Hex dump
Offset, hex bytes and printable characters, three columns side by side.
What is loaded above
The first 48 bytes of a real PNG file, taken from this site’s own 32-pixel favicon. The hex is decoded to bytes, then dumped. Three lines, sixteen bytes each.
The three columns
The left column is the offset of the first byte on that line, in hex, padded to eight digits. 00000020 is byte 32, and adding a position along the line gives the exact address of anything you spot.
The middle column is the data, two hex digits per byte, space separated. A short final line is padded so the right column stays aligned.
The right column, fenced between pipes, is the same bytes read as ASCII. Every byte from 0x20 to 0x7e prints as itself. Everything else prints as a dot.
Why the printable column earns its space
Line one reads .PNG........IHDR in the printable column: a file naming its format, then its first chunk. By line three it says IDAT, where the compressed image data starts. Format signatures, chunk names, embedded URLs, error messages and stray fragments of source all surface there with nothing decoded.
The dot is doing a lot of work, and it lies by omission. It stands for any of the 161 byte values that are not printable ASCII, so a run of dots tells you nothing about what is underneath. The two spaces on the second line are real 0x20 bytes: the low byte of the width and the low byte of the height, both 32.
Reading a dump back in
The decode direction strips the offset and the pipe-fenced gutter from each line and keeps the hex pairs, so a dump copied out of a terminal turns back into bytes. Output from hexdump -C pastes in and works. Plain xxd does not, because it puts a colon after the offset, groups bytes in fours, and leaves the ASCII column undelimited.
Line width
The width runs from 4 to 32 bytes per line, and anything outside that is clamped. Sixteen is conventional because all three columns together still fit an 80-column terminal.
Changing it is an analysis technique in itself. Structure in a file has a period, and when the line width matches that period the repeats stack into visible vertical stripes. Sliding the width until columns line up is how a fixed-size record layout gives itself away.
Related
Hexadecimal gives the same bytes as one continuous string for pasting elsewhere. Inspect works out what a blob appears to be. Bitwise is the next stop when the dump shows something obfuscated.