RFC 4194

The S Hexdump Format

📅 published October 2005, from ietf

RFC 4194: The S Hexdump Format 🎀

Okay bestie, so this is RFC 4194, and it's called The S Hexdump Format 💖. It's a Standards Track doc from October 2005, part of the Network Working Group. It was written by J. Strombergson (InformAsic AB), L. Walleij (Lunds Tekniska Hogskola), and P. Faltstrom (Cisco Systems Inc). Nothing in the title block says it obsoletes or updates any other RFC, so it's standing on its own 💅.

Status of This Memo ✨

This doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶. For where this protocol stands in the standardization process, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈.

Copyright Notice 💖

Abstract 🦋

Okay so this doc defines the S Hexdump Format (SHF), a brand new XML-based open format for describing binary data in hexadecimal notation 🧚. It lets you describe both tiny and huge, simple and super complicated hex data dumps, and it's open, modern, and neutral about transport and vendor. Iconic 👑.

1. Introduction 🌸

So in the computing, network, and embedded systems worlds, there are a bunch of different hex data formats floating around 😭. One of the most common ones is called "S-records" (plus a few spin-offs), and it reportedly started at Motorola. SHF is named after it as a little tribute 🫶.

People use these dump formats for all kinds of things: executable object code for embedded systems (aka "firmware"), on-chip flash memories and filesystems, FPGA configuration bitstreams, graphics and other application resources, routing tables, and more 🍓. The tea is that none of the formats people actually use are truly open, vendor-neutral, and/or well-defined 💀.

It's even worse because none of these formats can handle the big data sizes that are getting more and more common 😩. Dumps made of multiple sub-blocks with different Word sizes don't work, and neither do data sizes anywhere from a few Bytes up to way bigger than 2^32 bits. The checksums in these formats are also way too simplistic, and with bigger data they can't reliably catch errors. And the overhead you'd need for proper error detection is huge. Not it 🙈.

So SHF is here to fix that 💅. It's a modern, XML-based format that's still simple enough for basic tools and computing environments to implement, generate, parse, and use. It handles large data sizes and complex data structures too, and it gets high-quality error detection by using standardized cryptographic hash functions 🔥.

One simplification SHF makes is that it doesn't allow other number systems like octal or decimal notation, and it only allows Word sizes that are even bytes (8-bit groups). This is on purpose, to keep things easy for practical present-day applications 🌷. Formats for esoteric number systems or odd Word sizes can be implemented somewhere else 🦋.

Right now, SHF is mainly useful for Internet transport and file storage on development machines 💻. A parser for the XML format isn't easy to deploy in hardware devices yet, but a workstation computer can do the parsing and checksumming of the SHF data, then convert the SHF tokens into an ordinary bitstream before the final step (like a firmware upgrade) starts 🎀.

Also, SHF is a dump format only, and it should not be mixed up with similar things like binary configuration formats or patches. Those are meant to do stuff like change the contents of a core memory. That kind of thing needs to be able to modify individual bits or groups of bits in a machine's memory, and that's not what this mechanism is for 🙅‍♀️.

2. Terminology 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in RFC 2119 [1] 📚. Those are the big rules words, so read them carefully bestie 👑.

The key word "Byte" means a group of 8 bits. The key word "Octet" is just another name for Byte 🍓.

The key word "Word" means a group containing a whole number of Bytes 💜.

The key word "Block" means an ordered sequence of Words, starting at a certain address and running from lower to higher addresses. A Block usually represents a sequence of Words in a certain address range in a computer's memory 🧚.

The key word "Dump" means a sequence of Blocks, which might or might not be in a particular order. A Dump usually represents some non-continuous, interesting parts of a computer's memory, so that the Dump as a whole has a meaning. For example (but not only), it could be a complete firmware for an embedded system 🌈.

The expression "2^n" means the value two (2) raised to the n:th power. For example, 2^8 equals the value 256 ✨.

3. Features and Functionality 👑

The SHF-format has these features:

Support for arbitrarily wide data Words 🌸
Support for very large data Blocks 🦋
Support for an arbitrary number of independent data Blocks 🫶
Data integrity detection against errors provided by the RFC3174 specified (see [2]) SHA-1 cryptographic signature 🔥
An XML-based format 💅

In the embedded systems world, 8- and 16-bit processors are still used in huge numbers, and they'll keep being used for the foreseeable future 🤖. Meanwhile, more and more systems are using 64-bit and even bigger Word sizes 🚀.

SHF works for all of these systems because you can specify the Word size 🎀. The Word size MUST be an integer number of Bytes and at least one (1) Byte 📏.

SHF can represent both big and small data Blocks 🍓. The data Block MUST contain at least one (1) Word. On top of that, the data Block MUST NOT be larger than (2^64)-1 bits 🙅‍♀️.

The SHF Dump MUST contain at least one (1) data Block. The maximum number of Blocks supported is 2^64 💜. Each data Block in the Dump MAY have different Word sizes and start at different addresses 🌈.

The checksum (or message digest) used to check correctness or data integrity of each Block is 20 Bytes (160 bits) long 🧚. The digest MUST be calculated on the data actually represented by the SHF data Block, NOT the representation, i.e., NOT the ASCII-code 💅. SHA-1 can only calculate a digest for a data Block no larger than (2^64)-1 bits, so that's what limits each data Block in SHF to (2^64)-1 bits 🔥.

4. SHF XML Specification 🧚

The SHF format is an XML data structure that represents a Dump 🎀. The Dump has a Dump header section and one (1) or more Block sections containing data. Each Block of data is independent of every other Block 🦋.

Here's a short, symbolic example of an SHF Dump 👀:

<dump name="(Human readable string)" blocks="(64-bit value)">
  <block name="(Human readable string)" start_address="(64-bit
         value)" word_size="(64-bit value)" length="(64-bit value)"
         checksum="(20-Byte digest)">
     (Data)
  </block>
</dump>

4.1. Header Section 🌸

The header section is the Dump tag, and it has these attributes:

name: A compulsory string of arbitrary length that any interested party can use to identify the specific SHF Dump 🫶.
blocks: An optional 64-bit hexadecimal value for the number of Blocks in the specific SHF Dump. Whenever it's available, this value should be supplied. But there are possible situations where the number of Blocks can't be known ahead of time 🤷‍♀️. If the value is there, implementers should verify it. If the value is untrue, the behaviour is implementation-defined 🙈.

After the opening Dump tag, one or more subsections of Blocks must follow. Finally, the whole SHF Dump ends with a closing Dump tag 💖.

4.2. Block Subsection 💅

The Block subsection has a Block tag and a number of data words. The Block tag has these attributes:

name: A compulsory string of arbitrary length that any interested party can use to identify the specific Block 🎀.
start_address: A compulsory, 64-bit hexadecimal value for the start address in Bytes of the data in the Block 🦋.
word_size: A compulsory 64-bit hexadecimal value for the number of Bytes (the width) of one Word of the data 📏.
length: A compulsory hexadecimal representation of an unsigned 64-bit integer, showing the number of Words that follow inside the Block element. If this value turns out to be untrue, the Block MUST be discarded 😭.
checksum: A compulsory hexadecimal representation of the 20 Byte SHA-1 digest of the data in the Block 🔥.

The total size of the data in the Block (in bits) is given by the expression (8 * word_size * length). The expression MUST NOT be larger than (2^64)-1 🙅‍♀️.

After the opening Block tag comes a hexadecimal representation of the actual data in the Block. Finally, the Block section ends with a closing Block tag 🌈.

5. SHF Rules and Limits 🔥

Okay so there are several rules and limits in SHF 📋:

All attribute values that represent an actual value, and the data, MUST be in hexadecimal notation. The only attribute excluded from this rule is the name attribute in the Dump and Block tags. This restriction is there to make the dump easier to read: a reader shall not be uncertain about whether a figure is in hex notation, and can always assume it is hexadecimal 👑.
All attribute values, except for the checksum, MAY omit leading zeros. On the flip side, the checksum MUST NOT omit leading zeros 💜.
The data represented in a Block MUST NOT be larger than (2^64)-1 bits 🧚.
The size of a Word MUST NOT be larger than (2^64)-1 bits. This means a Block with a Word set to the maximum width can't contain more than one Word. An SHF consumer shall make sure it can handle a certain Word length before it starts parsing the blocks of an SHF Dump. If it doesn't, it may cause buffer overflows and endanger the stability and security of the system running the consuming application 🚨. This one is serious, bestie, no cap 😱.
The attribute values that represent an actual value MUST be in big-endian format. That means the most significant hexadecimal digits go on the left in a hexadecimal Word, address, or similar field. For example, the address value 1234 represents the address 1234 and not 3412 🌷. Some computing architectures use little-endian Words as their native format, and in that case it's the responsibility of any SHF producer running on that architecture to swap the attribute values into big-endian format 🔄. It goes the other way for a consumer receiving the big-endian SHF attributes: if the consumer is little-endian, the values have to be swapped around 🫶.
Likewise, the words inside a Dump MUST be stored in big-endian format if the word size is larger than one Byte. The same need for swapping Bytes around may come up here, as mentioned in the previous paragraph 💖.

6. SHF DTD 💖

okay bestie, so the block element and its blocks, address, word_size and checksum bits are only allowed to hold valid hexbyte sequences 🦋 here's the grammar:

whitespace ::= (#x20 | #x9 | #xC | #xD | #xA)
hexdigit   ::= [0-9A-Fa-f]
hexbytes   ::= whitespace* hexdigit (hexdigit|whitespace)*

if a parser finds any random alien characters sneaking in there, it should quietly ignore them, like they were never even there 🙈 whitespace has zero semantic meaning, it's just for making the dump pretty for humans 🌸 you can totally squish it all out and mash the hexbytes together if you want. also, since word size is measured in bytes, the number of hex digits inside a block needs to be even 💅 and malformed blocks should get ignored by implementations 💀

here's the DTD, with its little header comment and everything 🧚

<!--
  DTD for the S Hexdump Format, as of 2003-10-10
  Linus Walleij, Joachim Strombergson, Patrik Faltstrom 2003

  Refer to this DTD as:

  <!ENTITY % SHF PUBLIC "-//IETF//DTD SHF//EN"
             "http://ietf.org/dtd/shf.dtd">
       %SHF;
-->
<?xml version="1.0" encoding="UTF-8"?>

<!ELEMENT dump (block)+>
<!ATTLIST dump
       name          CDATA    #REQUIRED
       blocks        CDATA    #IMPLIED>

<!ELEMENT block (#PCDATA)>
<!ATTLIST block
       name          CDATA    #REQUIRED
       address       CDATA    #REQUIRED
       word_size     CDATA    #REQUIRED
       length        CDATA    #REQUIRED
       checksum      CDATA    #REQUIRED>

7. SHF Examples 🎀

okay, this part has three SHF examples showing how SHF and its attributes actually get used ✨

example one is a super simple dump with just one block of data 🌸

<?xml version="1.0" encoding="UTF-8"?>
<dump name="Simple SHF example" blocks="01">
  <block name="Important message in hex format" address="0400"
    word_size="01" length="1f"
    checksum="5601b6acad7da5c7b92036786250b053f05852c3">
      41 6c 6c 20 79 6f 75 72 20 62 61 73 65 20 61 72
      65 20 62 65 6c 6f 6e 67 20 74 6f 20 75 73 0a
  </block>
</dump>

example two is a 6502 machine code program living at memory address 0x1000 🧚 it works out the first 13 Fibonacci numbers and stores them at 0x1101-0x110d. it's giving retro computing, obsessed 😭

<?xml version="1.0" encoding="UTF-8"?>
<dump name="6502 Fibonacci" blocks="02">
  <block name="Code" address="1000" word_size="01" length="2a"
    checksum="5cab5bf8ee299af1ad17e8093d941914eb5930c7">
      a9 01 85 20 85 21 20 1e 10 20 1e 10 18 a5 21 aa
      65 20 86 20 85 21 20 1e 10 c9 c8 90 ef 60 ae 00
      11 a5 21 9d 00 11 ee 00 11 60
  </block>
  <block name="Mem" address="1100" word_size="01" length="e"
    checksum="c8c2001c42b0226a5d9f7c2f24bd47393166487a">
      01 00 00 00 00 00 00 00 00 00 00 00 00 00
  </block>
</dump>

and the final one has a block of 40-bit wide data 🔥 this is the big-brain example, ngl

<?xml version="1.0" encoding="UTF-8"?>
<dump name="Example of an SHF dump with wide data words" blocks="00001">
  <block name="SMIL memory dump" address="000" word_size="5"
        length="1A" checksum="ff2033489aff0e4e4f0cd7901afc985f7a213c97">
      00100 00200 00000 00090 00000 00036 00300 00400
      00852 00250 00230 00858 00500 00600 014DC 00058
      002A8 000B8 00700 00800 000B0 00192 00100 00000
      00900 00A00 00000 0000A 40000 00000 00B00 00C00
      00000 00000 00000 00001 00D00 00E00 00000 00100
      0CCCC CCCCD 00F00 01000 00000 00010 80000 00000
      00100 00790 00000 00234
  </block>
</dump>

8. SHF Security Considerations 🔐

okay, serious moment bestie 😭 SHF is just a format for representing hex data you want to move around, manage, or transform. the format itself does NOT promise that the data it represents is honest, safe, or non-malicious. it could be falsified, it could be malicious, it could be dangerous, and the format won't catch that for you 💀

if you need the integrity of the whole SHF file, that has to come from outside the file, like the generic signing mechanism in RFC 3275 [3] 🫶

9. IANA Considerations 🌈

this section has the registration info for the SHF MIME type 🦋 the media type was picked to follow the guidelines in [4].

Registration: application/shf+xml
MIME media type name: application
MIME subtype name: shf+xml
Required parameters: charset

Required parameters: charset

this parameter must exist and must be set to "UTF-8". no other character sets are allowed for transporting SHF data. the character set designator MUST be uppercase 💅

Encoding considerations:

this media type may contain binary content 👀 so if you're sending it over a transport that can't handle binary, you must apply an appropriate encoding.

Security considerations:

a hex dump has no security considerations beyond what applies to any other XML file 🙈 BUT the binary data, once decoded, may contain executable code for a target platform, so be careful 🔥 if you want extra security, you can add extra transport security solutions. for target code inside a hex dump, developers may want to include certificates, checksums, and similar stuff in hexdump form for the target platform. those uses are outside the scope of this document and are a matter of implementation ✨

Interoperability considerations:

n/a

Published specification:

this media type is a proper subset of the XML 1.0 specification [5] 💜 there's one restriction: no entity references other than the five predefined general entity references ("&", "<", ">", "'", and """) and numeric entity references may be present. the XML declaration (e.g., <?xml version="1.0" ?>) and the DOCTYPE declaration (e.g., <!DOCTYPE ...>) don't need to be present. (XML fragments are allowed! 🧚) all other XML 1.0 instructions (e.g., CDATA blocks, processing instructions, and so on) are allowed.

Applications that use this media type: any program or individual wishing to make use of this XML 1.0 subset for hexdump exchange 🌸

Additional information:

Magic number: There is no single initial Byte sequence that is always present for SHF files
File extension: shf
Macintosh File Type code: none

Intended usage: COMMON.

Author/Change controller: this MIME transport type is controlled by the IETF.

10. Extensions 🪄

the attributes of SHF XML elements can be extended whenever the need comes up 💖 for example, some apps will want to show executable code as an SHF dump, and they might need an execution start address tied to certain dump blocks. that way the address can be the starting point for the CPU part of any processor code in the block, instead of the raw data, which already gets a start address from the address attribute. you do this by adding a start_address attribute to the block tag ✨

another scenario: a dump gets applied to a computer with several independent address spaces, like a system with two CPUs that each have their own memory. then a user might want to add an address_space attribute 🌈

as long as new attributes are added, with no attributes removed or redefined, the result still counts as a valid SHF dump and can be transported using the application/xml+shf transport type 💅 parsers that don't know about the extended namespace should quietly ignore those extended attributes, or just copy them from input to output when they're filtering an SHF file. how these extended attributes get managed is a matter of convention between different groups of users, not a matter for the IETF 🫶

11. Additional Information 💜

contact for more info: check the "Authors' Addresses" section of this memo 🦋

acknowledgements: the SMIL memory dump was kindly provided by Sten Henriksson at Lund University 🙌 proofreading and great feedback on the SHF doc came from Peter Lindgren, Tony Hansen, Larry Masinter, and Clive D.W. Feather. thank you also to the Applications area workgroup for their help during development 🎀

12. Normative References 📚

[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[2] Eastlake, 3rd, D. and P. Jones, "US Secure Hash Algorithm 1 (SHA1)", BCP 14, RFC 3174, September 2001.
[3] Eastlake, 3rd, D., Joseph, J., and D. David, "(Extensible Markup Language) XML-Signature Syntax and Processing", BCP 14, RFC 3275, March 2002.
[4] Makoto, M., Simon, S., and D. Dan, "(Extensible Markup Language) XML Media Types", RFC 3023, January 2001.
[5] Bray, Tim, Paoli, Jean, Sperberg-McQueen, C. M. and Maler, Eve, Yergeau, Francois, "Extensible Markup Language (XML) 1.0 (Third Edition)", http://www.w3.org/TR/REC-xml.

Authors' Addresses 🧑‍💻

Joachim Strombergson
InformAsic AB
Hugo Grauers gata 5a
Gothenburg  411 33
SE

Phone: +46 31 68 54 90
EMail: Joachim.Strombergson@InformAsic.com
URI:   http://www.InformAsic.com/


Linus Walleij
Lunds Tekniska Hogskola
Master Olofs Vag 24
Lund  224 66
SE

Phone: +46 703 193678
EMail: triad@df.lth.se


Patrik Faltstrom
Cisco Systems Inc
Ledasa
273 71 Lovestad
Sweden

EMail: paf@cisco.com
URI:   http://www.cisco.com

this document is subject to the rights, licenses and restrictions in BCP 78, and except as set out there, the authors keep all their rights 💖

this document and the info in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 💀

Intellectual Property ⚖️

the IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to the technology in this document, or on whether any license under those rights might be available. it also doesn't claim to have made any independent effort to find such rights. info on the procedures for rights in RFC documents is in BCP 78 and BCP 79 🌸

copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users, can be found in the IETF online IPR repository at http://www.ietf.org/ipr ✨

the IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology needed to implement this standard. send that info to the IETF at ietf-ipr@ietf.org 🫶

Acknowledgement 🌷

funding for the RFC Editor function is currently provided by the Internet Society 👑

📦 where this page comes from

ietf: rfc4194 2005-10
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms