Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a binary file like this (open in emacs hex mode): How can grep if hex values '22081b00081f091d2733170d123f3114' exists in file?

00000000: 2b08 1b00 1418 0825 0407 3830 271d 170d  +......%..80'...
00000010: 2208 1b00 081f 091d 2733 170d 123f 3114  ".......'3...?1.
00000020: 1909 1b00 0934 1f10 2503 3803 111c 3821  .....4..%.8...8!

In my example, it should return a hit since the hex values I am looking for is in address 0x10.

Thank you.

share|improve this question
What happens if you grep for it? grep 2208 1b00 081f 091d 2733 170d 123f 3114, with the spaces. – terdon Aug 4 '13 at 17:57
grep knows the P option, so you can use grep -aP '\x22\x08\x1b...'. The answer is from… - I guess you're only interested in the retcode, so you should redirect the output to /dev/null. – ott-- Aug 4 '13 at 18:45
Use a hex editor. "Hex Editor Neo" is a good free one for Windows. I'd guess there are some for *nix as well. – Daniel R Hicks Aug 4 '13 at 19:34
See Binary grep on Linux? – Scott Oct 29 '14 at 21:34

3 Answers 3

you can use :

xxd -p /your/file | tr -d '\n' | grep -c '22081b00081f091d2733170d123f3114'

It'll return 1 if the content matches, 0 else.

xxd -p converts the file to plain hex dump, tr -d '\n' removes the newlines added by xxd, and grep -c counts the number of lines matched.

This way, the input is matched whatever is it's position in the file (if it was at position 0x18 in your example, it would have been cut in two and grep would not have matched it without the use of tr). Yet, you do not have its position in the file.

share|improve this answer
This is great, thanks! – Dor Shemer Dec 16 '14 at 8:47

grep can't do this on its own - it operates at a higher level and searches for encoded text.

One solution would be to use od to convert the binary to hex and output that in ASCII which you can then pipe into grep to search for the hex string:

od -t x -A n <input_file> | grep <hex string>

However, this causes further problems because it inserts newlines and spaces to format the hex. To handle that you could try using sed.

share|improve this answer
I wouldn't say that grep can't do it (see @gb0tech's answer and, but the explication that it works on encoded text is definitely right and helpful. There's minimal impact on performance as well if you need to convert everything to a hex string with od before greping. – Karl Richter Oct 29 '14 at 21:04

With later greps, you can most definitely do hex string searches and more, you can do it with full regexp power, such as 'find me this hex sequence followed by 1 or more 0 and then followed by text matching this and this regexp'

grep -aPo '\x01\x00\x00\x00[0-z]+\x00\x00\x00[0-z]+' <file> 

does match login/pass pairs in a file with a binary dump of a protocol stream used for control and retrieval of DHAV-formatted videos in certain IP-DVR systems. That is, the matching piece has to have bytes with hex codes 0x01 0x00 0x00 0x00 followed by ascii login then 0x00, two more 0 bytes and then the password.

share|improve this answer
see as well – Karl Richter Oct 29 '14 at 21:02
Wouldn't you need [!-~]+ for the password? – Scott Oct 29 '14 at 21:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.