XRef (xref) recovers function ranges from .eh_frame unwind tables (with span fallback) and runs whole-binary scans across CPU cores via rayon in memory — no multi-minute database import, no stale cache, and millisecond xrefs, layout recovery, backward slices, and typed pseudo-C on stripped Rust release binaries (shown below analyzing stripped xref itself, with 0 gotos across all 7 recorded functions).
Historical timings: xref 0.0.5 on the documented stripped ELF sample. Input, hardware and methodology.
curl -fsSL https://xrefcode.com/install.sh | sh
brew tap alex09x/apps brew install xref && xref --version
xref · Rust 1.88+cargo install xref-code --locked # or prebuilt via cargo-binstall: cargo binstall xref-code -y
curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.5.0/xref-v0.5.0-x86_64-unknown-linux-gnu.tar.gz curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.5.0/xref-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256 sha256sum -c xref-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256 && tar -xzf xref-v0.5.0-x86_64-unknown-linux-gnu.tar.gz
Loading recorded scenarios…
Loading recorded functions…
| Operation | Command | ELF Load | Total Time |
|---|---|---|---|
| Binary inventory (1,974 functions, 588 panic locations) | xref -b xref.stripped stats | 0.84 ms | 2.2 ms |
| Whole-binary string & pointer cross-reference scan | xref -b xref.stripped refs "goto L_" | 0.80 ms | 3.9 ms |
| Rust module mapping from embedded panic locations | xref -b xref.stripped where src/loops.rs | 0.79 ms | 3.4 ms |
| Interprocedural struct layout recovery (1-hop callees) | xref -b xref.stripped layout 0xa2270 --reg rsi --callees | 0.81 ms | 2.6 ms |
| Backward program slice + field offset hints | xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields | 0.81 ms | 5.1 ms |
| Cross-build function matching & normalized pseudo-C diff | xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xc7d60 | 0.86 ms | 13.4 ms |
xref 0.5.0 (the remapped Linux x86-64 release build of source commit b00d4a1, made by scripts/package-release.sh before the v0.5.0 tag) on AMD Ryzen 9 9950X (16 cores / 32 threads, Linux 6.8.0-111-generic x86_64) at 2026-11-09T06:38Z; tool SHA-256: 7fbae5a39477402849b2219eb4b9aad76fb17dd638832350cc9c8b4132cc0d8b. Compared with the previous xref 0.4.0 capture, 4 of the recorded commands changed: refs marks references through Rust format templates, stats prints the Build-ID and toolchains, error 13 finds one more reference, and one elapsed-time figure differs. The benchmark table remains the historical xref 0.0.5 single-run measurements on AMD Ryzen 9 9950X / Linux 6.8. Both use two stripped target ELF builds compiled with rustc 1.99.1 (58cf8f9c3 2026-10-13) on x86_64-unknown-linux-gnu via strip --strip-all: primary target xref.stripped from commit 68aa57b (1,962,608 B, sha256:3f3ba3b311f3eca8e26a929285d4fc9ffef4e4b6e8fc015105766180a2a6869d) and comparison target xref-v0.0.2.stripped from tag v0.0.2 / commit e6037d0 (1,899,096 B, sha256:151d7fa78ad7f479ffee73e104230753f929ed9925a6cfd52fefe95e11e467d0). Timings are single-process CLI wall times printed to stderr on warm OS page cache, not browser-side timings.Recovers immutable arg_* signatures, live-range webs (ptr_*, v_*, slot_*), 1-operand widening mul/div (u128/i128), multi-precision adc/sbb carry chains, and optional f_* offset hints.
Recognizes stripped rust_panic_bounds_check, rust_slice_index_fail, and rust_capacity_overflow helpers, bounds unproven .rodata previews, and slices exact &str / core::panic::Location descriptors.
Aggregates memory displacements, access widths, read/write/lea counts, SIB array strides, and 1-hop forwarded callee parameter offsets per pointer argument register.
Intersects callees, referenced strings, immediate constants, struct displacements, Rust source paths, and byte size bounds in one parallel pass across all functions.
Matches stripped functions across compiler builds via structural invariants and diffs normalized pseudo-C with shifted addresses, labels, and skip flags abstracted away.
xref slice isolates balanced statements and guards reaching an exact instruction IP, call, or panic site; xref dump groups stripped functions by panic source paths into modular .c files.
One immutable image, SHA-256 identity, typed schemas, pagination, cancellation and explicit budgets. info opens with a triage and ready-to-run next queries; every answer carries a confidence tier and a deterministic evidence ID; --compact keeps responses short. Configure a local read-only agent tool.
Start from an error message: origin lists the stores of its enum tag, conversions, calls passing the tag and the guards around each, following it through copies, spills, stack objects, records and loops that read them by value. callargs finds every call passing a constant. origin · callargs.
Read the dependency manifest cargo-auditable embeds in Rust binaries and the Go module list, with toolchains and Build-ID, and typed values at any virtual address. Only what the binary embeds is reported. deps · data.
Pseudo-C types scalar SSE/AVX f32/f64 parameters, returns and call results; an indirect call through constant vtables lists each possible target with the branch condition that selects it, and table dumps the records with their relocated pointers. table.
Keep alternative call sites, CFG guards and instruction definitions visible; distinguish field addresses from loaded values. Investigations · Field origins.
Thin little-endian x86-64 Mach-O with DWARF FDEs; ARM64, universal and compact-only input remain unsupported. Explicit stack anchors and opt-in goto output.
Verify the running executable, search private writable memory for known values and classify neighbouring words as code, string, heap or vtable pointers resolved to static functions. Recorded walkthrough.
Bounded perf uprobes count calls, callers and registers; DR0–DR3 watchpoints name the candidate store and value, and follow a buffer after it moves. Coverage gaps stay explicit.
The xref_live tool is exposed only when a verified PID is pinned at startup, with strict budgets, one live call at a time and cancellation. Contract & limits.
Connects serialized key strings to struct field offsets with instruction witnesses and ranks candidate writers, optionally only through a returned, argument or loaded pointer. Rankings are heuristic candidates, not type proof. Field search.
Record thread-scoped call windows in program order through tracefs uprobes, with explicit stop points and limits, and sample bounded CPU profiles of one verified process. Linux x86-64; traces need privileged tracefs access, profiles depend on the kernel perf_event_paranoid policy.
Summarize, annotate and diff .xprof recordings, import perf.data (with bounded Intel PT decoding) or perf script text, and map saved stacks and observed call edges onto the selected executable. Offline traces.
xref -b xref.stripped stats # functions, code bytes, pointers, imports, panic locations
xref -b xref.stripped refs "goto L_" # code & data slots referencing text or address (--inline)
xref -b xref.stripped disp 0x18 --lea --in 0x65e30 # struct field loads/stores/leas + receiving callee (--all, --stride)
xref -b xref.stripped layout 0xa2270 --reg rsi --callees # aggregate struct offsets, widths, strides & 1-hop callees
xref -b xref.stripped imm 59 --cmp --in 0xc7d60 # immediate constants (--store, --cmp, --in FN)
xref -b xref.stripped find --src src/loops.rs --calls 0x160bb0 # multi-predicate function search in one parallel pass
xref -b xref.stripped where src/image.rs --line 46 # map Rust source file & line to stripped function ranges
xref -b xref.stripped args 0xa2270 # constant & symbolic arguments across all call sites
xref -b xref.stripped path 0xc7fc0 0x160bb0 # shortest call chains between two functions
xref -b xref.stripped tree 0xd0aa0 --callers --depth 2 # indented caller/callee tree with panic locations
xref -b xref.stripped variant 0xc7fc0 2 # jump-table arms & string literals for enum discriminant
xref -b xref.stripped match --other xref-v0.0.2.stripped 0xc7d60 --top 2 # relocate shifted functions across two stripped builds
xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xd57c0 # cross-build normalized pseudo-C diff
xref -b xref.stripped c 0xc7d60 --fields # structured pseudo-C with heuristic offset hints
xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields # backward program slice to target call, IP, or string
xref -b xref.stripped dump --out out-loops --src src/loops.rs # parallel modular pseudo-C export by source file
xref -b xref.stripped query '{"operation":"info"}' # versioned JSON with immutable image identity
xref -b xref.stripped mcp # local read-only stdio MCP
xref -b xref.stripped disp 0x18 0x28 --all --stack # fields relative to explicit stack anchors
xref -b xref.stripped c 0xc7d60 --goto # preserve residual labels and transitions
xref -b ./app live memscan --pid PID 0x4441454d4f4e5632 # Linux: find values in a running process (also maps, resolve)
sudo xref -b ./app live probe --pid PID --callers 0x1f9f0 # Linux: bounded uprobe call counts, callers, registers
sudo xref -b ./app live watch --pid PID 0x55d1e1c3adc8 # Linux: hardware write watch (--follow for moving buffers)
sudo xref -b ./app live trace --pid PID --start 0x1f9f0 --stop-return 0x1f9f0 --callees-of 0x1f9f0 # Linux: ordered per-thread call windows
sudo xref -b ./app live profile --pid PID --duration 10s --out app.xprof # Linux: bounded CPU sampling profile
xref -b ./app field --keys c,m,e --write --writes-all-of m,e # serialized keys -> field layout & ranked writer candidates
xref -b ./app profile report app.xprof --by function --top 30 # summarize (also annotate, diff, import perf.data) profiles
xref -b ./app origin "number out of range" # code that builds an error: tag stores, conversions, guards, readers
xref -b ./app callargs 0x2c --arg rdx # every call passing a constant, grouped by callee
xref -b ./app deps --filter tokio # embedded cargo-auditable / Go build manifest, toolchains, Build-ID
xref -b ./app data 0x492c0b --as str # typed values at a virtual address
XRef is authored by Alexander Panasenko. Latest archived snapshot: v0.5.0 (10.5281/zenodo.24076380). Prior v0.4.0 snapshot: 10.5281/zenodo.23968336; v0.3.0 snapshot: 10.5281/zenodo.23932112; v0.2.0 snapshot: 10.5281/zenodo.23902824; v0.1.0 snapshot: 10.5281/zenodo.23878790.
@software{panasenko_2026_24076380,
author = {Panasenko, Alexander},
title = {XRef — Ultra Blazing Fast x86-64 ELF and Mach-O Analysis, Live Linux Process Inspection, Pseudo-C and Local MCP},
month = nov,
year = 2026,
publisher = {Zenodo},
version = {0.5.0},
doi = {10.5281/zenodo.24076380},
url = {https://doi.org/10.5281/zenodo.24076380}
}
Alexander Panasenko (2026). XRef — Ultra Blazing Fast x86-64 ELF and Mach-O Analysis, Live Linux Process Inspection, Pseudo-C and Local MCP (v0.5.0). Zenodo. https://doi.org/10.5281/zenodo.24076380 (concept DOI: 10.5281/zenodo.23878789).