triage command — Glaurung

use it for

Use triage for the first look. It reads a bounded part of the file and does not create a project.

Run glaurung triage --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: One ELF, PE/COFF, Mach-O, archive, bytecode file, or other supported input.
output: A bounded identification report. It includes format, processor, hardening, symbols, strings, and entropy.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung triage PATH [--json]

The installed parser is authoritative: glaurung triage --help

run it

examples

Identify an Ubuntu binary

Start here when you know only the path. This command does not create a project.

run

from the engine checkout

$ glaurung triage /bin/ls

output

captured result captured on the Ubuntu development host, 2026-08-31

path: /bin/ls
size: 11352352 bytes (10.8 MiB)
verdicts: 1
format=ELF arch=x86_64 64-bit endianness=Little confidence=0.80
symbols: imports=0 exports=0 libs=0
strings: ascii=621 utf8=33 u16le=0 u16be=0
entropy: overall=3.21

captured on the Ubuntu development host, 2026-08-31.

Read the result: The first verdict identifies the container and processor. The flags line is the fast hardening check; the string counts tell you whether a separate string pass is likely to pay off.

Feed the result to jq

Use JSON when a shell script needs one field and should ignore terminal formatting.

run

from the engine checkout

$ glaurung triage samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --json | jq '.verdicts[0] | {format, arch, bits}'

output

captured result selected JSON fields

{
  "format": "ELF",
  "arch": "x86_64",
  "bits": 64
}

selected JSON fields.

Read the result: The selected fields are enough to choose the matching processor workflow. Keep the full triage JSON when later code needs hardening, entropy, or string data too.

Identify an ARM64 ELF

The checked-in GCC debug build proves that identification does not depend on the host processor.

run

from the engine checkout

$ glaurung triage samples/binaries/platforms/linux/arm64/export/native/gcc/debug/hello-c-gcc-debug

output

captured result captured from the checked-in ARM64 GCC fixture, 2026-08-31

path: samples/binaries/platforms/linux/arm64/export/native/gcc/debug/hello-c-gcc-debug
size: 11144 bytes (10.9 KiB)
verdicts: 1
format=ELF arch=aarch64 64-bit endianness=Little confidence=0.92
symbols: imports=9 exports=0 libs=1 flags: debug,nx,aslr,relro,pie
strings: ascii=119 utf8=0 u16le=0 u16be=0
languages: eng=1
scripts: Latin=8
entropy: overall=3.39

captured from the checked-in ARM64 GCC fixture, 2026-08-31.

Read the result: The aarch64 verdict selects the ARM64 decoder. The debug flag explains why later symbol and type passes can recover more than they would from a stripped release build.

used above

important options

--json: Emit JSON for a script instead of the terminal report.
--max-read-bytes N: Limit how many bytes the first pass reads.
--tree: Show children found inside an archive or container.
--no-str-classify: Skip IOC classification when you only need identification.

These are the flags used by the examples. Run glaurung triage --help for the complete parser help.

before you rely on it

checks

Use --json when another program will read the result.

keep working

related commands

← all 40 commands