I'm trying to hexdump some bytes near the end of a 1 TB hard disk drive. First, let's look near the beginning, 0x1000:
% hexdump -n 16 -s 0x1000 -C /dev/sda2
00001000 08 70 b5 7c 20 4c 56 4d 32 20 78 5b 35 41 25 72 |.p.| LVM2 x[5A%r|
And confirming with hexedit, we see hexdump worked fine:
00001000 08 70 B5 7C 20 4C 56 4D 32 20 78 5B 35 41 25 72
Now the problem. hexedit shows near the end, at offset 0xE864544000:
64544000 FC 4E 2B A9 01 00 00 00 00 00 00 00 00 00 00 00
Why then does hexdump show me the data at 0x7FFFFFFF when I specify 0xE864544000...
% hexdump -n 16 -s 0xE864544000 -C /dev/sda2
7fffffff 13 29 24 50 54 47 31 00 10 14 80 47 db 46 61 4e |.)$PTG1....G.FaN|
Confirming 0x7FFFFFFF:
% hexdump -n 16 -s 0x7fffffff -C /dev/sda2
7fffffff 13 29 24 50 54 47 31 00 10 14 80 47 db 46 61 4e |.)$PTG1....G.FaN|
I tried this on another Linux and see similar behavior. Is this a bug in hexdump or am I missing something?
The max offset, '-s', that hexdump can use on an i686 Linux installation is (2^31-1) or 214783647 or in hex, 0x7FFFFFFF. The number you are trying to reach is way beyond this threshold. As @choroba pointed you must use a 64-bit Linux kernel to reach that address.
User contributions licensed under CC BY-SA 3.0