2

The hex string 0068732f6e69622f represents the ASCII string /bin/sh, when it's stored in memory in LE-format.

Is there any Linux utiltity that will take the hex string and reverse it bytes (2f62696e2f736800), such that xxd -r -ps will display /bin/sh?

$ echo -n 0068732f6e69622f | xxd -r -ps
hs/nib/

I've looked into xxd -e, but it's not possible to use it with -r:

-e little-endian dump (incompatible with -ps,-i,-r).

Shuzheng
  • 4,023
  • 1
  • 31
  • 71

1 Answers1

4
$ echo 0068732f6e69622f | rev | dd conv=swab 2>/dev/null | xxd -r -p
/bin/sh
  • rev reverses the input string: 0068732f6e69622f -> f22696e6f2378600
  • dd conv=swab 2>/dev/null swaps every pair of bytes and discards dd's noisy output on stderr: f2 -> 2f, 26 -> 62, ...
Freddy
  • 25,172
  • 1
  • 21
  • 60