pe command — Glaurung

use it for

Use the nested action that matches the PE data you need. This command does not run the full Windows analysis pipeline.

Run glaurung pe --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A Windows PE/COFF executable, DLL, or driver plus resources, manifest, or version.
output: Resource-tree rows, decoded XML manifest fields, or VERSIONINFO fields.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung pe {resources|manifest|version} PATH

The installed parser is authoritative: glaurung pe --help

run it

examples

Show an empty resource tree

The MinGW fixture has no resources. The zero counts are the result, not an error.

run

from the engine checkout

$ glaurung pe resources samples/binaries/platforms/windows/amd64/export/windows/x86_64/debug/hello-c-mingw64-debug.exe

output

captured result captured 2026-08-31

# PE resources: hello-c-mingw64-debug.exe
leaves: 0  matched: 0  directories: 0  bytes: 0

captured 2026-08-31.

Read the result: An empty resource directory rules out embedded manifest and version records in this file. It says nothing about adjacent files.

Read a real driver version

The checked-in Windows 8 pciidex driver contains VERSIONINFO.

run

from the engine checkout

$ glaurung pe version samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --json | jq '{file_version, product_version, strings}'

output

captured result selected fields from captured output

{
  "file_version": "6.2.9200.16384",
  "product_version": "6.2.9200.16384",
  "strings": {
    "FileDescription": "PCI IDE Bus Driver Extension",
    "OriginalFilename": "pciidex.sys"
  }
}

selected fields from captured output.

Read the result: Version resources identify the vendor build but do not prove the file is authentic. Hash or signature checks belong in a separate provenance step.

used above

important options

resources: List resource leaves and sizes.
manifest: Decode the application manifest when present.
version: Decode fixed and localized version records.
--json: Return the selected report as JSON.

These are the flags used by the examples. Run glaurung pe --help for the complete parser help.

keep working

related commands

← all 40 commands