view command — Glaurung

use it for

view lines up the main forms of evidence at one virtual address. Limit it to one pane when you only need hex, disassembly, or pseudocode.

Run glaurung view --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A project, a virtual address, and the matching binary.
output: Hex bytes, disassembly, and enclosing-function pseudocode aligned at one address.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung view PROJECT VA --binary PATH

The installed parser is authoritative: glaurung view --help

before the examples

project setup

The examples use the checked-in hello-c-clang-debug fixture and a project named hello.glaurung.

$ glaurung kickoff samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --db hello.glaurung

run it

examples

Put three forms of evidence together

Use view after search or xrefs returns an address.

run

from the engine checkout

$ glaurung view hello.glaurung 0x1150 --binary samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug

output

captured result captured fixture output, shortened

── hex @ 0x1150 ──
0x1148  ff 0f 1f 80 00 00 00 00 55 48 89 e5 48 83 ec 20

── disasm @ 0x1150 ──
0x1150  55                        push rbp
0x1151  4889e5                    mov rbp, rsp
0x1154  4883ec20                  sub rsp, 0x20

── pseudocode (enclosing function) ──
fn main {
    // x86-64 prologue: save rbp
    rsp = (rsp - 32);

captured fixture output, shortened.

Read the result: Treat the bytes and instructions as primary. Pseudocode is a recovered view and can be wrong.

Print only instructions

A single pane is easier to paste into an issue or compare with another tool.

run

from the engine checkout

$ glaurung view hello.glaurung 0x11d0 --binary samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --pane disasm

output

captured result captured fixture output, selected instructions

── disasm @ 0x11d0 ──
    0x11d0  55                        push rbp ←
    0x11d1  4889e5                    mov rbp, rsp
    0x11d4  4883ec10                  sub rsp, 0x10
    0x11d8  897dfc                    mov rbp:[rbp - 0x4], edi
    0x11de  488d3d350e0000            lea rdi, rip:[rip + 0x201a]
    0x11e7  e854feffff                call 0x1040
    0x11f1  c3                        ret

captured fixture output, selected instructions.

Read the result: The arrow marks the requested address. The nearby RIP-relative load points at the format string shown on the strings-xrefs page.

used above

important options

--binary PATH: Read bytes from the binary linked to the project.
--pane hex|disasm|pseudo: Print one pane instead of all three.
--hex-window N: Set the number of bytes in the hex pane.
--disasm-window N: Set the number of instructions in the disassembly pane.

These are the flags used by the examples. Run glaurung view --help for the complete parser help.

keep working

related commands

← all 40 commands