windows command — Glaurung

use it for

windows contains specialized nested commands. Start with glaurung windows --help, then read the help for the action you plan to run.

Run glaurung windows --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A nested Windows action plus PE files, projects, or comparison artifacts required by that action.
output: IOCTL reports, project fact manifests, xrefs, call-graph comparisons, notebooks, task plans, or runner promotion artifacts.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung windows ACTION ...

The installed parser is authoritative: glaurung windows --help

run it

examples

Check a driver for IOCTL dispatch

The real pciidex fixture has no recovered dispatcher, which is a valid negative result.

run

from the engine checkout

$ glaurung windows ioctl samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --format json

output

captured result captured 2026-08-31

{
  "binary": "samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys",
  "dispatcher_count": 0,
  "dispatchers": []
}

captured 2026-08-31.

Read the result: No recovered dispatcher means this action found no IOCTL surface in the file. It is not a general proof that the driver has no externally reachable control path.

Seed a Windows project

This action writes PE facts to an explicit project file for later project-* commands.

run

from the engine checkout

$ glaurung windows bootstrap-project-facts --pe-path samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --project-path driver.glaurung

output

captured result captured from the checked-in pciidex driver; timing removed

Windows project-fact bootstrap: PASS
  project=driver.glaurung
  coverage=call_xrefs,data_xrefs,persisted_cfg,function_boundaries,function_chunks,cfg_dominance,branch_conditions,callsite_path_conditions,memory_operand_facts
  missing=sysinfo_dispatch,pdb_import
  index_function_boundaries ok=True count=146
  index_callgraph ok=True count=142
  index_data_xrefs ok=True count=346
  index_cfg ok=True count=1129
  index_memory_operands ok=True count=25651

captured from the checked-in pciidex driver; timing removed.

Read the result: PASS means the requested indexing stages completed. The missing list remains part of the result: no sysinfo dispatcher or PDB import was available.

used above

important options

ioctl PATH: Recover Windows IOCTL dispatch evidence from a binary.
bootstrap-project-facts: Seed a project with PE facts.
project-xrefs: Query xrefs stored in a Windows project.
target-pipeline: Run the configured Windows target pipeline.
ACTION --help: Read the selected action's own arguments before running it.

These are the flags used by the examples. Run glaurung windows --help for the complete parser help.

before you rely on it

checks

Several actions read or write project artifacts. Check the selected action before running it over a corpus.

keep working

related commands

← all 40 commands