hexdump vs xxd format difference

I was searching for how to do a reverse hexdump and found xxd mentioned. However, it does not seem to work with simply:

xxd -r hexdumpfile > binaryfile

I then compared the difference between outputs of xxd infile and hexdump infile, and found three differences:

1. xxd output has a colon after the address
2. xxd output has the positions in the data reversed (for example, 5a42 in hexdump output becomes 425a in xxd output)
3. There are some extra characters after each line

I only have the hexdumped version of certain files on a server. How can I correctly get back the binary data using xxd?

Solution 1:

There's no one command that I know of that will do the conversion, but it can easily be broken up into a few steps:

1. Strip addresses from hexdump output using sed
2. Convert into binary using xxd
3. Endian conversion (for example, 5a42 becomes 425a) using dd

Here's the full command:

sed 's/^[0-9]*//' hexdump | xxd -r -p | dd conv=swab of=binaryfile

Solution 2:

This answer is a cross-post from https://stackoverflow.com/a/52834021/6770384

You can do the conversion in one sed command. It's sufficient to add the : after the address and change the endianness (switching ab12 to 12ab).

sed -E 's/ /: /;s/ (..)(..)/ \2\1/g;$d' dump | xxd -r

Known Bugs (see comment section)

• A trailing null byte is added if the original file was of odd length (e.g. 1, 3, 5, 7, ..., byte long).
• Repeating sections of the original file are not restored correctly if they were hexdumped using a *.

Solution 3:

Try to add -p.

xxd -r -p hexdumpfile > binaryfile