Why hexdump and hexdump -C Show Different Output

This is a short writing about a small discovery I made whilst using hexdump to dump some ELF files on my Raspberry Pi. During the writing of the article about dissecting ELF executables, I noticed how one command line parameter significantly changed the interpretation of the binary dump.

What about hexdump?

hexdump is a handy command-line tool on Linux that lets you view binary files in a more human-readable format. It is useful to create a hexadecimal dump from a binary file, hence its name “hexdump”. It can be found in the util-linux package, a package with some general utilities.

An example with hexdump

As an example, consider creating a text file which contains only the word “hi”.

echo -n "hi" > example.txt 

The -n flag avoids adding a newline character to the file. In ASCII “hi” corresponds to the following bytes: 0x68 0x69.

When running

hexdump example.txt

This produces the following output:

0000000 6968
0000002

However, when we run

hexdump -C example.txt

The output looks slightly different:

00000000  68 69                                             |hi|
00000002

Notice how the position of the hexadecimal values 0x68 and 0x69 seems to change in the hexdump output depending on the presence of the -C parameter.

What is going on?

When you run hexdump without any flags, it defaults to grouping bytes into 16-bit words (2 bytes), and then displays them in your system’s native endianness—on a Raspberry Pi, that’s little-endian. So the bytes 0x68 and 0x69 (for “hi”) get grouped into one word: 0x6968, but displayed in reverse due to little-endian formatting.

In contrast, hexdump -C switches to “canonical hex+ASCII” format. It shows each byte in its original order, along with its ASCII representation on the right. It’s more human-readable, and often a better default for inspecting raw files byte-by-byte.

So:

• hexdump: word-based, endian-sensitive
• hexdump -C: byte-based, order-preserving

Alternative

Oh, and if you want to be more efficient in the amount of keystrokes you use, you can use hd as well which is just a symbolic link to hexdump.

Takeaway

This small difference reminded me how important tooling defaults can be — especially when interpreting binary data. Understanding what each tool actually displays can prevent subtle misinterpretations.