group command — Glaurung

use it for

Repeat --member at least twice. Names identify rows in the report; paths select the binaries.

Run glaurung group --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: At least two repeatable NAME=PATH members.
output: Per-member pool-tag allocation counts, shared tags, call sites, coverage, and explicit caveats.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung group --member NAME=PATH --member NAME=PATH [...]

The installed parser is authoritative: glaurung group --help

run it

examples

Run a negative control

Two ordinary Linux fixture builds contain no Windows pool-tag allocation sites.

run

from the engine checkout

$ glaurung group --member debug=samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --member optimized=samples/binaries/platforms/linux/amd64/export/native/clang/O2/hello-c-clang-O2

output

captured result captured 2026-08-31, shortened

; module-group pool-tag analysis
;   debug: 0 tags, 0 alloc sites
;   optimized: 0 tags, 0 alloc sites
; SHARED pool tags (0):
  (none shared)

--- coverage (module-group/pool-tags) ---
members: debug, optimized
alloc call sites: {'debug': 0, 'optimized': 0}
distinct tags: {'debug': 0, 'optimized': 0}

captured 2026-08-31, shortened.

Read the result: A shared tag scopes a possible cross-module pool surface. It does not prove corruption or an overflow path.

Compare two drivers

Names become report labels; use short, stable module names.

run

from the engine checkout

$ glaurung group --member pci=samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --member wifi=samples/binaries/platforms/windows/vendor/realworld/win10-vwififlt.sys --json

output

captured result captured from the checked-in Windows drivers; selected fields

{
  "members": [
    {"name":"pci","alloc_calls":2,"tag_unresolved":0,"tags":{"IdeX":[77068],"PlTc":[78177]}},
    {"name":"wifi","alloc_calls":1,"tag_unresolved":1,"tags":{}}
  ],
  "shared_tags": {},
  "coverage": {"analysis":"module-group/pool-tags","complete":false}
}

captured from the checked-in Windows drivers; selected fields.

Read the result: There are no shared literal tags in this pair, and wifi has one unresolved tag argument. The incomplete marker prevents a clean negative claim.

used above

important options

--member NAME=PATH: Add one named module; repeat at least twice.
--json: Return members, tags, and sites as JSON.
--verbose: Show additional recovery detail.

These are the flags used by the examples. Run glaurung group --help for the complete parser help.

keep working

related commands

← all 40 commands