detect-packer command

use it for

The result is evidence, not a guarantee that a file is packed or clean.

Run glaurung detect-packer --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: One binary. The detector reads signatures, section layout, entry bytes, and entropy clues.
output: A packed/not-packed verdict with named evidence and confidence.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung detect-packer PATH

The installed parser is authoritative: glaurung detect-packer --help

run it

examples

Check a known UPX fixture

The sample corpus includes a packed executable for a positive control.

run

from the engine checkout

$ glaurung detect-packer samples/binaries/platforms/linux/amd64/export/native/gcc/O0/hello-cpp-g++-O0.upx9

output

captured result captured from the checked-in UPX fixture, 2026-08-31

PACKED: UPX  (confidence 95%)
  indicator: UPX!
  overall entropy: 7.699 bits/byte

captured from the checked-in UPX fixture, 2026-08-31.

Read the result: A signature hit is stronger than entropy alone. A clean result still does not prove that the binary is unpacked.

Check an ordinary system binary

Run the same detector on a normal Ubuntu executable for comparison.

run

from the engine checkout

$ glaurung detect-packer /bin/ls --json

output

captured result captured on the Ubuntu development host, 2026-08-31

{"is_packed":false,"packer_name":null,"family":null,"confidence":0.0,"indicators":[],"overall_entropy":6.3025,"notes":["no packer indicators found"]}

captured on the Ubuntu development host, 2026-08-31.

Read the result: This is a useful negative control. No detected indicator is not the same as a proof that a file was never packed or transformed.

Check a 32-bit Windows executable

The MinGW fixture exercises the same detector on PE32/i386 instead of a 64-bit Linux ELF.

run

from the engine checkout

$ glaurung detect-packer samples/binaries/platforms/windows/i386/export/windows/i686/debug/hello-c-mingw32-debug.exe --json

output

captured result captured from the checked-in 32-bit MinGW PE fixture, 2026-08-31

{"is_packed":false,"packer_name":null,"family":null,"confidence":0.0,"indicators":[],"overall_entropy":6.0399,"notes":["no packer indicators found"]}

captured from the checked-in 32-bit MinGW PE fixture, 2026-08-31.

Read the result: The entropy is high enough to be interesting but produced no signature or layout indicator. Run triage and PE inspection before deciding whether the file needs an unpacking workflow.

used above

important options

--json: Emit the verdict and evidence as JSON.
--format plain|rich|json|jsonl: Choose the output format.
--quiet: Suppress non-result messages.

These are the flags used by the examples. Run glaurung detect-packer --help for the complete parser help.

keep working

related commands

← all 40 commands