XRef (xref) recovers function ranges from .eh_frame unwind tables (with span fallback) and runs whole-binary scans across CPU cores via rayon in memory — no multi-minute database import, no stale cache, and millisecond xrefs, layout recovery, backward slices, and typed pseudo-C on stripped Rust release binaries (shown below analyzing stripped xref itself, with 0 gotos across all 7 recorded functions).
Historical timings: xref 0.0.5 on the documented stripped ELF sample. Input, hardware and methodology.
brew tap alex09x/apps brew install xref && xref --version
xref · Rust 1.88+cargo install xref-code --locked # or prebuilt via cargo-binstall: cargo binstall xref-code -y
curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.3.0/xref-v0.3.0-x86_64-unknown-linux-gnu.tar.gz curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.3.0/xref-v0.3.0-x86_64-unknown-linux-gnu.tar.gz.sha256 sha256sum -c xref-v0.3.0-x86_64-unknown-linux-gnu.tar.gz.sha256 && tar -xzf xref-v0.3.0-x86_64-unknown-linux-gnu.tar.gz
Loading recorded scenarios…
Loading recorded functions…
| Operation | Command | ELF Load | Total Time |
|---|---|---|---|
| Binary inventory (1,974 functions, 588 panic locations) | xref -b xref.stripped stats | 0.84 ms | 2.2 ms |
| Whole-binary string & pointer cross-reference scan | xref -b xref.stripped refs "goto L_" | 0.80 ms | 3.9 ms |
| Rust module mapping from embedded panic locations | xref -b xref.stripped where src/loops.rs | 0.79 ms | 3.4 ms |
| Interprocedural struct layout recovery (1-hop callees) | xref -b xref.stripped layout 0xa2270 --reg rsi --callees | 0.81 ms | 2.6 ms |
| Backward program slice + field offset hints | xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields | 0.81 ms | 5.1 ms |
| Cross-build function matching & normalized pseudo-C diff | xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xc7d60 | 0.86 ms | 13.4 ms |
xref 0.3.0 (release build of source base 9dbcb2f, rustc 1.97.1) on AMD Ryzen 9 7950X3D (16 cores / 32 threads, Linux 5.15.0-191-generic x86_64) at 2026-11-03T19:44Z; tool SHA-256: d0cbe968e306a1f4d9e9edb770b6ebf99f8e7dee94795a81bd311b9dd398a0e3. Every recorded stdout matches the previous xref 0.2.0 capture except one elapsed-time figure. The benchmark table remains the historical xref 0.0.5 single-run measurements on AMD Ryzen 9 9950X / Linux 6.8. Both use two stripped target ELF builds compiled with rustc 1.99.1 (58cf8f9c3 2026-10-13) on x86_64-unknown-linux-gnu via strip --strip-all: primary target xref.stripped from commit 68aa57b (1,962,608 B, sha256:3f3ba3b311f3eca8e26a929285d4fc9ffef4e4b6e8fc015105766180a2a6869d) and comparison target xref-v0.0.2.stripped from tag v0.0.2 / commit e6037d0 (1,899,096 B, sha256:151d7fa78ad7f479ffee73e104230753f929ed9925a6cfd52fefe95e11e467d0). Timings are single-process CLI wall times printed to stderr on warm OS page cache, not browser-side timings.Recovers immutable arg_* signatures, live-range webs (ptr_*, v_*, slot_*), 1-operand widening mul/div (u128/i128), multi-precision adc/sbb carry chains, and optional f_* offset hints.
Recognizes stripped rust_panic_bounds_check, rust_slice_index_fail, and rust_capacity_overflow helpers, bounds unproven .rodata previews, and slices exact &str / core::panic::Location descriptors.
Aggregates memory displacements, access widths, read/write/lea counts, SIB array strides, and 1-hop forwarded callee parameter offsets per pointer argument register.
Intersects callees, referenced strings, immediate constants, struct displacements, Rust source paths, and byte size bounds in one parallel pass across all functions.
Matches stripped functions across compiler builds via structural invariants and diffs normalized pseudo-C with shifted addresses, labels, and skip flags abstracted away.
xref slice isolates balanced statements and guards reaching an exact instruction IP, call, or panic site; xref dump groups stripped functions by panic source paths into modular .c files.
One immutable image, SHA-256 identity, typed schemas, pagination, cancellation and explicit budgets. Configure a local read-only agent tool.
Keep alternative call sites, CFG guards and instruction definitions visible; distinguish field addresses from loaded values. Investigations · Field origins.
Thin little-endian x86-64 Mach-O with DWARF FDEs; ARM64, universal and compact-only input remain unsupported. Explicit stack anchors and opt-in goto output.
Verify the running executable, search private writable memory for known values and classify neighbouring words as code, string, heap or vtable pointers resolved to static functions. Recorded walkthrough.
Bounded perf uprobes count calls, callers and registers; DR0–DR3 watchpoints name the candidate store and value, and follow a buffer after it moves. Coverage gaps stay explicit.
The xref_live tool is exposed only when a verified PID is pinned at startup, with strict budgets, one live call at a time and cancellation. Contract & limits.
xref -b xref.stripped stats # functions, code bytes, pointers, imports, panic locations
xref -b xref.stripped refs "goto L_" # code & data slots referencing text or address (--inline)
xref -b xref.stripped disp 0x18 --lea --in 0x65e30 # struct field loads/stores/leas + receiving callee (--all, --stride)
xref -b xref.stripped layout 0xa2270 --reg rsi --callees # aggregate struct offsets, widths, strides & 1-hop callees
xref -b xref.stripped imm 59 --cmp --in 0xc7d60 # immediate constants (--store, --cmp, --in FN)
xref -b xref.stripped find --src src/loops.rs --calls 0x160bb0 # multi-predicate function search in one parallel pass
xref -b xref.stripped where src/image.rs --line 46 # map Rust source file & line to stripped function ranges
xref -b xref.stripped args 0xa2270 # constant & symbolic arguments across all call sites
xref -b xref.stripped path 0xc7fc0 0x160bb0 # shortest call chains between two functions
xref -b xref.stripped tree 0xd0aa0 --callers --depth 2 # indented caller/callee tree with panic locations
xref -b xref.stripped variant 0xc7fc0 2 # jump-table arms & string literals for enum discriminant
xref -b xref.stripped match --other xref-v0.0.2.stripped 0xc7d60 --top 2 # relocate shifted functions across two stripped builds
xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xd57c0 # cross-build normalized pseudo-C diff
xref -b xref.stripped c 0xc7d60 --fields # structured pseudo-C with heuristic offset hints
xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields # backward program slice to target call, IP, or string
xref -b xref.stripped dump --out out-loops --src src/loops.rs # parallel modular pseudo-C export by source file
xref -b xref.stripped query '{"operation":"info"}' # versioned JSON with immutable image identity
xref -b xref.stripped mcp # local read-only stdio MCP
xref -b xref.stripped disp 0x18 0x28 --all --stack # fields relative to explicit stack anchors
xref -b xref.stripped c 0xc7d60 --goto # preserve residual labels and transitions
xref -b ./app live memscan --pid PID 0x4441454d4f4e5632 # Linux: find values in a running process (also maps, resolve)
sudo xref -b ./app live probe --pid PID --callers 0x1f9f0 # Linux: bounded uprobe call counts, callers, registers
sudo xref -b ./app live watch --pid PID 0x55d1e1c3adc8 # Linux: hardware write watch (--follow for moving buffers)
XRef is authored by Alexander Panasenko. Latest archived snapshot: v0.3.0 (10.5281/zenodo.23932112). Prior v0.2.0 snapshot: 10.5281/zenodo.23902824; v0.1.0 snapshot: 10.5281/zenodo.23878790.
@software{panasenko_2026_23932112,
author = {Panasenko, Alexander},
title = {XRef — Ultra Blazing Fast x86-64 ELF and Mach-O Analysis, Live Linux Process Inspection, Pseudo-C and Local MCP},
month = nov,
year = 2026,
publisher = {Zenodo},
version = {0.3.0},
doi = {10.5281/zenodo.23932112},
url = {https://doi.org/10.5281/zenodo.23932112}
}
Alexander Panasenko (2026). XRef — Ultra Blazing Fast x86-64 ELF and Mach-O Analysis, Live Linux Process Inspection, Pseudo-C and Local MCP (v0.3.0). Zenodo. https://doi.org/10.5281/zenodo.23932112 (concept DOI: 10.5281/zenodo.23878789).