Documentation
Guides for every XRef workflow, generated from the Markdown in the repository. Start with the command reference on the home page, or the recorded Live Analysis walkthrough.
Static analysis
Field key search and writer ranking
Search a stripped executable for a set of serialized keys and rank candidate writers with:
Serialized field names and input-relative access candidates
This workflow, available starting with v0.4.0, connects a literal key and length to an input-relative value in a known function-call model:
Field-origin investigations
Available starting with v0.2.0. The JSON CLI and the local MCP xref_query tool share this operation. The inspected binary is never executed.
Instruction search and cross-build ambiguity
These workflow additions are available starting with v0.4.0.
Bounded investigations
Available starting with v0.2.0. The JSON CLI and the local MCP xref_query tool accept the same request. The inspected file is read, never executed.
Stack displacement searches and label-preserving output
Available starting with v0.2.0. The v0.1.0 binaries do not include these flags.
Mach-O input support
Available starting with v0.2.0. Published v0.1.0 binaries and the registry package at version 0.1.0 remain ELF-only.
Live & profiles
Linux live analysis: architecture and acceptance contract
Status: implemented across Stages L1 (PR #49), L2 (PR #53), L3 Increment 1 (PR #54), L3 Increment 2 (PR #55), and L4 for issue #46. Available starting with v0.3.0; the published v0.2.0 and earlier binaries do not contain xref live or the opt-in xref_live MCP tool.
Offline stacks and observed call evidence
symbolize maps addresses from a saved run onto the **selected executable**. It never attaches to a running process. Frames in another executable, a shared library, an ambiguous mapping, or a range without unwind information remain explicitly unresolved. These commands are available starting with v0.