Identifier / Programs / Linux and Unix
xxd
Create a hexadecimal representation (hexdump) from a binary file, or vice-versa. tldr-pages
GTFOBins file-read, file-write 2 documented commands
How xxd is abused
file-read
-rReverse operation: turn a hexdump into a binary file toyboxfile-write
-rReverse operation: turn a hexdump into a binary file toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for xxd.
2 documented commands
file-read unprivileged, with sudo, as SUID
xxd /path/to/input-file | xxd -rfile-write unprivileged, with sudo, as SUID
echo DATA | xxd | xxd -r - /path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for xxd. The identifier reads the line of each that runs xxd.
Everyday use
Generate a hexdump from a binary file and display the output
xxd input_fileIdentifyGenerate a hexdump from a binary file and save it as a text file
xxd input_file output_fileIdentifyDisplay a more compact output, replacing consecutive zeros (if any) with a star
xxd -autoskip input_fileIdentify-oAdd N to display offset toyboxNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of xxd
-c NShow N bytes per line (default 16)-eLittle-endian-g NGroup bytes by adding a ' ' every N bytes (default 2)-iOutput include file (CSV hex bytes, plus C header/footer if not stdin)-l NLimit of N bytes before stopping (default is no limit)-o NAdd N to display offset-pPlain hexdump (30 bytes/line, no grouping. With -c 0 no wrap/group)-rReverse operation: turn a hexdump into a binary file-s NSkip to offset N