Binary files can’t be cat‘d directly. First run file to detect the type, then pick od, hexdump, or strings to inspect.
TL;DR: Run file first to confirm the type, use hexdump -C for byte layout, od -A x -t x1z for a universal dump, and strings when you only want readable strings.
1. Confirm the type first: file
file /bin/lsfile identifies the type via filesystem checks, magic bytes, and language tests [1]. With no options it prints the type directly; -i prints MIME type and encoding, useful for scripting. Expected output looks like /bin/ls: ELF 64-bit LSB pie executable, x86-64, .... If the file is text, file labels it text — no hex tool needed, just cat or less.
2. Hex view: hexdump -C
hexdump -C /bin/ls | headhexdump -C prints hex plus ASCII side-by-side [2]. -C is canonical hex+ASCII; -n 64 shows only the first 64 bytes; -s 0x100 starts at offset 0x100. Each line shows 16 bytes of hex with ASCII on the right. For large files always pair with head or -n to avoid flooding the terminal.
3. Universal dump: od
od -A x -t x1z /bin/ls | headod defaults to octal; -A x switches the address column to hex and -t x1z prints single-byte hex with ASCII [3]. Compared with hexdump, od is available in almost any POSIX environment, so it’s the safer choice in scripts. -j 16 skips the first 16 bytes; -N 32 reads only 32 bytes. Expected output: address column + bytes + readable characters on the right.
4. Extract strings: strings and xxd
strings -n 8 /bin/ls | headstrings prints sequences of printable characters at least as long as the threshold [4]. Default threshold is 4; -n 8 raises it to cut noise; -t x prefixes each line with its offset. Good for quickly spotting paths, version strings, and error messages in a binary without dumping it all.
xxd -l 64 /bin/lsxxd also gives hex+ASCII output [5]: -l 64 limits length, -s 0x100 sets the start offset, and -r reverses hex text back into binary. Handy inside Vim, but for automation prefer od/hexdump.
5. Large files, permissions, and rollback
For huge files every tool floods output — always limit with -n/-N/-l or pipe to head/less. These are read-only operations, so there’s no rollback needed; but when using xxd -r to generate a new file, double-check the output path to avoid overwriting the source. On permission errors add sudo or switch users. Reading device files, FIFOs, or sockets is kernel-dependent and may not produce stable output.
6. Troubleshooting quick reference, limitations, and FAQ
| Symptom | Cause | Fix |
|---|---|---|
| All octal output | od default format |
Add -t x1 or -A x |
| Garbled terminal / flood | File too large, no limit | Use -n/-N/-l or pipe to head |
| Permission denied | No read permission | chmod +r or sudo |
| strings returns nothing | Threshold too high or no long strings | Lower the -n value |
Limitations: this article covers ELF and general binaries on x86-64 Linux only; od/hexdump options differ slightly on macOS/BSD; for compressed or encrypted files these tools only see the wrapper — extract/decrypt first.
Verified: WSL2 Ubuntu 24.04 — file 5.45, coreutils od 9.4, util-linux hexdump 2.39.3, binutils strings 2.42, vim xxd 2023-10-25; all commands pass on WSL; RPM platforms not tested.
Q: Can I just cat a binary? A: Not recommended. Control characters can mess up the terminal or trigger odd behavior; run file first.
Q: hexdump or od? A: For interactive viewing prefer hexdump -C‘s ASCII column; for scripts and portability prefer od.
Q: How do I view just the file header? A: hexdump -C -n 64 file or od -A x -t x1z -N 64 file.
Q: Can strings recover source code? A: No — it only extracts printable fragments; use readelf/objdump for symbols and debug info.
Q: Will large files hang? A: Yes — always limit bytes or page with less.
Not fully verified — untested: RPM platforms, macOS/BSD option differences, compressed/encrypted file internals.
References
- [1] file(1) — Linux manual page (file)
- [2] hexdump(1) — Linux manual page (hexdump)
- [3] od(1) — Linux manual page (od)
- [4] strings(1) — Linux manual page (strings)
- [5] xxd(1) — Debian Manpages (xxd)
Main commands tested on WSL Ubuntu (24.04); a few entries (uninstalled tools / install commands) were only checked against official docs, not actually run.
