explain command — Glaurung

use it for

The default tldr preset favors readable source. Use --fidelity annotated for block-by-block bug review. --require-llm stops instead of silently returning the heuristic fallback.

Run glaurung explain --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A binary, one function VA or byte range, configured model credentials, and a target language.
output: An LLM-assisted C, Rust, or Go rewrite with assumptions. Annotated fidelity keeps block-level evidence.
mode: model + local tools. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung explain PATH --func VA [--style c|rust|go]

The installed parser is authoritative: glaurung explain --help

run it

examples

Rewrite one fixture function

Skip signature and role calls for a smaller example, but require the rewrite model itself.

run

from the engine checkout

$ glaurung explain samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --func 0x1150 --style c --no-types --no-roles --require-llm

output

captured result captured model output, 2026-08-31, shortened

// entry_va: 0x1150
// rewrite-source: llm (fidelity=tldr, confidence 0.86)

#include <stdio.h>
#include <string.h>

int sub_1150(void *arg0) {
    printf("Hello, World from C!\n");
    unsigned int sum = 0;
    unsigned int i = 0;
    const char **strings = (const char **)arg0;
    while (strings[i] != NULL) {
        sum += (unsigned int)strlen(strings[i]);
        i++;
    }
    print_sum(sum);
    static_function();
    return 0;
}

captured model output, 2026-08-31, shortened.

Read the result: The rewrite assumed a null-terminated pointer array. Check that assumption against the actual loop bound and calling convention before using this as recovered source.

Keep basic-block evidence

Annotated fidelity is longer and better suited to bug review around a suspicious address.

run

from the engine checkout

$ glaurung explain samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --func 0x1150 --style c --fidelity annotated --suspicious-va 0x11bd --require-llm

output

captured result captured model output, 2026-08-31; shortened

// entry_va: 0x1150
// prototype-source: llm
// role: wrapper (llm)
// rewrite-source: llm (fidelity=annotated, confidence 0.86)
// prototype: int main(int argc, char *const argv[]);
// suspicious VAs: 0x11bd

// ---- block 0: 0x1150..0x116f (confidence 0.92) ----
printf("Hello, World from C!\n");
// calls in this block:
//   0x1167 -> printf@plt [direct]

// ---- block 1: 0x1171..0x11c8 (confidence 0.74) ----
while (1) {
    strlen(*(u64)&[%ret+%var1*8]);
}
// branches in this block:
//   0x1188 cond -> 0x11ca
//   0x11c8 uncond -> 0x1171

// ---- block 2: 0x11ca..0x11e0 (confidence 0.93) ----
print_sum((unsigned long)((unsigned int)(*(int32_t *)(%rsp + 20))));
static_function();
return;

captured model output, 2026-08-31; shortened.

Read the result: Annotated mode keeps block ranges, call VAs, and branch targets beside the rewrite. The model still emitted a strange strlen operand, so the evidence makes the defect visible instead of smoothing it away.

used above

important options

--func VA: Select the function entry address.
--style c|rust|go: Choose the rewrite language.
--fidelity tldr|annotated: Choose concise source recovery or block-by-block review.
--require-llm: Fail instead of silently returning heuristic output when the model is unavailable.
--with-layer0: Run extra labeler calls; this can add substantial cost.

These are the flags used by the examples. Run glaurung explain --help for the complete parser help.

before you rely on it

checks

The rewrite is not evidence. Keep the disassembly and cited addresses beside it.

keep working

related commands

← all 40 commands