39

I have a file, a little bigger than 500MB, that is causing some problems.

I believe the issue is in the end of line (EOL) convention used. I would like to look at the file in its uninterpreted raw form (1) to confirm the EOL convention of the file.

How can I view the "binary" of a file using something built in to Windows 7? I would prefer to avoid having to download anything additional.

(1) My coworker and I opened the file in text editors, and they show the lines as one would expect. But both text editors will open files with different EOL conventions and interpret them automagically. (TextEdit and Emacs 24.2. For Emacs I had created a second file with just the first 4K bytes using head -c4096 on a linux box and opened that from my windows box.

I attempted to use hexl-mode in Emacs, but when I went to hexl-mode and back to text-mode, the contents of the buffer had changed, adding a visible ^M to the end of each line, so I'm not trusting that at the moment.

I believe the issue may be in the end of line character(s) used. The editors my coworker and I tried (1) just automagically recognized the end of line convention and showed us lines. And based on other evidence I believe the EOL convention is carriage return only. (2) return only.

To know what is actually in the file, I would like to look at the binary contents of the file, or at least a couple thousand bytes of the file, preferablely in Hex, though I could work with decimal or octal. Just ones an zeros would be pretty rough to look at.

UPDATE

Except the one suggesting DEBUG, all the answers below work to some extent or another. I have up-voted each of those as helpful. My question was ill-formed. In testing each suggested solution I found I really wanted side by side hex and text contents viewing, and that I wanted it to be something where when I had my cursor over something, either a byte value or the text character, the matching thing on the other side would be highlighted.

I actually solved my problem when Emacs hexl-mode started working "correctly". So I ended up not using any of these answers, only testing them.(Really should investigate the weird Emacs behavior and file a bug-report.)

| improve this question | |
  • Likely there's some sort of tool under Cygwin, but that would require installing Cygwin. Or if you have, eg, Java installed on your box, it would be a fairly simple task to write a hex dump program in Java. – Daniel R Hicks Aug 31 '12 at 3:32

12 Answers 12

Active Oldest Votes
13

You need a "hex editor". I've used "Hex Editor Neo" for years and it's very good. It's available in free and paid versions. (And I'm sure there are other similar tools available.)

| improve this answer | |
  • 4
    I had asked how, without anything besides Windows 7 because I do not like adding additional programs because 1) Many install in a way that the rights I have do not allow. 2) Some look to be dodgy. That said Hex Editor Neo looks to be a good recommendation. +1 – Shannon Severance Aug 31 '12 at 1:22
  • 1
    zblist.com is a standalone program that doesn't need to be installed or need any special rights and has an Alt-H or hex mode – sgmoore Aug 31 '12 at 8:33
  • Met all my requirements including stated, misstated, unstated. Hex Editor Neo was fast too, and has been added to my tool bag. – Shannon Severance Sep 20 '12 at 0:19
  • 1. Other editors are not native. 2. File managers are good for this purpose and there are plenty around that are portable. 3. Type command can display the content natively and has useful filters (like page by page). – Overmind May 4 '17 at 12:30
  • The question was asking for a solution with provided tools in Windows, without external downloads – Zimba Apr 11 at 11:11
50

If you have powershell version 5.0 or later, you can use the powershell built-in function Format-Hex

PS:21 C:\Temp >Format-Hex application.exe

            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

00000000   42 4D 5E 00 00 00 00 00 00 00 36 00 00 00 28 00  BM^.......6...(. 
00000010   00 00 0A 00 00 00 01 00 00 00 01 00 20 00 00 00  ............ ... 
00000020   00 00 00 00 00 00 C4 0E 00 00 C4 0E 00 00 00 00  ......Ä...Ä..... 
00000030   00 00 00 00 00 00 B7 59 71 FF B7 59 71 FF B7 59  ......•Yq.•Yq.•Y 
00000040   71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF B7 59  q.•Yq.•Yq.•Yq.•Y 
00000050   71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF        q.•Yq.•Yq.•Yq.
| improve this answer | |
  • 4
    I'm frankly surprised that this isn't the top answer. This is THE correct way to do it using a built-in tool in windows. If you want to write the output to a file, you can use >Format-Hex application.exe > out.txt – techdude Feb 12 '18 at 20:04
  • This seems nice, but Format-Hex is not available in my PowerShell; I just get a "not recognized" error – Kidburla Feb 14 '18 at 16:30
  • According to JamieSee, it apparently wasn't added until powershell 5.0. – techdude Feb 15 '18 at 21:23
28

Built in, quick and dirty: start powershell, execute: 

gc -encoding byte -TotalCount 100 "your_file_path" |% {write-host ("{0:x}" -f $_) -noNewline " "}; write-host

TotalCount is count of bytes you want to read from file.

Google 'powershell hexdump' to get much more polished/workable versions.

If you have Windows Resource Kit Tools (not exactly built in, but close) you may also use a cmd line utility called list.exe. It's a small editor with hex mode. Designed specifically to work with big files:

List Text File Tool (List) is a command-line tool that displays and searches one or more text files. Unlike other text display tools, List does not read the whole file into memory when you open it. It allows a user to edit a text file in a hexadecimal format.

List is useful for displaying text or log files remotely, and for use on servers where administrators are concerned with degradation of system performance.

| improve this answer | |
  • 1
    So far, this solution is the closest that I was asking for. – Shannon Severance Aug 31 '12 at 1:10
  • 2
    Nice, simple, already installed. I changed the format to write-host ("{0:X2}" to force 0x0A to appear as "0A" not "A", the 2 for 2 digit the upper case because that's how I like it – Adam Straughan Nov 5 '13 at 14:01
  • 1
    List.exe was perfect - the list.exe /? help command doesn't give much info, but once inside the editor just hit ? to see commands. H opens the Hex editor, & F1 toggles the way the Hex is displayed – Coruscate5 Mar 22 '17 at 16:14
  • @ShannonSeverance If this is the closest, what about changing the accepted answer? – marcellothearcane Jul 6 at 9:19
  • 1
    @marcellothearcane Because Hex Editor Neo was the answer I used. – Shannon Severance Jul 6 at 15:24
8

This also works on everything after XP:

certutil -encodehex MyProgram.exe MyProgram.txt

XP requires the Windows Server 2003 Administration Tools Pack from here :

https://www.microsoft.com/en-us/download/details.aspx?id=16770

| improve this answer | |
  • most portable and back compatable solution on the windows, could be used even from windows batch scripts, amazed why is this still is not in the top of all answers – Andry Sep 9 '18 at 10:15
7

HxD is a portable hex editor, which means no installation necessary, and is nothing more than a single exe file.

http://mh-nexus.de/en/hxd/

Another similarly portable option is Frhed:

http://frhed.sourceforge.net/en/screenshots/

| improve this answer | |
  • Nice to have- There are installable and portable editions. – pdem May 4 '16 at 15:35
  • I used to HxD but the question is asking for no external downloads. fc /b or certutil is a possible solution to this. JScript or VBScript will also qualify. – Zimba Apr 11 at 11:15
6

Copy the file to a name with a .COM extension, where the base name is no longer than eight characters.  Run

DEBUG your_filename

It will give a '-' prompt.  Type

DEnter

repeatedly to display the file 128 bytes at a time.  Type

D address Enter

to display 128 bytes starting at address, which must be typed in hex, where the beginning of the file is address 100.  Type

D address1 address2 Enter

to display from address1 to address2.  Type

D address Lnum Enter

to display num bytes (length) starting at address.  num is also entered in hex.  Use Q to quit.

For example,

C:\Users\scott\Documents> debug thispost.com
-d
0BE4:0100  43 6F 70 79 20 74 68 65-20 66 69 6C 65 20 74 6F   Copy the file to
0BE4:0110  20 61 20 6E 61 6D 65 20-77 69 74 68 20 61 20 2E    a name with a .
0BE4:0120  43 4F 4D 20 65 78 74 65-6E 73 69 6F 6E 2C 20 77   COM extension, w
0BE4:0130  68 65 72 65 20 74 68 65-20 62 61 73 65 20 6E 61   here the base na
0BE4:0140  6D 65 20 69 73 20 6E 6F-20 6C 6F 6E 67 65 72 20   me is no longer
0BE4:0150  74 68 61 6E 20 65 69 67-68 74 20 63 68 61 72 61   than eight chara
0BE4:0160  63 74 65 72 73 2E 0D 0A-52 75 6E 20 44 45 42 55   cters...Run DEBU
0BE4:0170  47 20 2A 79 6F 75 72 5F-66 69 6C 65 6E 61 6D 65   G *your_filename
-d
0BE4:0180  2A 0D 0A 49 74 20 77 69-6C 6C 20 67 69 76 65 20   *..It will give
0BE4:0190  61 20 27 2D 27 20 70 72-6F 6D 70 74 2E 0D 0A 54   a '-' prompt...T
0BE4:01A0  79 70 65 20 44 20 45 6E-74 65 72 20 72 65 70 65   ype D Enter repe
0BE4:01B0  61 74 65 64 6C 79 20 74-6F 20 2A 2A 64 2A 2A 69   atedly to **d**i
0BE4:01C0  73 70 6C 61 79 20 74 68-65 20 66 69 6C 65 20 31   splay the file 1
0BE4:01D0  32 38 20 62 79 74 65 73-20 61 74 20 61 20 74 69   28 bytes at a ti
0BE4:01E0  6D 65 2E 0D 0A 54 79 70-65 20 44 20 5F 61 64 64   me...Type D _add
0BE4:01F0  72 65 73 73 5F 20 74 6F-20 64 69 73 70 6C 61 79   ress_ to display
-d 200 L16
0BE4:0200  20 31 32 38 20 62 79 74-65 73 20 73 74 61 72 74    128 bytes start
0BE4:0210  69 6E 67 20 61 74                                 ing at
-
| improve this answer | |
  • 4
    Unfortunately that won't work if the file is larger than about 64KB, the max for a .COM. (It has to fit in the segment starting at offset 100h.) – Ken Aug 31 '12 at 0:18
  • 1
    C:\>attrib debug.exe /s. Results: File not found - debug.exe. Was unable to find official, debug is no longer supported statement, but from what I saw on the web it looks like debug support has been dropped awhile ago. I found DebugDiag from Microsoft. (Extra download.) Debugging? Maybe it supports looking at files in HEX? Delivered as an .MSI file. Needs an admin password to install. I'm not one. – Shannon Severance Aug 31 '12 at 0:23
  • @Ken I had already used head -c4096 bigFileName > smallFileName on linux to get the first 4 KB of the files. Lines are small enough that four KB has plenty of lines for my purposes – Shannon Severance Aug 31 '12 at 0:34
  • So why not use hexdump -C while on Linux? – Ken Aug 31 '12 at 0:47
  • 3
    @Shannon debug is part of DOS, and as such, if you are using x64, it is not there. – kinokijuf Aug 31 '12 at 5:27
6

Since Windows 7 comes with the dotnet framework 3.5 built in, you will have the C# compiler built in, so you can grab, for example, the listing from http://illegalargumentexception.blogspot.co.uk/2008/04/c-file-hex-dump-application.html and then compile using 

  \windows\Microsoft.NET\Framework\v3.5\csc printhex.cs

and you should end up with a printhex.exe which should display both hex and ascii characters.

| improve this answer | |
3

It is not ideal, but if you really don't want to download anything, then you could try using fc /b (ie file compare in binary mode) to compare this file with another completely different file, and it will show you the hex values of each byte that is different. You will may get some values that happen to be the same in the two files and so may be skipped from the output, but you can tell if that happens by checking for missing values in the offset column.

| improve this answer | |
  • 1
    Not ideal, but I was able to do so by creating a file of 0x00 bytes and then compare against that. Being a text file that I was looking at, and that I was interested in 0a and 0d mostly a file of nulls as comparison worked. But it doesn't provide both the character view and hex view side by side made finding where I wanted to look harder. (As debug does in Scott's answer and as Emacs's hexl-mode does. I had not asked for side by side view, but it's pretty crucial for how I actually use hex dumps.) – Shannon Severance Aug 31 '12 at 0:47
  • When I compare files with fc /b 2 1, I get result: FC: 2 longer than 1. 1 is a zero byte file. Why don't I see any hex values? – Zimba Apr 8 at 16:04
2

You can use the PowerShell function below along with Get-Content to see a hexdump of the file contents, i.e., Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump. It takes about 23 seconds to dump a 222 KB file and, if desired, the output can be redirected to a text file to make examining the dump easier.

$encodingAutoCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)
    $availableEncodings = ([System.Text.Encoding]::GetEncodings() | Select Name, CodePage, DisplayName) + @( [PSCustomObject] @{ CodePage = '20127'; Name = 'ascii'; DisplayName = 'US-ASCII' }, [PSCustomObject] @{ CodePage = '1200'; Name = 'unicode'; DisplayName = 'Unicode' } )
    $availableEncodings | ?{ $_.Name.StartsWith($wordToComplete) } | %{ New-Object System.Management.Automation.CompletionResult -ArgumentList $_.Name, $_.Name, 'ParameterValue', "$($_.DisplayName). Code Page $($_.CodePage)." }
}

function Format-BufferText([byte[]] $buffer, [System.Text.Encoding] $displayEncoding, [switch] $useControlPictures)
{
    $bufferChars = $displayEncoding.GetChars($buffer);
    $bufferText = (($bufferChars | %{ if ([char]::IsControl($_) -eq $true) { if ($useControlPictures -eq $false) { '.' } else { [char] ($_.ToInt16([cultureinfo]::InvariantCulture) + 0x2400) } } else { "$_" } }) -join "")

    $bufferText
}

<#
    .Synopsis
    Displays binary data as a hexadecimal dump.

    .Description
     Displays binary data as a hexadecimal dump. Options are available to suppress displaying text and to display control characters 
     as Unicode Control Pictures instead of dots.

    .Parameter Bytes
    The bytes to be displayed.

    .Parameter Encoding
    The name of the text encoding to use. The default is ascii.

    .Parameter NoTextDisplay
    If specified the text display sidebar will be suppressed; otherwise, the display text sidebar will be present.

    .Parameter UseControlPictures
    If specified control characters will be displayed as Unicode Control pictures; otherwise, dots are used to represent control 
    characters.

    .Example
    Format-HexDump -Encoding unicode $bytes

    .Example
    Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump -Encoding unicode

    .Example
    0..255 | Format-HexDump -NoTextDisplay
#>
function Format-HexDump
{
    [CmdletBinding()]
    param
    (
        [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [byte[]] $Bytes,
        [ValidateScript({ if (([System.Text.Encoding]::GetEncodings().Name + @('unicode', 'ascii')) -icontains $_) { return $true } else { Throw "Encoding must be one of the following: $([System.Text.Encoding]::GetEncodings().Name -join ', '), unicode, or ascii." } })]
        [Parameter(ValueFromPipeline = $false)]
        [string] $Encoding = "ASCII",
        [Parameter()]
        [switch] $NoTextDisplay,
        [Parameter()]
        [switch] $UseControlPictures
    )

    BEGIN
    {
        $displayEncoding = [System.Text.Encoding]::GetEncoding($Encoding)

        $counter = 0
        $hexRow = ""
        [byte[]] $buffer = @()
    }

    PROCESS
    {
        foreach ($byte in $Bytes)
        {
            $buffer += $byte
            $hexValue = $byte.ToString("X2")

            if ($counter % 16 -eq 0)
            {
                $buffer = @($byte)
                $hexRow = "$($counter.ToString("X8")): $($hexValue) "
            }
            elseif ($counter % 16 -eq 15)
            {
                if ($NoTextDisplay -eq $true)
                {
                    $hexRow += "$($hexValue)"
                    $hexRow
                }
                else
                {
                    $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures
                    $hexRow += "$($hexValue)   $($bufferText)"
                    $hexRow
                }
            }
            else
            {
                $hexRow += "$($hexValue) "
            }

            $counter++
        }
    }

    END
    {
        $counter--

        if ($counter % 16 -ne 15)
        {
            $hexRow += " " * (((16 - $counter % 16) * 3) - 1)

            if ($NoTextDisplay -eq $false)
            {
                $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures
                $hexRow += "$($bufferText)"
            }

            $hexRow
        }
    }
}

Register-ArgumentCompleter -CommandName Format-HexDump -ParameterName Encoding -ScriptBlock $encodingAutoCompleter

Output looks like this:

00000000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F   ................
00000010: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F   ................
00000020: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F    !"#$%&'()*+,-./
00000030: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F   0123456789:;<=>?
00000040: 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F   @ABCDEFGHIJKLMNO
00000050: 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F   PQRSTUVWXYZ[\]^_
00000060: 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F   `abcdefghijklmno
00000070: 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F   pqrstuvwxyz{|}~.
00000080: 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F   ????????????????
00000090: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F   ????????????????
000000A0: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF   ????????????????
000000B0: B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 BA BB BC BD BE BF   ????????????????
000000C0: C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF   ????????????????
000000D0: D0 D1 D2 D3 D4 D5 D6 D7 D8 D9 DA DB DC DD DE DF   ????????????????
000000E0: E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 EA EB EC ED EE EF   ????????????????
000000F0: F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF   ????????????????
| improve this answer | |
1

As Sublime text is my favorite editor, I use its plugin to view hex files. http://facelessuser.github.io/HexViewer/

HexViewer

| improve this answer | |
0

I know you are using Emacs but Vim users can use xxd utility:

xxd -s <start_offset> -l <length_offest> <file>

i.e.

Usage:
       xxd.exe [options] [infile [outfile]]
    or
       xxd.exe -r [-s [-]offset] [-c cols] [-ps] [infile [outfile]]
Options:
    -a          toggle autoskip: A single '*' replaces nul-lines. Default off.
    -b          binary digit dump (incompatible with -ps,-i,-r). Default hex.
    -c cols     format <cols> octets per line. Default 16 (-i: 12, -ps: 30).
    -E          show characters in EBCDIC. Default ASCII.
    -g          number of octets per group in normal output. Default 2.
    -h          print this summary.
    -i          output in C include file style.
    -l len      stop after <len> octets.
    -ps         output in postscript plain hexdump style.
    -r          reverse operation: convert (or patch) hexdump into binary.
    -r -s off   revert with <off> added to file positions found in hexdump.
    -s [+][-]seek  start at <seek> bytes abs. (or +: rel.) infile offset.
    -u          use upper case hex letters.
    -v          show version: "xxd V1.10 27oct98 by Juergen Weigert (Win32)".
| improve this answer | |
0

To view in decimal:
comp File1 File2 /D /m
(similar to gc -encoding byte File1 in powershell)

To view in hex:
fc /b File1 File2
(similar to gc -encoding byte File1 |% {write-host ("{0:X2}" -f $_)} in powershell)

NB:
File2 is a reference file with no similar characters to File1
If unsure, then a workaround would be to fill File2 with 0x20, then for 2nd comparison fill File2 with 0x00 and replace the missing characters with 0x20 (in the 1st comparison)
(Or just fill the missing offsets with 0x20 in lieu of 2nd comparison)

Tested on Win 10 x64

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.