How can I dump my bootable ssd to inspect the dump in HEX editor I am on macbook.
I have encrypted bootable volume. 
I know my password and can normally log in to my profile on macOs. 
I need to make byte-perfect dump of encrypted partition in it's decrypted state to search for a specific bytes sequence.
Steps I did:


log in to recovery mode
mount partition via diskutil
run terminal and trying to read /dev/disk1s1


It shows following error:

cat: /dev/disk1s1: Operation not permitted


I also tried with hex editors and sudo mode. 

Is there a way I can access unencrypted raw bytes sequence on internal ssd of my macbook?
Since you are booting into recovery, you will need to decrypt it first using diskutil

diskutil coreStorage decryptVolume /dev/disk1s1 -passphrase ThePassPhraseYouSet 


It will then decrypt the volume.

Per the man page (man diskutil) :


  Begin a live background process of decrypting the on-disk backing
  bytes of an existing encrypted CoreStorage logical volume (LV).
  Bytes are read, decrypted, and written back to disk in plain form.  The LV must be unlocked before beginning this operation.


You will have to unlock first...

diskutil coreStorage unlockVolume


Once it's unencrpyted, you can then use dd to dump it to an image for later manipulation:

sudo dd if=/dev/disk1 of=/path/to/disk.img