Write byte at address (hexedit/modify binary from the command line)

Question

Is there any straightforward way to modify a binary from the commandline?

Let's say I know that my binary contains 1234ABCD and I want to change it to 12FFABCD or FFFFABCD or maybe even FF34FFABC0 (you get the idea) :-)

How might I achieve that without using any special purpose tools like Swiss File Knife or similar?

It would be great to do it just from the command line with only standard Linux tools.

Or maybe even better, instead for searching for the hexadecimal string I want to replace directly writing FF at offset 0x10000, 12 at offset 0x100001 and so on.

It should be scriptable and run directly from the command line. I am looking for something like "binary-which-is-included-in-the-distro --write AB --at-offset 100000 --file thebinary.bin". I am quite sure that it is possible with dd, but I wasn't able to wrap my head around the man page.

Peter Mortensen · Accepted Answer · 2022-05-25 20:42:43Z

140

printf '\x31\xc0\xc3' | dd of=test_blob bs=1 seek=100 count=3 conv=notrunc

dd arguments:

of | file to patch
bs | 1 byte at a time please
seek | go to position 100 (decimal)
conv=notrunc | don't truncate the output after the edit (which dd does by default)

One Josh looking out for another ;)

edited May 25, 2022 at 20:42

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Apr 7, 2011 at 19:18

Josh

6,5832 gold badges24 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

ben Over a year ago

Beautiful elegant solution! Is it possible to insert bytes using this command as well? Or to output the patched file to a different filename? Or for the seek position to be based on a variable like the filesize?

Adam Haun Over a year ago

This is a great solution, but sadly, it doesn't work with BusyBox. BusyBox's implementation of dd doesn't support conv=notrunc (or conv=anything, for that matter).

markzz Over a year ago

Be sure to note that seek may not be in bytes, but in the size of obs.

Marcel Over a year ago

@AdamHaun BusyBox's dd does support some conv= options, including conv=notrunc, and I have verified that this solution works with BusyBox in its default configuration (BusyBox is very configurable and this feature can be disabled in custom builds).

baptx Over a year ago

This overwrites data. To append data at a specific position instead, the second solution of this answer worked: askubuntu.com/questions/1276339/…

|

Peter Mortensen · Accepted Answer · 2022-05-25 20:50:26Z

14

The printf + dd based solutions do not seem to work for writing out zeros. Here is a generic solution in Python 3 (included in all modern distributions) which should work for all byte values...

#!/usr/bin/env python3
#file: set-byte

import sys

fileName = sys.argv[1]
offset = int(sys.argv[2], 0)
byte = int(sys.argv[3], 0)

with open(fileName, "r+b") as fh:
    fh.seek(offset)
    fh.write(bytes([byte]))

Usage...

set-byte eeprom_bad.bin 0x7D00 0
set-byte eeprom_bad.bin 1000 0xff

Note: This code can handle input numbers both in hexadecimal (prefixed by 0x) and decimal (no prefix).

edited May 25, 2022 at 20:50

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Dec 30, 2015 at 7:19

Sandeep Datta

29.6k18 gold badges74 silver badges92 bronze badges

6 Comments

Eugene K Over a year ago

Important you run this in python3 (not python2) or else you end up writing literal string representation of a list: [byte]

s3n0 Over a year ago

The query was for Shell script, not Python script.

King Sumo Over a year ago

The printf+dd works when writing out zeros, for this is mandatory to use the "conv=notrunc" option.

Agguro Over a year ago

printf '\x00\x00\x00\x00' | dd of=blah bs=1 seek=24 count=4 conv=notrunc works (Linux Mint 20)

Pedro Gimeno Over a year ago

Support for hex in printf depends on the printf implementation. Bash built-in printf supports it, as does GNU printf (the one found as /usr/bin/printf in many Linux). But the built-in printf in some sh variants (like dash) doesn't support it. Octal should be supported by all variants, though. See pubs.opengroup.org/onlinepubs/9699919799/utilities/printf.html for the POSIX explanation. So an alternative is to use something else, e.g. xxd or perl, to output the stream to "poke" with dd.

|

CoolOppo · Accepted Answer · 2015-05-12 19:52:20Z

10

Here's a Bash function replaceByte, which takes the following parameters:

the name of the file,
an offset of the byte in the file to rewrite, and
the new value of the byte (a number).

#!/bin/bash

# param 1: file
# param 2: offset
# param 3: value
function replaceByte() {
    printf "$(printf '\\x%02X' $3)" | dd of="$1" bs=1 seek=$2 count=1 conv=notrunc &> /dev/null
}

# Usage:
# replaceByte 'thefile' $offset 95

edited May 12, 2015 at 19:52

CoolOppo

5499 silver badges17 bronze badges

answered Mar 21, 2013 at 2:06

sinharaj

1,1132 gold badges11 silver badges16 bronze badges

Comments

Peter Mortensen · Accepted Answer · 2022-05-25 20:40:42Z

4

The xxd tool, which comes with Vim (and thus is quite likely to be available) allows to hex dump a binary file and construct a new binary file from a modified hex dump.

edited May 25, 2022 at 20:40

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Jan 24, 2011 at 15:36

SK-logic

9,7491 gold badge25 silver badges37 bronze badges

6 Comments

Josh Over a year ago

But that also wouldn't work from the commandline (see my comment above to Dans reply), right?

SK-logic Over a year ago

It should work: xxd -ps ... | sed -s "s/.../.../g/" | xxd -r ...

SK-logic Over a year ago

For your case: echo "010000: FF" | xxd -r - binary.x

Archimedes Trajano Over a year ago

I like this one because it also allows me to do simple search and replace on hex data when I don't know the exact location.

Alice Jacka Over a year ago

I like this but there doesn't seem to be a way to easily add more than 256 bytes without putting in a second address. You can only modify one line per address and the max line length is 256

|

eadmaster · Accepted Answer · 2016-07-18 02:58:09Z

2

Some alternatives:

HexAlter (open source compiled tool)
ucon64 --nbak --poke=OFF:V FILE (meant for ROM dumps, should work with any binary file, but no inplace editing)
printf '\x31' | dd of=FILE bs=1 seek=OFFSET count=1 conv=notrunc (wrapped in a shellscript like this that also allows reading)

edited Jul 18, 2016 at 2:58

answered Aug 2, 2013 at 22:43

eadmaster

1,49715 silver badges23 bronze badges

Comments

memscan · Accepted Answer · 2018-02-09 22:31:54Z

2

Writing the same byte at two different positions in the same file with a one liner.

printf '\x00'| tee >(dd of=filename bs=1 count=1 seek=692 conv=notrunc status=none) \
    >(dd of=filename bs=1 count=1 seek=624 conv=notrunc status=none)

status=none very useful when you don't want any statistics out of dd.

answered Feb 9, 2018 at 22:31

memscan

211 bronze badge

Comments

Peter Mortensen · Accepted Answer · 2022-05-25 20:37:02Z

1

If you don't need it to be scriptable, you could try the hexedit utility. It is available in many Linux distributions (if not installed by default, it can usually be found in the distribution's package repository).

If your distribution doesn't have it, you can build and install it from source.

edited May 25, 2022 at 20:37

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Jan 24, 2011 at 15:34

Dan Moulding

223k25 gold badges103 silver badges101 bronze badges

1 Comment

Josh Over a year ago

It should be scriptable and run directly from the commandline. I am looking for something like "binary-which-is-included-in-the-distro --write AB --at-offset 100000 --file thebinary.bin". I am quite sure that it is possible with "dd", but I wasn't able to wrap my head around the man page.

Peter Mortensen · Accepted Answer · 2022-05-25 20:54:27Z

1

Regarding Josh's answer: In case you want to do it for a specific address -

hexdump -C {file location}

with some hexadecimal value you might have tried to add 0x, but it would fail:

dd: warning: ‘0x’ is a zero multiplier; use ‘00x’ if that is intended

You can achieve this by encapsulating it with $(()) that the terminal will translate as an integer value:

mybinary={file location}
printf '\x31\xc0\xc3' | dd of=$mybinary bs=1 seek=$((0x100)) count=3 conv=notrunc

edited May 25, 2022 at 20:54

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Jun 4, 2019 at 9:39

Antonin GAVREL

11.4k12 gold badges62 silver badges92 bronze badges

Collectives™ on Stack Overflow

Write byte at address (hexedit/modify binary from the command line)

8 Answers 8

7 Comments

6 Comments

Comments

6 Comments

Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

7 Comments

6 Comments

Comments

6 Comments

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related