Search code examples
hexreverse-engineeringoffsethexdump

Why are offsets in hex dump 10 more than previous?


I am new to all this. I just got a hex dump of a file and I am confused. I want to ask why the addresses differ by 10. There are only 8 bytes after the offset but next offset after 00000000 is 00000010 and not 00000008.

00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  30 84 04 08 34 00 00 00  |........0...4...|
00000020  ec 22 00 00 00 00 00 00  34 00 20 00 08 00 28 00  |."......4. ...(.|

Solution

  • 00, 10, and 20 are byte offsets in hex. So an offset of "10" is an offset of 16 bytes.

    xxd examples

    You can specify the byte count per line with xxd's -c flag. Using 16 mimics default behavior:

    $ printf "The quick brown fox jumps over the lazy dog" | xxd -c 16
    00000000: 5468 6520 7175 6963 6b20 6272 6f77 6e20  The quick brown
    00000010: 666f 7820 6a75 6d70 7320 6f76 6572 2074  fox jumps over t
    00000020: 6865 206c 617a 7920 646f 67              he lazy dog
    

    Example with 12

    Using an offset of 12 instead results in increments of 12 bytes (in hex).

    $ printf "The quick brown fox jumps over the lazy dog" | xxd -c 12
    00000000: 5468 6520 7175 6963 6b20 6272  The quick br
    0000000c: 6f77 6e20 666f 7820 6a75 6d70  own fox jump
    00000018: 7320 6f76 6572 2074 6865 206c  s over the l
    00000024: 617a 7920 646f 67              azy dog
    

    Converting the offsets, we get the expected result:

    0x0c = 12
    0x18 = 24
    0x24 = 36