Skip to content

od

Advanced od (octal dump) techniques for low-level binary inspection, EFI and firmware analysis, raw memory decoding, and visual comparison of executable and system data

"View UEFI BootOrder from efivars

od -An -t x2 -v -j4 /sys/firmware/efi/efivars/BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c | awk '{a[NR]=$1} END{for(i=1;i<=NR;i++){printf "%s%s", a[i], (i<NR?",":"\n")}}'

Hex-dump a binary file with byte offsets (classic)

od -Ax -tx1 -v firmware.bin

Read /dev/mem at VGA ROM (0xC0000) safely

dd if=/dev/mem bs=1 skip=$((0xC0000)) count=256 2>/dev/null | od -Ax -tx1

Inspect kernel version string directly from memory

strings /proc/kallsyms | head -n1 | od -An -tc

View EFI variable payload (skip attributes, hex words)

od -An -t x2 -j4 /sys/firmware/efi/efivars/BootCurrent-8be4df61-93ca-11d2-aa0d-00e098032b8c

Show ASCII + hex side by side (great for newbies)

od -Ax -tx1 -tc /bin/ls | head

Find printable strings hidden in binary blobs

od -An -tc firmware.bin | tr -s ' ' | grep '[[:print:]]'

Inspect ELF header manually (first 64 bytes)

od -Ax -tx1 -N64 /bin/bash

Watch entropy from /dev/random in real time

od -An -tx1 /dev/random

Decode little-endian integers from raw memory

dd if=/dev/mem bs=4 skip=$((0x1000)) count=8 2>/dev/null | od -An -t u4

Compare two binaries at word level (poor man’s diff)

paste <(od -An -tx4 fileA.bin) <(od -An -tx4 fileB.bin)

Matrix screensaver

COLUMNS="${COLUMNS:-$(tput cols)}"

od -An -N9999999 -tu1 /dev/urandom \
| awk '{
    for (i=1;i<=NF;i++) {
      c=$i
      if (c % 8)          printf " "          # ~7/8 spaces
      else                printf "%c", 48 + (c % 10)
    }
  }' \
| dd bs=1 cbs="$COLUMNS" conv=unblock 2>/dev/null \
| GREP_COLOR="1;32" grep --color=always '[0-9]'

Matrix screensaver example 2

od -An -tu1 /dev/urandom \
| awk '{for(i=1;i<=NF;i++) printf($i%8?" ":"%c",48+$i%10)}' \
| fold -w "${COLUMNS:-$(tput cols)}" \
| GREP_COLOR="1;32" grep --color=always '[0-9]'