I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes for the string, rather than interpret them as the raw bytes.

One way I've seen people accomplish this is by calling python -c 'print("\x00\xFF\xAB")' and piping output to the program under test. Is there a way to do this without using Python by just using the Bash shell?

  • 1
    You can use ‘printf \xbb’, where you replace ‘bb’ by the byte you want. The only problem is, you cannot pass null byte this way.
    – bart1e
    Commented Apr 19, 2020 at 8:53
  • Ah thanks do you know how I could pass a null byte?
    – the_endian
    Commented Apr 19, 2020 at 9:15
  • Unfortunately, I don't. :/
    – bart1e
    Commented Apr 19, 2020 at 9:50
  • @bart1e thanks I don't think there is a way to do it like this. For null bytes I may have to run execve manually and pass the args I believe.
    – the_endian
    Commented Apr 19, 2020 at 10:19
  • 2
    @bart1e: you can print NUL bytes with printf. You just can't save them in a variable.
    – rici
    Commented Apr 19, 2020 at 19:03

2 Answers 2


Use echo -e and pipe to your program's input.

Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input.

edit: You can pass null-bytes

  • would you mind adding an example on how to pass bytes as an argument to the executable? Commented Apr 20, 2020 at 14:04
  • Put the echo -e command after the executable name, surrounded by backticks: (`). Null bytes are ok in this method too. (Newline chars, however, will break the string)
    – Yotamz
    Commented Apr 20, 2020 at 15:40
  • @Yotamz yikes ... backticks? That's so 1990s. Drop the backticks and use $(...) to dodge the escaping nightmare that ensues as soon as you start nesting backticks ... null bytes will work in arguments? I find that surprising, since they're treated as zero-terminated. Can you substantiate that claim?
    – 0xC0000022L
    Commented Apr 23, 2020 at 6:39
  • Yes, tried it with ls, echo -e "\x2E\x2E" (ls ..) works the same as ls with echo "\x2E\x00\x2E", even though it supposedly ends the string. I'd expect the latter to be treated as just "\x2E" and list the current folder but it doesn't. I agree with you on the backticks-escaping though.
    – Yotamz
    Commented Apr 23, 2020 at 8:14

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:

echo -e -n "\x00\xFF\xAB" > file.bin

program < file.bin

You can use also use xxd to convert hex to binary:

echo "00 FF AB" | xxd -r -p | program

  • 3
    Upvoted for the use of xxd – it is much more convenient without the backslashes.
    – Hermann
    Commented Apr 19, 2020 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.