Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a binary file like this (open in emacs hex mode): How can grep if hex values '22081b00081f091d2733170d123f3114' exists in file?

00000000: 2b08 1b00 1418 0825 0407 3830 271d 170d  +......%..80'...
00000010: 2208 1b00 081f 091d 2733 170d 123f 3114  ".......'3...?1.
00000020: 1909 1b00 0934 1f10 2503 3803 111c 3821  .....4..%.8...8!

In my example, it should return a hit since the hex values I am looking for is in address 0x10.

Thank you.

share|improve this question
    
What happens if you grep for it? grep 2208 1b00 081f 091d 2733 170d 123f 3114, with the spaces. –  terdon Aug 4 '13 at 17:57
    
grep knows the P option, so you can use grep -aP '\x22\x08\x1b...'. The answer is from stackoverflow.com/questions/6319878/… - I guess you're only interested in the retcode, so you should redirect the output to /dev/null. –  ott-- Aug 4 '13 at 18:45
    
Use a hex editor. "Hex Editor Neo" is a good free one for Windows. I'd guess there are some for *nix as well. –  Daniel R Hicks Aug 4 '13 at 19:34

2 Answers 2

you can use :

xxd -p /your/file | tr -d '\n' | grep -c '22081b00081f091d2733170d123f3114'

It'll return 1 if the content matches, 0 else.

xxd -p converts the file to plain hex dump, tr -d '\n' removes the newlines added by xxd, and grep -c counts the number of lines matched.

This way, the input is matched whatever is it's position in the file (if it was at position 0x18 in your example, it would have been cut in two and grep would not have matched it without the use of tr). Yet, you do not have its position in the file.

share|improve this answer

grep can't do this on its own - it operates at a higher level and searches for encoded text.

One solution would be to use od to convert the binary to hex and output that in ASCII which you can then pipe into grep to search for the hex string:

od -t x -A n <input_file> | grep <hex string>

However, this causes further problems because it inserts newlines and spaces to format the hex. To handle that you could try using sed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.