XRef Code
Zero-index cross-references, layout recovery, slicing and pseudo-C for x86-64 ELF binaries.
- 4d53038 feat(release): prepare xref-code crates.io package, binstall, JSON-LD, and provenance 2026-11-02
- 4ac500a docs: add published Zenodo v0.1.0 and concept DOIs 2026-11-02
- c2bf310 Polish logo banner padding, CSP headers, and release path-leak check 2026-11-02
- 667ee8e fix(ci): dispatch update-homebrew.yml explicitly after GITHUB_TOKEN release publish 2026-11-02
Status from GitHub and crates.io as of 2026-11-02.
The problem
Answering a question about a stripped binary usually starts with importing it into an analysis database. xref keeps no index: each command maps the ELF image, takes function ranges from the .eh_frame unwind tables (falling back to inferred spans), and decodes functions in parallel to answer one query.
Example uses
01. Cross-references
Find the code and data that refer to a string or an address with xref refs.
02. Struct layout recovery
Infer field offsets, sizes and strides used through a register with xref layout, optionally across direct callees.
03. Slicing and pseudo-C
Print a backward slice of the statements and guards reaching a call with xref slice, or structured pseudo-C for a function with xref c.
04. Comparing builds
Match a function across two stripped builds and diff its normalized pseudo-C with xref diff-c.
Where it fits
xref is a single command-line tool with no project database, written in safe Rust (unsafe code is forbidden in the crate). Types and field hints are reconstructed from machine-code uses, not from DWARF, so they complement an interactive disassembler rather than replace it.
Get started
brew tap alex09x/apps
brew install xref
xref -b ./your-binary statsPrebuilt v0.1.0 archives exist for x86_64 Linux (glibc 2.34 or later) and Apple Silicon macOS; cargo install --git https://github.com/alex09x/xref --tag v0.1.0 --locked builds from source. The README records example runs and single-run timings measured with xref 0.0.5 on one stripped Rust binary.
Authoritative installation steps, architecture diagrams, and full configuration references are maintained in the repository:
Read the XRef Code README on GitHub →
Limitations
- Input is limited to x86-64 ELF executables and shared objects; PE, Mach-O and AArch64 are out of scope.
- The recorded examples and the end-to-end tests use Rust binaries; other source languages are not covered by published runs.
- Without .eh_frame (for example after strip -R .eh_frame) function boundaries fall back to heuristics.
- Signatures, types and field hints are conservative static reconstructions, not source types; instructions it does not model are left as inline assembly comments.
Cite this software · archived version v0.1.0
Cite this software
Alexander Panasenko (2026). XRef Code — Ultra Blazing Fast x86-64 ELF Cross-References & Pseudo-C Decompiler (v0.1.0). Zenodo. https://doi.org/10.5281/zenodo.23878790This record reflects the archived software version deposited on Zenodo for citation and reproducibility, which may differ from subsequent development releases.