title: Using grep to search for hex strings in a file
body: <p>Does anyone know how to <strong>get grep, or similar tool, to retrieve offsets of hex strings in a file</strong>?</p>
  <p>I have a bunch of hexdumps (from GDB) that I need to check for strings and then run again and check if the value has changed.</p>
  <p>I have tried <code>hexdump</code> and <code>dd</code>, but the problem is because it's a stream, I lose my offset for the files.</p>
  <p>Someone must have had this problem and a workaround. What can I do?</p>
  <h3>To clarify:</h3>
  <ul>
  <li>I have a series of dumped memory regions from GDB (typically several hundred MB)</li>
  <li>I am trying to narrow down a number by searching for all the places the number is stored, then doing it again and checking if the new value is stored at the same memory location.</li>
  <li>I cannot get <code>grep</code> to do anything because I am looking for hex values so all the times I have tried (like a bazillion, roughly) it will not give me the correct output.</li>
  <li>The hex dumps are just complete binary files, the paterns are within float values at larges so 8? bytes?</li>
  <li>The patterns are not line-wrapping, as far as I am aware. I am aware of the what it changes to, and I can do the same process and compare the lists to see which match.</li>
  </ul>
  <p>Perl COULD be a option, but at this point, I would assume my lack of knowledge with bash and its tools is the main culprit.</p>
  <h3>Desired output format</h3>
  <p>It's a little hard to explain the output I am getting since I really am not getting any output.</p>
  <p>I am anticipating (and expecting) something along the lines of:</p>
  <pre><code>&lt;offset&gt;:&lt;searched value&gt;
  </code></pre>
  <p>Which is the pretty well standard output I would normally get with <code>grep -URbFo &lt;searchterm&gt; . &gt; &lt;output&gt;</code></p>
  <h3>What I tried:</h3>
  <p>A. Problem is, when I try to search for hex values, I get the problem of if just not searching for the hex values, so if I search for 00 I should get like a million hits, because thats always the blankspace, but instead its searching for 00 as text, so in hex, 3030.
  Any idea's?</p>
  <p>B. I CAN force it through hexdump or something of the link but because its a stream it will not give me the offsets and filename that it found a match in.</p>
  <p>C. Using <code>grep -b</code> option doesnt seem to work either, I did try all the flags that seemed useful to my situation, and nothing worked.</p>
  <p>D. Using <code>xxd -u /usr/bin/xxd</code> as an example I get a output that would be useful, but I cannot use that for searching..</p>
  <pre><code>0004760: 73CC 6446 161E 266A 3140 5E79 4D37 FDC6  s.dF..&amp;j1@^yM7..
  0004770: BF04 0E34 A44E 5BE7 229F 9EEF 5F4F DFFA  ...4.N[.&quot;..._O..
  0004780: FADE 0C01 0000 000C 0000 0000 0000 0000  ................
  </code></pre>
  <p>Nice output, just what I want to see, but it just doesn't work for me in this situation..</p>
  <p>E. Here are some of the things I've tried since posting this:</p>
  <pre><code>xxd -u /usr/bin/xxd | grep 'DF'
  00017b0: 4010 8D05 0DFF FF0A 0300 53E3 0610 A003  @.........S.....
  
  root# grep -ibH &quot;df&quot; /usr/bin/xxd
  Binary file /usr/bin/xxd matches
  xxd -u /usr/bin/xxd | grep -H 'DF'
  (standard input):00017b0: 4010 8D05 0DFF FF0A 0300 53E3 0610 A003  @.........S.....
  </code></pre>