Linux hexdump offset strangeness

2

I'm trying to hexdump some bytes near the end of a 1 TB hard disk drive. First, let's look near the beginning, 0x1000:

%  hexdump -n 16  -s 0x1000 -C /dev/sda2

00001000  08 70 b5 7c 20 4c 56 4d  32 20 78 5b 35 41 25 72  |.p.| LVM2 x[5A%r|

And confirming with hexedit, we see hexdump worked fine:

00001000   08 70 B5 7C  20 4C 56 4D  32 20 78 5B  35 41 25 72

Now the problem. hexedit shows near the end, at offset 0xE864544000:

64544000   FC 4E 2B A9  01 00 00 00  00 00 00 00  00 00 00 00

Why then does hexdump show me the data at 0x7FFFFFFF when I specify 0xE864544000...

%  hexdump -n 16  -s 0xE864544000 -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

Confirming 0x7FFFFFFF:

%  hexdump -n 16  -s 0x7fffffff -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

I tried this on another Linux and see similar behavior. Is this a bug in hexdump or am I missing something?

linux
asked on Super User Jul 24, 2013 by hexer • edited Jul 18, 2014 by Peter Mortensen

1 Answer

3

The max offset, '-s', that hexdump can use on an i686 Linux installation is (2^31-1) or 214783647 or in hex, 0x7FFFFFFF. The number you are trying to reach is way beyond this threshold. As @choroba pointed you must use a 64-bit Linux kernel to reach that address.

answered on Super User Jul 24, 2013 by cfreire • edited Jul 17, 2014 by Peter Mortensen

User contributions licensed under CC BY-SA 3.0