I have a file, a little bigger than 500MB, that is causing some problems.
I believe the issue is in the end of line (EOL) convention used. I would like to look at the file in its uninterpreted raw form (1) to confirm the EOL convention of the file.
How can I view the "binary" of a file using something built in to Windows 7? I would prefer to avoid having to download anything additional.
(1) My coworker and I opened the file in text editors, and they show the lines as one would expect. But both text editors will open files with different EOL conventions and interpret them automagically. (TextEdit and Emacs 24.2. For Emacs I had created a second file with just the first 4K bytes using head -c4096 on a linux box and opened that from my windows box.
I attempted to use hexl-mode in Emacs, but when I went to hexl-mode and back to text-mode, the contents of the buffer had changed, adding a visible ^M to the end of each line, so I'm not trusting that at the moment.
I believe the issue may be in the end of line character(s) used. The editors my coworker and I tried (1) just automagically recognized the end of line convention and showed us lines. And based on other evidence I believe the EOL convention is carriage return only. (2) return only.
To know what is actually in the file, I would like to look at the binary contents of the file, or at least a couple thousand bytes of the file, preferablely in Hex, though I could work with decimal or octal. Just ones an zeros would be pretty rough to look at.
UPDATE
Except the one suggesting DEBUG, all the answers below work to some extent or another. I have up-voted each of those as helpful. My question was ill-formed. In testing each suggested solution I found I really wanted side by side hex and text contents viewing, and that I wanted it to be something where when I had my cursor over something, either a byte value or the text character, the matching thing on the other side would be highlighted.
I actually solved my problem when Emacs hexl-mode started working "correctly". So I ended up not using any of these answers, only testing them.(Really should investigate the weird Emacs behavior and file a bug-report.)
113 Answers
You need a "hex editor". I've used "Hex Editor Neo" for years and it's very good. It's available in free and paid versions. (And I'm sure there are other similar tools available.)
5If you have powershell version 5.0 or later, you can use the powershell built-in function Format-Hex
PS:21 C:\Temp >Format-Hex application.exe 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 42 4D 5E 00 00 00 00 00 00 00 36 00 00 00 28 00 BM^.......6...(.
00000010 00 00 0A 00 00 00 01 00 00 00 01 00 20 00 00 00 ............ ...
00000020 00 00 00 00 00 00 C4 0E 00 00 C4 0E 00 00 00 00 ......Ä...Ä.....
00000030 00 00 00 00 00 00 B7 59 71 FF B7 59 71 FF B7 59 ......•Yq.•Yq.•Y
00000040 71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF B7 59 q.•Yq.•Yq.•Yq.•Y
00000050 71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF q.•Yq.•Yq.•Yq.Built in, quick and dirty: start powershell, execute:
gc -encoding byte -TotalCount 100 "your_file_path" |% {write-host ("{0:x}" -f $_) -noNewline " "}; write-host TotalCount is count of bytes you want to read from file.
Google 'powershell hexdump' to get much more polished/workable versions.
If you have Windows Resource Kit Tools (not exactly built in, but close) you may also use a cmd line utility called list.exe. It's a small editor with hex mode. Designed specifically to work with big files:
5List Text File Tool (List) is a command-line tool that displays and searches one or more text files. Unlike other text display tools, List does not read the whole file into memory when you open it. It allows a user to edit a text file in a hexadecimal format.
List is useful for displaying text or log files remotely, and for use on servers where administrators are concerned with degradation of system performance.
This also works on everything after XP:
certutil -encodehex MyProgram.exe MyProgram.txt
XP requires the Windows Server 2003 Administration Tools Pack from here :
2Since Windows 7 comes with the dotnet framework 3.5 built in, you will have the C# compiler built in, so you can grab, for example, the listing from and then compile using
\windows\Microsoft.NET\Framework\v3.5\csc printhex.cs and you should end up with a printhex.exe which should display both hex and ascii characters.
2HxD is a portable hex editor, which means no installation necessary, and is nothing more than a single exe file.
Another similarly portable option is Frhed:
3Copy the file to a name with a .COM extension, where the base name is no longer than eight characters. Run
DEBUGyour_filename
It will give a '-' prompt. Type
DEnter
repeatedly to display the file 128 bytes at a time. Type
Daddress Enter
to display 128 bytes starting at address, which must be typed in hex, where the beginning of the file is address 100. Type
Daddress1 address2 Enter
to display from address1 to address2. Type
DaddressLnum Enter
to display num bytes (length) starting at address. num is also entered in hex. Use Q to quit.
For example,
C:\Users\scott\Documents> debug thispost.com
-d
0BE4:0100 43 6F 70 79 20 74 68 65-20 66 69 6C 65 20 74 6F Copy the file to
0BE4:0110 20 61 20 6E 61 6D 65 20-77 69 74 68 20 61 20 2E a name with a .
0BE4:0120 43 4F 4D 20 65 78 74 65-6E 73 69 6F 6E 2C 20 77 COM extension, w
0BE4:0130 68 65 72 65 20 74 68 65-20 62 61 73 65 20 6E 61 here the base na
0BE4:0140 6D 65 20 69 73 20 6E 6F-20 6C 6F 6E 67 65 72 20 me is no longer
0BE4:0150 74 68 61 6E 20 65 69 67-68 74 20 63 68 61 72 61 than eight chara
0BE4:0160 63 74 65 72 73 2E 0D 0A-52 75 6E 20 44 45 42 55 cters...Run DEBU
0BE4:0170 47 20 2A 79 6F 75 72 5F-66 69 6C 65 6E 61 6D 65 G *your_filename
-d
0BE4:0180 2A 0D 0A 49 74 20 77 69-6C 6C 20 67 69 76 65 20 *..It will give
0BE4:0190 61 20 27 2D 27 20 70 72-6F 6D 70 74 2E 0D 0A 54 a '-' prompt...T
0BE4:01A0 79 70 65 20 44 20 45 6E-74 65 72 20 72 65 70 65 ype D Enter repe
0BE4:01B0 61 74 65 64 6C 79 20 74-6F 20 2A 2A 64 2A 2A 69 atedly to **d**i
0BE4:01C0 73 70 6C 61 79 20 74 68-65 20 66 69 6C 65 20 31 splay the file 1
0BE4:01D0 32 38 20 62 79 74 65 73-20 61 74 20 61 20 74 69 28 bytes at a ti
0BE4:01E0 6D 65 2E 0D 0A 54 79 70-65 20 44 20 5F 61 64 64 me...Type D _add
0BE4:01F0 72 65 73 73 5F 20 74 6F-20 64 69 73 70 6C 61 79 ress_ to display
-d 200 L16
0BE4:0200 20 31 32 38 20 62 79 74-65 73 20 73 74 61 72 74 128 bytes start
0BE4:0210 69 6E 67 20 61 74 ing at
-It is not ideal, but if you really don't want to download anything, then you could try using fc /b (ie file compare in binary mode) to compare this file with another completely different file, and it will show you the hex values of each byte that is different. You will may get some values that happen to be the same in the two files and so may be skipped from the output, but you can tell if that happens by checking for missing values in the offset column.
2You can use the PowerShell function below along with Get-Content to see a hexdump of the file contents, i.e., Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump. It takes about 23 seconds to dump a 222 KB file and, if desired, the output can be redirected to a text file to make examining the dump easier.
$encodingAutoCompleter = { param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters) $availableEncodings = ([System.Text.Encoding]::GetEncodings() | Select Name, CodePage, DisplayName) + @( [PSCustomObject] @{ CodePage = '20127'; Name = 'ascii'; DisplayName = 'US-ASCII' }, [PSCustomObject] @{ CodePage = '1200'; Name = 'unicode'; DisplayName = 'Unicode' } ) $availableEncodings | ?{ $_.Name.StartsWith($wordToComplete) } | %{ New-Object System.Management.Automation.CompletionResult -ArgumentList $_.Name, $_.Name, 'ParameterValue', "$($_.DisplayName). Code Page $($_.CodePage)." }
}
function Format-BufferText([byte[]] $buffer, [System.Text.Encoding] $displayEncoding, [switch] $useControlPictures)
{ $bufferChars = $displayEncoding.GetChars($buffer); $bufferText = (($bufferChars | %{ if ([char]::IsControl($_) -eq $true) { if ($useControlPictures -eq $false) { '.' } else { [char] ($_.ToInt16([cultureinfo]::InvariantCulture) + 0x2400) } } else { "$_" } }) -join "") $bufferText
}
<# .Synopsis Displays binary data as a hexadecimal dump. .Description Displays binary data as a hexadecimal dump. Options are available to suppress displaying text and to display control characters as Unicode Control Pictures instead of dots. .Parameter Bytes The bytes to be displayed. .Parameter Encoding The name of the text encoding to use. The default is ascii. .Parameter NoTextDisplay If specified the text display sidebar will be suppressed; otherwise, the display text sidebar will be present. .Parameter UseControlPictures If specified control characters will be displayed as Unicode Control pictures; otherwise, dots are used to represent control characters. .Example Format-HexDump -Encoding unicode $bytes .Example Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump -Encoding unicode .Example 0..255 | Format-HexDump -NoTextDisplay
#>
function Format-HexDump
{ [CmdletBinding()] param ( [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)] [byte[]] $Bytes, [ValidateScript({ if (([System.Text.Encoding]::GetEncodings().Name + @('unicode', 'ascii')) -icontains $_) { return $true } else { Throw "Encoding must be one of the following: $([System.Text.Encoding]::GetEncodings().Name -join ', '), unicode, or ascii." } })] [Parameter(ValueFromPipeline = $false)] [string] $Encoding = "ASCII", [Parameter()] [switch] $NoTextDisplay, [Parameter()] [switch] $UseControlPictures ) BEGIN { $displayEncoding = [System.Text.Encoding]::GetEncoding($Encoding) $counter = 0 $hexRow = "" [byte[]] $buffer = @() } PROCESS { foreach ($byte in $Bytes) { $buffer += $byte $hexValue = $byte.ToString("X2") if ($counter % 16 -eq 0) { $buffer = @($byte) $hexRow = "$($counter.ToString("X8")): $($hexValue) " } elseif ($counter % 16 -eq 15) { if ($NoTextDisplay -eq $true) { $hexRow += "$($hexValue)" $hexRow } else { $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures $hexRow += "$($hexValue) $($bufferText)" $hexRow } } else { $hexRow += "$($hexValue) " } $counter++ } } END { $counter-- if ($counter % 16 -ne 15) { $hexRow += " " * (((16 - $counter % 16) * 3) - 1) if ($NoTextDisplay -eq $false) { $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures $hexRow += "$($bufferText)" } $hexRow } }
}
Register-ArgumentCompleter -CommandName Format-HexDump -ParameterName Encoding -ScriptBlock $encodingAutoCompleterOutput looks like this:
00000000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F ................
00000010: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ................
00000020: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F !"#$%&'()*+,-./
00000030: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 0123456789:;<=>?
00000040: 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F @ABCDEFGHIJKLMNO
00000050: 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F PQRSTUVWXYZ[\]^_
00000060: 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F `abcdefghijklmno
00000070: 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F pqrstuvwxyz{|}~.
00000080: 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F ????????????????
00000090: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F ????????????????
000000A0: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF ????????????????
000000B0: B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 BA BB BC BD BE BF ????????????????
000000C0: C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF ????????????????
000000D0: D0 D1 D2 D3 D4 D5 D6 D7 D8 D9 DA DB DC DD DE DF ????????????????
000000E0: E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 EA EB EC ED EE EF ????????????????
000000F0: F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF ????????????????As Sublime text is my favorite editor, I use its plugin to view hex files.
I know you are using Emacs but Vim users can use xxd utility:
xxd -s <start_offset> -l <length_offest> <file>i.e.
Usage: xxd.exe [options] [infile [outfile]] or xxd.exe -r [-s [-]offset] [-c cols] [-ps] [infile [outfile]]
Options: -a toggle autoskip: A single '*' replaces nul-lines. Default off. -b binary digit dump (incompatible with -ps,-i,-r). Default hex. -c cols format <cols> octets per line. Default 16 (-i: 12, -ps: 30). -E show characters in EBCDIC. Default ASCII. -g number of octets per group in normal output. Default 2. -h print this summary. -i output in C include file style. -l len stop after <len> octets. -ps output in postscript plain hexdump style. -r reverse operation: convert (or patch) hexdump into binary. -r -s off revert with <off> added to file positions found in hexdump. -s [+][-]seek start at <seek> bytes abs. (or +: rel.) infile offset. -u use upper case hex letters. -v show version: "xxd V1.10 27oct98 by Juergen Weigert (Win32)".In Windows PowerShell:
PS C:\Users\YourName\Desktop>Format-Hex file.dllOr its shorter form:
PS C:\Users\YourName\Desktop>fhx file.dllAlternatively, if you prefer to have the hexdump command available, create a batch script that works with both PowerShell and Command Prompt:
- Create a file called hexdump.bat with the following content:
@echo off
powershell Format-Hex %*Copy it to
C:\Windows\System32(requires admin rights)Use it via PowerShell or Command prompt
C:\Users\YourName\Desktop>hexdump file.dll Path: C:\Users\YourName\Desktop\file.dll 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ.............
00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ¸.......@.....
...To view in decimal:comp File1 File2 /D /m
(similar to gc -encoding byte File1 in powershell)
To view in hex:fc /b File1 File2
(similar to gc -encoding byte File1 |% {write-host ("{0:X2}" -f $_)} in powershell)
NB:
File2 is a reference file with no similar characters to File1
If unsure, then a workaround would be to fill File2 with 0x20, then for 2nd comparison fill File2 with 0x00 and replace the missing characters with 0x20 (in the 1st comparison)
(Or just fill the missing offsets with 0x20 in lieu of 2nd comparison)
Update: 15 Oct 2021
powershell 5.1 format-hex seems to have a bug decoding binary files.
A sample test had error displaying offsets 0x290 & 0x7c0 for a 2kB file.
Sample output:
00000280 5B E3 6D 67 2E D9 03 AB 0A DF D7 73 7A 3F 61 9B [ãmg.Ù.«.ß×sz?a
E 4C FB 38 46 91 C7 13 42 92 C7 8A B4 DF E8 6A ÞLû8FÇ.BÇ´ßèj
000002A0 00 0C 3D 68 50 9D D4 9C 1C 92 DB F0 B5 79 5F 4A ..=hPÔ.Ûðµy_J
.
.
.
000007B0 5C F1 20 1F D8 8E EA 9B 03 91 EF 20 87 A4 4D 9B \ñ .Øêï ¤M
0 A5 54 30 1D CC 4F 56 31 C5 39 15 2E 3A A8 8D BC ¥T0.ÌOV1Å9..:¨¼
000007D0 B1 BA 8D 30 58 F5 DE 4F DD 8C 4B 34 22 D5 27 6A ±º0XõÞOÝK4"Õ'jcertutil works well.
Tested on Win 10 x64
