11

I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes for the string, rather than interpret them as the raw bytes.

One way I've seen people accomplish this is by calling python -c 'print("\x00\xFF\xAB")' and piping output to the program under test. Is there a way to do this without using Python by just using the Bash shell?

  • 1
    You can use ‘printf \xbb’, where you replace ‘bb’ by the byte you want. The only problem is, you cannot pass null byte this way. – bart1e Apr 19 at 8:53
  • Ah thanks do you know how I could pass a null byte? – the_endian Apr 19 at 9:15
  • Unfortunately, I don't. :/ – bart1e Apr 19 at 9:50
  • @bart1e thanks I don't think there is a way to do it like this. For null bytes I may have to run execve manually and pass the args I believe. – the_endian Apr 19 at 10:19
  • 2
    @bart1e: you can print NUL bytes with printf. You just can't save them in a variable. – rici Apr 19 at 19:03
9

Use echo -e and pipe to your program's input.

Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input.

edit: You can pass null-bytes

| improve this answer | |
  • would you mind adding an example on how to pass bytes as an argument to the executable? – Woodrow Barlow Apr 20 at 14:04
  • Put the echo -e command after the executable name, surrounded by backticks: (`). Null bytes are ok in this method too. (Newline chars, however, will break the string) – Yotamz Apr 20 at 15:40
  • @Yotamz yikes ... backticks? That's so 1990s. Drop the backticks and use $(...) to dodge the escaping nightmare that ensues as soon as you start nesting backticks ... null bytes will work in arguments? I find that surprising, since they're treated as zero-terminated. Can you substantiate that claim? – 0xC0000022L Apr 23 at 6:39
  • Yes, tried it with ls, echo -e "\x2E\x2E" (ls ..) works the same as ls with echo "\x2E\x00\x2E", even though it supposedly ends the string. I'd expect the latter to be treated as just "\x2E" and list the current folder but it doesn't. I agree with you on the backticks-escaping though. – Yotamz Apr 23 at 8:14
16

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:

echo -e -n "\x00\xFF\xAB" > file.bin

program < file.bin

You can use also use xxd to convert hex to binary:

echo "00 FF AB" | xxd -r -p | program

| improve this answer | |
  • 2
    Upvoted for the use of xxd – it is much more convenient without the backslashes. – Hermann Apr 19 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.