Reference
all 40 commands
Start with triage. Use kickoff when you want to keep the analysis in a project. Each page below has a command you can run, the files it reads or writes, and the next command you will probably need.
Checked against glaurung 0.1.0 at engine commit 7bc73539,
2026-08-31. The CLI is pre-1.0; run glaurung COMMAND --help before scripting it.
Inspect a file
Read a binary without creating a project.
-
triageIdentify the file, processor, hardening flags, strings, and packer clues. -
stringsExtract strings and report encodings, language clues, entropy, and IOCs. -
symbolsList symbols, imports, exports, and linked libraries. -
disasmDecode instructions at an address or across a recovered function. -
cfgDiscover functions and build control-flow graphs. -
detect-packerCheck signatures, section layout, and entropy for packer evidence.
Create a project
Run the larger analysis and keep its results.
Navigate a project
Find code, data, references, and stack variables.
-
findSearch functions, strings, comments, labels, types, and disassembly. -
viewShow bytes, disassembly, and pseudocode around one address. -
xrefsList recorded references to or from an address. -
strings-xrefsJoin recovered strings to the instructions and functions that read them. -
frameList, discover, rename, or retype stack-frame variables.
Record your work
Add names, types, notes, labels, and bookmarks.
-
bookmarkAdd, list, or delete address bookmarks. -
journalKeep dated notes in a project. -
renameGive a recovered function a new name. -
commentShow, add, or delete a comment at an address. -
labelName and type data at a virtual address. -
protoShow or set a function prototype. -
undoInspect or revert changes recorded in a project's undo log. -
redoReapply project changes reverted by undo.
Recover and compare code
Render pseudocode, graph functions, compare builds, and export results.
Patch and verify
Write a copied binary or test recovered source.
Java, Lua, and PE files
Use parsers and workflows made for a specific format.
-
classfileRead Java class metadata from a .class file or JAR. -
javaRun Java triage, security, or recovery agents. model credentials -
java-recovery-reportRecover a JAR into a project tree and score the result. -
luacRecognize Lua and LuaJIT bytecode and print header information. -
peList PE resources or decode a manifest or version record.
Windows analysis
Inspect drivers, project facts, locks, and related binaries.
-
windows-riskSummarize risky imports, strings, and function shapes in a Windows binary. -
typesRegenerate Windows API prototypes from pinned metadata. -
windowsRun the Windows project, IOCTL, diff, notebook, and corpus workflows. -
locksInventory lock state in one recovered function. -
groupCompare shared tags across two or more named binaries.
Optional LLM workflows
Ask questions or request a bounded rewrite. These commands can cost money.