headers):

hexyl -n 256 firmware.bin

You can also use human-readable size units, such as -n 2kB or -n 1MB.

Starting from a Specific Offset

To skip past known headers and begin reading from a specific byte offset:

# Skip the first 1024 bytes (decimal)
hexyl -r 1024:2048 dump.raw

# Seek using hexadecimal notation (0x400)
hexyl -r 0x400:0x800 dump.raw

Piping Streams into hexyl

Hexyl integrates smoothly into Unix pipeline operations, accepting input directly from standard input (stdin):

head -c 128 /dev/urandom | hexyl

You can also pipe the output of network packet dumps or curl responses to inspect raw response bytes:

curl -s https://digitash.com/favicon.ico | hexyl -n 128

Paging Through Massive Dumps

Because hexyl utilizes ANSI escape codes for terminal colouring, passing output into standard less directly can strip colours. To preserve syntax highlighting while paging through long outputs, use the -R flag with less:

hexyl bigfile.bin | less -R