strings command — Glaurung

use it for

This command works without a project. Use strings-xrefs after kickoff when you need the code that reads each string.

Run glaurung strings --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A binary or data file. No project is required.
output: Decoded strings with offsets, encodings, length statistics, entropy, language clues, and optional IOC labels.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung strings PATH [--min-len N] [--raw-limit N]

The installed parser is authoritative: glaurung strings --help

run it

examples

See imports and program text

Fourteen rows reach past the loader names to the strings written by this small program.

run

from the engine checkout

$ glaurung strings samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --min-len 6 --raw-limit 14

output

captured result captured from the checked-in fixture, 2026-08-31

path: samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug
size: 17680 bytes (17.3 KiB)
encodings: ascii=87 utf8=0 u16le=0 u16be=0
languages: (none)
scripts: Latin=16
lengths: count=87 min=6 max=44 mean=15.2 median=12.0 p90=27.0 p99=38.8
entropy: count=87 min=2.25 max=4.18 mean=3.18 p90=3.85 p99=4.12
[0x318] ascii len=27 3.86 | /lib64/ld-linux-x86-64.so.2
[0x489] ascii len=14 3.18 | __cxa_finalize
[0x498] ascii len=17 3.26 | __libc_start_main
[0x4aa] ascii len= 6 2.58 | strlen
[0x4b1] ascii len= 6 2.58 | printf
[0x4b8] ascii len= 9 2.95 | libc.so.6
[0x4c2] ascii len=11 3.10 | GLIBC_2.2.5
[0x4ce] ascii len=10 3.32 | GLIBC_2.34
[0x4d9] ascii len=27 3.85 | _ITM_deregisterTMCloneTable
[0x4f5] ascii len=14 2.84 | __gmon_start__
[0x504] ascii len=25 3.81 | _ITM_registerTMCloneTable
[0x2004] ascii len=20 3.51 | Hello, World from C!
[0x201a] ascii len=25 3.86 | Total argument length: %d
[0x2035] ascii len=31 3.81 | Static function called %d times

captured from the checked-in fixture, 2026-08-31.

Read the result: The rows follow file-offset order, so a small raw limit can hide the program text behind loader names. These are file offsets, not virtual addresses; use strings-xrefs after kickoff to find the instructions that read them.

Hunt IOC-shaped strings

Enable classification and keep the result machine-readable for a larger corpus pass.

run

from the engine checkout

$ glaurung strings /usr/bin/curl --min-len 8 --classify --json

output

captured result captured on the Ubuntu development host; selected fields

{
  "metadata": {"path":"/usr/bin/curl","size_bytes":334360},
  "encodings": {"ascii":1567,"utf8":30,"utf16le":0,"utf16be":0},
  "iocs": {"java_path":21,"url":2,"path_posix":28,"hostname":7,"ipv4":0},
  "lengths": {"count":1567,"stats":{"min":8,"max":157,"median":19}},
  "strings": [
    {"text":"/lib64/ld-linux-x86-64.so.2","offset":883,"length":28}
  ]
}

captured on the Ubuntu development host; selected fields.

Read the result: The IOC counts are classifier leads, not confirmed indicators of compromise. Preserve the matching string and offset before escalating one.

Recognize a Fortran runtime

An ARM64 gfortran build exposes language and runtime clues that do not appear in the C fixture.

run

from the engine checkout

$ glaurung strings samples/binaries/platforms/linux/arm64/export/fortran/hello-gfortran-debug --min-len 8 --raw-limit 20

output

captured result captured from the checked-in ARM64 gfortran fixture; selected rows

path: samples/binaries/platforms/linux/arm64/export/fortran/hello-gfortran-debug
size: 15568 bytes (15.2 KiB)
encodings: ascii=99 utf8=0 u16le=0 u16be=0
lengths: count=99 min=8 max=194 mean=20.2 median=15.0 p90=34.0 p99=48.0
[0x238] ascii len=26 | /lib/ld-linux-aarch64.so.1
[0x4ae] ascii len=25 | _gfortran_string_len_trim
[0x4c8] ascii len=15 | _gfortran_iargc
[0x4d8] ascii len=32 | _gfortran_transfer_integer_write
[0x570] ascii len=33 | _gfortran_get_command_argument_i4
[0x5b9] ascii len=16 | libgfortran.so.5
[0x5ea] ascii len=10 | GFORTRAN_8

captured from the checked-in ARM64 gfortran fixture; selected rows.

Read the result: The loader path identifies ARM64, while the _gfortran names identify compiler runtime calls. These clues help choose language-aware analysis even when source symbols are incomplete.

used above

important options

--min-len N: Discard strings shorter than N characters.
--raw-limit N: Cap the number of string rows printed.
--classify: Classify paths, hosts, addresses, and other IOC-shaped text.
--no-entropy: Skip per-string entropy when speed matters more than statistics.

These are the flags used by the examples. Run glaurung strings --help for the complete parser help.

keep working

related commands

← all 40 commands