1. Comp 335 – File Structures Hexadecimal Dumps Interpreting File Contents

2. What is a Hexadecimal Dump? It is a common way to view the actual contents of a file or memory. The contents are displayed in hexadecimal because this is easier to view than the actual binary code. It will be a useful tool in this class to examine file structures within binary files.

3. What is a Hexadecimal Dump? HEX DUMP FOR FILE: somedata.dat 00000000: 54 68 69 73 20 69 73 0D 0A 73 61 6D 70 6C 65 20 This is..sample 00000010: 74 65 78 74 0D 0A 77 69 74 68 20 6E 75 6D 62 65 text..with numbe 00000020: 72 73 20 31 35 0D 0A 61 6E 64 20 33 36 2E 0D 0A rs 15..and 36... Parts of a Hexadecimal Dump: Title Line – gives the name of the file dumped Byte Address – given in hex in increments of 16 bytes Data – each byte is written in hex, 16 bytes on a line ASCII translation – if byte is readable ASCII, it will be displayed, otherwise a ‘.’ is displayed

4. Hexadecimal Review Base 16 Uses digits 0 – 9 Uses letters A – F  A: 10  B: 11  C: 12  D: 13  E: 14  F: 15

5. Hexadecimal Review 16 10 would be 10 16 (1 X 16 1 ) + (0 X 16 0 ) = 16 + 0 = 16 45 10 would be 2D 16 (2 X 16 1 ) + (13 X 16 0 ) = 32 + 13 = 45

6. Hexadecimal Questions What is 1AE 16 in Decimal? (1 X 16 2 ) + (10 X 16 1 ) + (14 X 16 0 ) 256 + 160 + 14 = 430 What is 375 10 in Hexadecimal? 375 - 256 = 119 (16 2 place – 1) 119 – 112 = 7 (16 1 place – 7) 7 – 7 = 0 (16 0 place – 7) Answer: 177 16

7. Hex to Binary It takes 4 binary digits to represent one hex number. 0000 – 00001 – 10010 – 2 0011 – 30100 – 40101 – 5 0110 – 60111 – 71000 - 8 1001 – 91010 – A1011 – B 1100 – C1101 – D1110 – E 1111 – F Hex dumps represent each byte in a file as a two digit hex number. Example: OD 16 would be 0000 1101 2

8. Hex to Binary Questions Convert A8 16 to Binary 1010 1000 2 Convert 0110 1111 2 to Hexadecimal 6F 16

9. Another Look at a Hex Dump HEX DUMP FOR FILE: somedata.dat 00000000: 54 68 69 73 20 69 73 0D 0A 73 61 6D 70 6C 65 20 This is..sample 00000010: 74 65 78 74 0D 0A 77 69 74 68 20 6E 75 6D 62 65 text..with numbe 00000020: 72 73 20 31 35 0D 0A 61 6E 64 20 33 36 2E 0D 0A rs 15..and 36... This is sample text with numbers 15 and 36. The above dump was generated from a simple ASCII file created in the Windows Notepad application shown below.