Command line

$ klarion-cli loaders [--json]

Every file-format loader and every architecture this build has registered. Takes no file.

Run this first when a file will not open. What Klarion recognises is a build-time decision, independent of anything in the file you are holding, and this is the command that tells you what the build decided.

--json

Machine-readable output.

$ klarion-cli info <file>

Format, architecture, bitness, byte order, image base, entry points, size, counts, overlay, every format-specific property the loader exposes, and any load diagnostics.

Runs no analysis, so it is near-instant even on a huge image. This is where the Authenticode verdict appears on a signed PE.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli sections <file>

Every section: name, address range, size, permissions, semantic role and file offset.

A section is a unit of meaning and may have no virtual mapping at all — a debug-only section, for instance. Use segments for the mapping-only view.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli segments <file>

Every segment: the raw units of mapping between file bytes and virtual addresses, with their permissions.

A segment carries no name and no declared role, so the name column is synthesised as #<index> and the type is inferred from permissions and zero-fill.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli symbols <file>

Every symbol the loader recovered: name, address, kind, binding, which table it came from, size and owning library.

View-only, so this reflects exactly what the format's own tables say — including on a stripped binary, where it will be mostly imports and exports.

--imports-only

Only symbols that are imports.

--exports-only

Only symbols that are exports.

--filter <text>

Case-insensitive substring match on the name.

--sort <key>

address (default) or name.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli imports <file>

Imported symbols grouped by the module that provides them, with delay-loaded and weak dependencies marked.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli exports <file>

Every export: name, address, ordinal, and the forwarder target where an export forwards to another module.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli strings <file>

Printable text: address, encoding, byte length and the decoded text of each run.

Plain use scans the loaded image and runs no analysis. --referenced-only has to know what the program points at, so it runs the full pipeline first — which is the difference between a fast command and a slow one.

--min-length N

Shortest run accepted, in characters. Default 4.

--encoding <e>

ascii, utf8, utf16 or all. Default all.

--referenced-only

Only strings something in the image refers to. Runs analysis.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli search <file> "48 8B ?? 24"

Searches the whole file for a byte pattern and prints the address and containing section of each hit.

The pattern is space-separated hex by default, where ?? (or ?) matches any single byte. With --text it is matched as literal text instead. Only the first hit is reported unless you pass --all.

--text

Treat the pattern as literal text, not hex.

--utf16

Encode --text as UTF-16LE instead of 8-bit.

--all

List every match instead of stopping at the first.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli dotnet <file>

The CLI metadata of a managed image: CLR header, assembly manifest and references, the type and method tables, and the string heaps.

Exits with a failure status when the file is not a managed image, so it doubles as a test for one.

--types

List every type the module defines.

--methods

List every method, with its token, RVA and body extent.

--refs

List assembly references and referenced members.

--strings

List the #US literals — what ldstr loads.

--heap-strings

List the #Strings identifiers.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli disasm <file> [--function main --all]

Disassembles from an address, or the whole of one function: address, bytes, text.

Starts at the image's first entry point unless told otherwise. Give either --address or --function, not both. This runs no full analysis: a function is recovered on the spot by one recursive traversal from its entry.

--address <addr>

Start at this hex or decimal address.

--function <ref>

Start at this function: a symbol name or an address.

--count N

Decode N instructions. Default 64.

--all

Decode the whole function instead of --count.

--no-bytes

Omit the raw byte column.

--att

AT&T syntax instead of Intel.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli analyze <file>

Runs the full pipeline and prints the counts: functions and the evidence each was found by, thunks, no-return functions, jump tables, unresolved indirect branches, cross-references, strings, classes, decode failures and elapsed time.

This is the CI smoke test for the engine. Run it over a corpus of known-good binaries and watch for a non-zero exit or a suspicious drop in any count.

--quiet

Print only the counts, one per line.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli functions <file> --sort size

Every recovered function: entry, name, size, basic-block count, how it was discovered, a confidence and its flags.

Progress goes to stderr; stdout carries only the table. That split is what lets you pipe the output without a scraping layer.

--sort <key>

address (default), name or size.

--min-size N

Omit functions smaller than N bytes.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli xrefs <file> CreateFileW

Every cross-reference pointing at a target, and every one originating from it, each annotated with the function it falls inside.

The target is a hex or decimal literal, an image symbol name, or a name analysis generated such as sub_401000.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli diff <a> <b> [--apply-names --save]

Analyses both files and matches their functions on several independent signals, then propagates matches along the call graph to a fixed point.

Every match carries a 0–100 confidence and is classified identical, moved or changed. Nothing ambiguous is reported: a signal shared by more than one candidate on either side matches nothing, because a wrong match costs far more than a missing one.

--min-confidence N

Drop matches below this confidence. 0–100, default 50.

--changed-only

Report only pairs classified changed.

--show-unmatched

Also list the functions that were not matched.

--no-names

Ignore symbol names as a signal, to see what the structural and call-graph signals achieve alone.

--limit N

Print at most N match rows. 0 means no limit, and is the default.

--apply-names

Port names from A onto the functions they matched in B.

--name-confidence N

Minimum confidence to port a name. Default 80 — higher than --min-confidence, because a listed match is a suggestion and a ported name is a claim.

--replace-names

Also replace meaningful names B already had. Never a name the analyst set.

--save

Write the ported names to B's project file. Nothing reaches disk without it.

--show-ported

List every name that was ported.

--show-skipped

List the names that were not ported, with the reason for each.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

--no-align

Tab-separated output even on a terminal.

$ klarion-cli script <file> <script.lua>

Runs the analysis pipeline, then executes a Lua script against the result.

Names and comments a script writes are held in memory; --save writes the project file. Byte patches are separate and reach a file only with --patched-out.

--save

Write the project file when the script finishes.

--patched-out <path>

Write a copy of the binary with the script's byte patches applied. Refused if it made none.

--lang <lua|python>

Override the language implied by the extension. Python needs a build with an embedded interpreter, which release builds are not.

--format <name>

Force a loader instead of auto-detecting.

--arch <name>

Force an architecture. Also picks the slice of a universal Mach-O.

--json

Machine-readable output.

$ klarion-cli report <file> --json > report.json

Everything, in one document: file info, sections, segments, symbols, imports and exports, functions with their basic blocks, strings and the analysis report.

Intended to feed a pipeline. Note the one inconsistency in the whole CLI: here --format selects the output format (json, markdown or html) and --loader forces the loader, where every other command spells that --format.

--format <fmt>

json (default), markdown or html.

--loader <name>

Force a loader. Called --format everywhere else.

--arch <name>

Force an architecture.

--json

Shorthand for --format json.

$ klarion-cli licence activate <key>

What this machine is licensed for, and how to change it: activate from the key on your receipt, install a licence file, remove one, or print the machine fingerprint.

The one command that runs without a licence, because the command that installs a licence cannot sit behind the gate it exists to open. That matters on a build agent, in a container or over SSH, where the answer cannot be “open a menu”. `activate` needs the network; `install` never does, and takes a file from a path or from standard input.

status

Edition, key, seats and expiry. The default.

activate <key>

Exchange the key from your receipt for a licence file.

install <file|->

Install a licence file you already have.

deactivate

Remove the licence from this machine. Local only.

fingerprint

This machine's fingerprint, for offline activation.

--server <url>

Activate against a staging or self-hosted server.

--json

Machine-readable output.

$ klarion-cli update <package>

Verifies a signed update package and applies it to an installation, moving it from one release to the next without re-running the installer.

The other command that runs without a licence, and for a sharper reason than licence does: a security fix has to reach someone running Klarion Free, and an updater that stops working when a subscription lapses turns a billing problem into an unpatched installation. It opens no socket — Klarion never checks for updates by itself, so you fetch the package and hand it to this command. The package is verified against a public key compiled into the build before a byte of it is unpacked, and the installation is untouched until every replacement file has been staged and checked against the digest that was signed; if the machine loses power partway through, --recover finishes or undoes it. Nothing to apply yet: the download page publishes installers only, and the first update package will appear there beside the release it moves you to.

--root <dir>

The installation to update. Defaults to the one this klarion-cli is part of.

--verify

Check the package and print what it contains. Changes nothing.

--dry-run

Plan against the installation and print the plan. Changes nothing.

--status

Report whether an earlier update was left unfinished.

--recover

Finish or undo an update that was interrupted.

--force

Apply even while Klarion appears to be running.

--json

Machine-readable output.