cfg command — Glaurung

use it for

cfg prints the recovered function and block structure. It does not persist the result unless a surrounding workflow writes a project.

Run glaurung cfg --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A native binary. Optional limits bound the whole analysis and each recovered function.
output: Recovered functions, basic-block counts, edge counts, and a call graph. DOT output is optional.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung cfg PATH [--max-functions N]

The installed parser is authoritative: glaurung cfg --help

run it

examples

Map a small ELF

Start without a project when you only need function and block counts.

run

from the engine checkout

$ glaurung cfg samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --max-functions 20

output

captured result captured fixture output, selected rows

functions: 16 | callgraph edges: 15
- _start @0x1060 blocks=1 edges=0 size=38
- _init @0x1000 blocks=3 edges=3 size=27
- main @0x1150 blocks=4 edges=4 size=127
- print_sum @0x11d0 blocks=1 edges=0 size=34
- static_function @0x1200 blocks=1 edges=0 size=41

captured fixture output, selected rows.

Read the result: Block and edge counts are quick complexity clues. They are recovered structure, so indirect control flow and damaged code can leave gaps.

Bound a large first pass

Use both a function cap and a whole-run timeout when you do not yet trust the input size.

run

from the engine checkout

$ glaurung cfg /usr/bin/openssl --max-functions 500 --total-timeout-ms 30000 --json

output

captured result captured on Ubuntu, selected rows

{
  "functions": [
    {"name":"sub_4e590","entry_point":320912,"basic_blocks":1,"edges":0,"size":38},
    {"name":"sub_7dd20","entry_point":515360,"basic_blocks":41,"edges":64,"size":1156},
    {"name":"sub_820d0","entry_point":532688,"basic_blocks":40,"edges":64,"size":872}
  ]
}

captured on Ubuntu, selected rows.

Read the result: The 500-function ceiling bounds discovery; the JSON can still be large. A high block or edge count is a place to inspect, not proof of suspicious behavior.

used above

important options

--max-functions N: Analyze at most N recovered functions; zero means unlimited.
--total-timeout-ms N: Put a wall-clock ceiling on the whole run.
--dump N: Print the first N instructions of each function.
--dot: Emit the first function's CFG as DOT.

These are the flags used by the examples. Run glaurung cfg --help for the complete parser help.

keep working

related commands

← all 40 commands