Useful Switches for the OD command

Post date: May 9, 2011 6:39:37 AM

Back in the day when it was cool (and necessary) to be able to read memory using a hex dump our dump programs showed memory in a way that was helpful (ish). The Unix command od, is by default is octal but I like hex+ascii better. The other day I found a set of switches that will make it more like the old dump programs by showing the offset in hex, the hex value of the bytes, and the ASCII representation (if any) of the bytes.

$ od -Ax -vtx1z filename

• od : octal dump
• -Ax: print addresses in hex instead of octal
• -v: don't compress duplicate values
• -t x1: print each byte individually in hex (avoids byte swapping on intel)
• z: when applied to -tx1 cause the ascii characters to be printed at the end of the line.

This gives a good output for reading the bytes and to see what the strings are. For example I needed to know the layout of /proc/[pid]/cmdline. With the command below I found that the arguments are delimited by NULL instead of space or newline. (because this is really printing the argv list after it is parsed.

[scott@ssr ~]$ od -Ax -vtx1z /proc/19779/cmdline

000000 2f 75 73 72 2f 62 69 6e 2f 74 6f 70 00 2d 64 00  >/usr/bin/top.-d.<

000010 30 2e 31 00                                      >0.1.<

000014

This could be a candidate for a shell alias in your .bashrc (or similar):

alias xd='od -Ax -vtx1z'