glaurung

What works today

Glaurung is a pre 1.0 reverse engineering framework with a Rust analysis core, Python bindings, a command line interface, persistent SQLite project files, and optional LLM assisted workflows. The README states it is useful today for automated binary triage and analysis but is not yet a drop in replacement for mature interactive tools like Ghidra or IDA Pro, and that decompiler output is still experimental and should be checked against disassembly and runtime behavior. Working capabilities include ELF, PE/COFF and Mach-O triage covering symbols, strings, indicators of compromise, entropy, packer signals and hardening metadata, plus bounded disassembly for x86/x86-64, ARM/ARM64 and RISC-V.

Tooling and agents

Beyond triage the framework offers function discovery, control flow graphs, call graphs, cross references, stack frame analysis, type propagation, DWARF ingestion and PE/PDB support. A developing LLIR/SSA/AST pipeline produces C-like pseudocode. Analysis state is stored in persistent .glaurung project databases holding names, comments, labels, types, prototypes, xrefs, stack variables, bookmarks and journal entries. The CLI and a Python API support scripting, and optional PydanticAI agents assist with question answering, naming, vulnerability review and source recovery. The README warns the decompiler is experimental and should be verified.

Install and usage

Glaurung is not published on PyPI, so it is built from source. Requirements are Git, CPython 3.11 or newer, Rust 1.88 or newer, and a native C compiler and linker. The recommended path uses uv: clone, uv sync --locked --dev to create a venv and build the Rust extension, then uv run glaurung commands. The repository ships real sample binaries so a smoke test of triage, kickoff and decompile needs no API key or external tool. A guided walkthrough starts at the install tutorial, and the Python API lets scripts call triage.analyze_path directly within the project environment.

Editorial conclusion

Glaurung is Apache-2.0 licensed and reported twenty seven stars at indexing, and it ships sample binaries so triage runs without an external API key.