find command — Glaurung

use it for

The query is a substring by default. Use --regex for a regular expression and --binary when the search needs bytes not stored in the project.

Run glaurung find --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A .glaurung project, a query, and optionally the original binary for disassembly searches.
output: Matching functions, strings, comments, labels, types, stack variables, or instructions.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung find PROJECT QUERY [--kind KIND]

The installed parser is authoritative: glaurung find --help

before the examples

project setup

The examples use the checked-in hello-c-clang-debug fixture and a project named hello.glaurung.

$ glaurung kickoff samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --db hello.glaurung

run it

examples

Resolve a function name

Narrowing the kind removes string and comment matches with the same text.

run

from the engine checkout

$ glaurung find hello.glaurung main --kind function

output

captured result captured fixture output

kind        location        snippet
--------------------------------------------------------------------------------
function    0x1150          main  (set_by=analyzer)

captured fixture output.

Read the result: Use the returned VA with view, xrefs, frame, disasm, or a write command.

Search decoded instructions

Instruction text is not stored for every project, so this form also supplies the binary.

run

from the engine checkout

$ glaurung find hello.glaurung 'call.*printf' --kind disasm --regex --binary samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug

output

captured result captured fixture output, 2026-08-31

(no matches for 'call.*printf')

captured fixture output, 2026-08-31.

Read the result: The disassembler renders this target as call 0x1040 and adds printf as a comment elsewhere. Search the syntax that the selected view actually emits; an empty regex result is not proof that the call is absent.

used above

important options

--kind KIND: Search one record class, such as function, string, comment, or disasm.
--regex: Interpret the query as a regular expression.
--case-sensitive: Disable case folding.
--binary PATH: Supply bytes for a disassembly search.

These are the flags used by the examples. Run glaurung find --help for the complete parser help.

keep working

related commands

← all 40 commands