Hackszine.com: Edit binary files in Vi

Edit binary files in Vi

If you've ever wanted to examine or edit a binary file in your favorite text editor, there's an easy way to simulate a vi hex mode. To do this, you just filter the file's contents through the xxd hex dump utility, a trick that can be accomplished right within the vi/vim interface.

To convert a file to hex dump representation, just load your file in vi and type the following:

:%!xxd

This sends the entire contents of the opened document to xxd and loads in the result. At this point, you can view or edit any of the hex data. The ASCII representation is listed to the right, though editing this region will not affect the hex portion of the file.

When you are done, you'll want to convert things back into their binary format before saving. To do this, you run things through xxd again, but this time with the -r option:

:%!xxd -r

Your file should be returned to illegible gibberish, which you can save back out with :wq.

A funny thing I just noticed: OS X binaries all start with the same 4 bytes which, in hex, spell out the phrase "cafe babe". This is just a magic number used to identify the file as an OS X binary, but it's hard not to ascribe some deeper meaning. ;)

Posted by Jason Striegel | Aug 9, 2008 10:00 PM
Linux, Mac | Permalink | Comments (5)

Comments

Newest comments listed first.

Posted by: peder on August 10, 2008 at 5:43 AM

File magic

cafebabe is actually the file magic number of java class files, that suggests that OS X binaries actually are java-programs.

Btw, look at the unix utility 'file' for many more such magic numbers. A typical exe on windows will start with MZ, the initials of Mark Zbikowski, one of the developers of MS-DOS. Binaries on linux start with 0x7f ELF. Most file-formats have such magic numbers.

Posted by: Bader on August 10, 2008 at 12:30 PM

Question

How is cafebabe represented in just 4 bytes?

Posted by: Bader on August 10, 2008 at 12:36 PM

oops

my bad I see it now, I thought it meant 99, 97, 102, 101, 98, 97, 98, 101

Posted by: Tom on August 14, 2008 at 12:30 PM

try bvi

I came accross bvi the other day,

just: sudo apt-get install bvi

then use bvi on your binary file

Posted by: Anonymous Coward on August 16, 2008 at 5:33 PM