windows-risk command

use it for

The report narrows review; it does not prove a vulnerability. Large drivers can require higher function and timeout limits.

Run glaurung windows-risk --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A PE executable, DLL, or driver.
output: Imports, exports, resources, version data, string xrefs, risky API buckets, and ranked function summaries.
mode: read only. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung windows-risk PATH [--json]

The installed parser is authoritative: glaurung windows-risk --help

run it

examples

Inventory a real Windows driver

Skip pseudocode on the first pass and select only the summary with jq.

run

from the engine checkout

$ glaurung windows-risk samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --no-decompile --json | jq '.summary'

output

captured result selected fields from captured 2026-08-31 output

{
  "format": "PE",
  "arch": "x86_64",
  "function_count": 175,
  "import_count": 78,
  "export_count": 67,
  "lib_count": 2,
  "string_count": 337,
  "data_xref_count": 346
}

selected fields from captured 2026-08-31 output.

Read the result: The summary sizes the review. It does not identify a vulnerability; read the ranked functions and supporting API/string evidence next.

Bound decompiler work

On a large DLL, keep discovery broad but restrict the expensive pseudocode pass.

run

from the engine checkout

$ glaurung windows-risk samples/binaries/platforms/windows/vendor/realworld/win8-pciidex.sys --max-functions 5000 --max-decompile 40 --timeout-ms 30000

output

captured result captured from the checked-in pciidex driver; shortened

Windows Risk Summary
format: PE arch: x86_64 functions: 175 imports: 78 exports: 67 strings: 337 data_xrefs: 346

PE metadata:
  resources: leaves=1 types={'VERSIONINFO': 1}
  version: file=6.2.9200.16384 description=PCI IDE Bus Driver Extension

Top findings:
  [medium] copy-or-format-sink 0x12164: sub_12164 has copy or format sink shape
    evidence: memcpy, PoCallDriver, PoSetPowerState, PoStartNextPowerIrp
  [medium] copy-or-format-sink 0x133dc: sub_133dc has copy or format sink shape
    evidence: memcpy, MmGetSystemRoutineAddress, RtlInitUnicodeString

captured from the checked-in pciidex driver; shortened.

Read the result: The medium rows are pattern matches, not confirmed vulnerabilities. Open the function, its callers, and the argument evidence before promoting one to a finding.

used above

important options

--no-decompile: Skip per-function pseudocode pattern detection for a faster first pass.
--max-functions N: Cap recovered functions; zero means unlimited.
--max-decompile N: Cap functions sent through pseudocode pattern checks.
--timeout-ms N: Bound each analysis phase.
--json: Return the complete report as JSON.

These are the flags used by the examples. Run glaurung windows-risk --help for the complete parser help.

keep working

related commands

← all 40 commands