1

I am new to all this. I just got a hex dump of a file and I am confused. I want to ask why the addresses differ by 10. There are only 8 bytes after the offset but next offset after 00000000 is 00000010 and not 00000008.

00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  30 84 04 08 34 00 00 00  |........0...4...|
00000020  ec 22 00 00 00 00 00 00  34 00 20 00 08 00 28 00  |."......4. ...(.|

1 Answer 1

1

00, 10, and 20 are byte offsets in hex. So an offset of "10" is an offset of 16 bytes.

xxd examples

You can specify the byte count per line with xxd's -c flag. Using 16 mimics default behavior:

$ printf "The quick brown fox jumps over the lazy dog" | xxd -c 16
00000000: 5468 6520 7175 6963 6b20 6272 6f77 6e20  The quick brown
00000010: 666f 7820 6a75 6d70 7320 6f76 6572 2074  fox jumps over t
00000020: 6865 206c 617a 7920 646f 67              he lazy dog

Example with 12

Using an offset of 12 instead results in increments of 12 bytes (in hex).

$ printf "The quick brown fox jumps over the lazy dog" | xxd -c 12
00000000: 5468 6520 7175 6963 6b20 6272  The quick br
0000000c: 6f77 6e20 666f 7820 6a75 6d70  own fox jump
00000018: 7320 6f76 6572 2074 6865 206c  s over the l
00000024: 617a 7920 646f 67              azy dog

Converting the offsets, we get the expected result:

0x0c = 12
0x18 = 24
0x24 = 36
3
  • I don't get why "an offset of "10" is an offset of 16 bytes". What 00000010 points to? What is the address of each of the 16 bytes appearing next to the offset?
    – Akhil
    Oct 1, 2019 at 14:05
  • These are not memory addresses. These are offsets from the beginning of the file. Oct 1, 2019 at 17:59
  • 0x0 = 0; 0x4 =4; 0x8 = 8; 0xc = 12; 0x10 = 16; You should check out hex to decimal conversions to get a sense of them Oct 1, 2019 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.