☰

为什么 xxd -r 会改变我的二进制文件的第一个字节

tag-icon • tag-icon linux xxd
为什么 xxd -r 会改变我的二进制文件的第一个字节

我对 的行为感到困惑xxd，这就是我正在做的事情。

我有一个 xxd 转储：

$ head dump
00000000: 7f45 4c46 0201 0103 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 107f 4400 0000 0000  ..>.......D.....
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 4000 3800 0200 4000 0000 0000  [email protected]...@.....
00000040: 0100 0000 0500 0000 0000 0000 0000 0000  ................
00000050: 0000 4000 0000 0000 0000 4000 0000 0000  ..@.......@.....
00000060: 2487 0400 0000 0000 2487 0400 0000 0000  $.......$.......
00000070: 0000 2000 0000 0000 0100 0000 0600 0000  .. .............
00000080: 2854 0b00 0000 0000 2854 6b00 0000 0000  (T......(Tk.....
00000090: 2854 6b00 0000 0000 0000 0000 0000 0000  (Tk.............

但是当我xxd -r这样做时，第一个字节被改为另一个值：

$ xxd -r dump output
$ xxd output | head
00000000: ce45 4c46 0201 0103 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 107f 4400 0000 0000  ..>.......D.....
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 4000 3800 0200 4000 0000 0000  [email protected]...@.....
00000040: 0100 0000 0500 0000 0000 0000 0000 0000  ................
00000050: 0000 4000 0000 0000 0000 4000 0000 0000  ..@.......@.....
00000060: 2487 0400 0000 0000 2487 0400 0000 0000  $.......$.......
00000070: 0000 2000 0000 0000 0100 0000 0600 0000  .. .............
00000080: 2854 0b00 0000 0000 2854 6b00 0000 0000  (T......(Tk.....
00000090: 2854 6b00 0000 0000 0000 0000 0000 0000  (Tk.............

如您所见，所有内容保持不变，但第一个字节ce不是7f。

答案1

您的转储文件中是否存在不包含数据的行（例如，仅包含注释的行）？

对于每一行输入，xxd 都会尝试读取地址和数据的十六进制值。它不会区分格式正确的行。这是一个人为的例子：

$ cat dump 
00000000: 7f45 4c46 0201 0103 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 107f 4400 0000 0000  ..>.......D.....
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 4000 3800 0200 4000 0000 0000  [email protected]...@.....
00000040: 0100 0000 0500 0000 0000 0000 0000 0000  ................
00000050: 0000 4000 0000 0000 0000 4000 0000 0000  ..@.......@.....
00000060: 2487 0400 0000 0000 2487 0400 0000 0000  $.......$.......
00000070: 0000 2000 0000 0000 0100 0000 0600 0000  .. .............
00000080: 2854 0b00 0000 0000 2854 6b00 0000 0000  (T......(Tk.....
00000090: 2854 6b00 0000 0000 0000 0000 0000 0000  (Tk.............
# 0 ocelot something or other

$ xxd -r dump output

$ xxd output 
00000000: ce45 4c46 0201 0103 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 107f 4400 0000 0000  ..>.......D.....
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 4000 3800 0200 4000 0000 0000  [email protected]...@.....
00000040: 0100 0000 0500 0000 0000 0000 0000 0000  ................
00000050: 0000 4000 0000 0000 0000 4000 0000 0000  ..@.......@.....
00000060: 2487 0400 0000 0000 2487 0400 0000 0000  $.......$.......
00000070: 0000 2000 0000 0000 0100 0000 0600 0000  .. .............
00000080: 2854 0b00 0000 0000 2854 6b00 0000 0000  (T......(Tk.....
00000090: 2854 6b00 0000 0000 0000 0000 0000 0000  (Tk.............

在该示例中，它将其解释0为地址，而ceocelot 将其解释为数据。从手册页中可以看到：

CAVEATS
       xxd -r has some builtin magic while evaluating line number information.  If the output file is
       seekable,  then  the  linenumbers at the start of each hexdump line may be out of order, lines
       may be missing, or overlapping. In these cases xxd will lseek(2) to the next position. If  the
       output file is not seekable, only gaps are allowed, which will be filled by null-bytes.

       xxd -r never generates parse errors. Garbage is silently skipped.

       When  editing hexdumps, please note that xxd -r skips everything on the input line after read‐
       ing enough columns of hexadecimal data (see option -c). This also means, that changes  to  the
       printable  ascii  (or  ebcdic)  columns  are always ignored. Reverting a plain (or postscript)
       style hexdump with xxd -r -p does not depend on the correct number of columns.  Here  anything
       that looks like a pair of hex-digits is interpreted.

在这种情况下，解决方案是删除所有非数据行。如果您有注释，可以将它们添加到数据之后，因为 xxd 会忽略它们，例如

00000000: 7f45 4c46 0201 0103 0000 0000 0000 0000  .ELF............ # 0 ocelot something or other

相关内容