disasm command — Glaurung

use it for

Addresses are virtual addresses, not file offsets. Use a checked-out sample for this example because /bin/ls differs by system.

Run glaurung disasm --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A binary and either a virtual address, its entry point, or a function stored in a project.
output: Decoded instructions with virtual addresses and raw bytes.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung disasm PATH --addr VA [--max-instructions N]

The installed parser is authoritative: glaurung disasm --help

run it

examples

Decode main

The fixture has a stable main address, so the example works across machines.

run

from the engine checkout

$ glaurung disasm samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --addr 0x1150 --max-instructions 5

output

captured result captured fixture output

engine: iced-x86 arch: x86_64
0x1150: 55                   push rbp
0x1151: 4889e5               mov rbp, rsp
0x1154: 4883ec20             sub rsp, 0x20
0x1158: c745fc00000000       mov rbp:[rbp - 0x4], 0x0
0x115f: 897df8               mov rbp:[rbp - 0x8], edi

captured fixture output.

Read the result: The address is a VA, not a file offset. The raw-byte column lets you confirm that a patch or external disassembler is looking at the same bytes.

Apply project names

After kickoff, ask for a function by name and let its recovered CFG set the bounds.

run

from the engine checkout

$ glaurung disasm samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --db hello.glaurung --function main --comments

output

captured result captured fixture output, selected instructions

; main  0x1150-0x11cf  (33 insns)
  0x1150: push rbp
  0x1151: mov rbp, rsp
  0x1166: lea rdi, rip:[rip + 0x2004]
  0x116f: call 0x1040   ; -> printf@plt
  0x11bd: call 0x11d0   ; -> print_sum
  0x11c2: call 0x1200   ; -> static_function
  0x11ce: ret

captured fixture output, selected instructions.

Read the result: Project names turn raw call targets into printf, print_sum, and static_function. Keep the addresses beside the names; names are annotations and can change.

used above

important options

--addr VA: Begin at this virtual address.
--max-instructions N: Stop after N decoded instructions.
--comments: Annotate recognized calls and strings.
--db PROJECT --function NAME|VA: Use project names and CFG-derived function bounds.

These are the flags used by the examples. Run glaurung disasm --help for the complete parser help.

before you rely on it

checks

Pass --db to apply names stored in a project.

keep working

related commands

← all 40 commands