RSS
If you've ever wanted to examine or edit a binary file in your favorite text editor, there's an easy way to simulate a vi hex mode. To do this, you just filter the file's contents through the xxd hex dump utility, a trick that can be accomplished right within the vi/vim interface.
To convert a file to hex dump representation, just load your file in vi and type the following:
:%!xxd
This sends the entire contents of the opened document to xxd and loads in the result. At this point, you can view or edit any of the hex data. The ASCII representation is listed to the right, though editing this region will not affect the hex portion of the file.
When you are done, you'll want to convert things back into their binary format before saving. To do this, you run things through xxd again, but this time with the -r option:
:%!xxd -r
Your file should be returned to illegible gibberish, which you can save back out with :wq.
A funny thing I just noticed: OS X binaries all start with the same 4 bytes which, in hex, spell out the phrase "cafe babe". This is just a magic number used to identify the file as an OS X binary, but it's hard not to ascribe some deeper meaning. ;)
cafebabe is actually the file magic number of java class files, that suggests that OS X binaries actually are java-programs.
Btw, look at the unix utility 'file' for many more such magic numbers. A typical exe on windows will start with MZ, the initials of Mark Zbikowski, one of the developers of MS-DOS. Binaries on linux start with 0x7f ELF. Most file-formats have such magic numbers.
Reply to this comment
How is cafebabe represented in just 4 bytes?
Reply to this comment
my bad I see it now, I thought it meant 99, 97, 102, 101, 98, 97, 98, 101
Reply to this comment
I came accross bvi the other day,
just: sudo apt-get install bvi
then use bvi on your binary file
Reply to this comment
0xCAFEBABE and it's relatives (0xDEADBEEF, etc) are used not to determine the executable format but the endianness of the running computer.
If you look through a universal binary you'll see other magic numbers in the file. One 0xBEBAFECA is the same but for the PPC architecture.
Reply to this comment