XRef Code releases

XRef Code v0.1.0

Zero-index x86-64 ELF cross-references, .eh_frame function discovery, backward program slicing, struct displacement recovery, and goto-free structured pseudo-C — written in pure safe Rust (#![forbid(unsafe_code)]).

• Website & Recorded Workbench: https://xrefcode.com
• Zenodo Archival Record (v0.1.0): https://doi.org/10.5281/zenodo.23878790 (concept DOI for all versions: https://doi.org/10.5281/zenodo.23878789)
• Documentation & CLI Reference (v0.1.0): README.md at v0.1.0

Install

Homebrew (macOS Apple Silicon & Linux x86_64)

brew tap alex09x/apps
brew install xref

Cargo (rustc 1.88+)

cargo install --git https://github.com/alex09x/xref --tag v0.1.0 --locked

Prebuilt Binaries

Platform	Archive	SHA-256
Linux x86_64 (glibc >= 2.34)	xref-v0.1.0-x86_64-unknown-linux-gnu.tar.gz	30a6ac3303bfe86e4f23de10b5382bd56fb65df605c3e4cbced495e15e9d77de
macOS Apple Silicon (arm64)	xref-v0.1.0-aarch64-apple-darwin.tar.gz	9652793f0ee814c9dc212c54739b0e1b6bfc1f9ab30ef6c3fe4af65a805858b0

Citation

• Alexander Panasenko (2026). XRef Code — Ultra Blazing Fast x86-64 ELF Cross-References & Pseudo-C Decompiler (v0.1.0). Zenodo. https://doi.org/10.5281/zenodo.23878790 (concept DOI: https://doi.org/10.5281/zenodo.23878789)

Highlights in v0.1.0

• Zero-index .eh_frame discovery & parallel queries (stats, sym, func, refs, istr, imm, disp, callers, calls, args, find, path, tree, asm, error, variant, arm, src, where, files): maps x86-64 ELF images directly in memory, extracts function ranges from .eh_frame unwind records (with heuristic span fallback), and scans functions across CPU cores via rayon without upfront project database files. Recorded single-run wall-clock times from xref 0.0.5 on self-hosted xref.stripped (68aa57b, 1.96 MB, AMD Ryzen 9 9950X, warm page cache) are documented in README.md#recorded-performance.
• Goto-free structured typed pseudo-C (c / decomp, --fields): lifts x86-64 machine code via SSA lifting, dead-code elimination, condition folding, 1-operand widening mul/imul/div/idiv, multi-precision adc/sbb, stripped Rust panic and (ptr, len) &str recognition, and structured if/else/while/do-while/switch regions (0 gotos across the 7 recorded workbench functions).
• Static struct displacement & stride recovery (layout, disp --lea, --stride): aggregates non-stack memory displacements, access widths, read/write/lea counts, SIB array strides, and 1-hop callee pointer forwarding per argument register.
• Backward program slicing, cross-build diffing & modular export (slice, match / diff, diff-c, dump): isolates balanced statements and control guards reaching a target call/address/string, matches shifted functions across stripped builds, diffs normalized pseudo-C, and exports modular .c files grouped by recovered Rust panic source paths.
• Scope & Limitations: x86-64 ELF executables and shared objects only (PE, Mach-O, and AArch64 are out of scope; end-to-end tests in tests/fixture.rs and recorded runs in docs/recorded-data.js at v0.1.0 cover Rust binaries).

Highlights

• 1-Operand Widening ALU, Sign-Extension & Multi-Precision Carry/Borrow (xref c / xref slice / xref dump / xref diff-c):
  • Lifts x86_64 1-operand widening mul / imul (8/16/32/64-bit, collapsing high/low u128 / i128 splits into clean wide shifts/casts when both halves are consumed and preserving upper register bits on 8/16-bit subword writes).
  • Lifts 1-operand div / idiv (8/16/32/64-bit) with zero-extended low halves ((u128)(u64)), SSA-proven cbw / cwd / cdq / cqo sign-extension folding on idiv, and accumulator sign-extension instructions (cbw, cwde, cdqe, cwd, cdq, cqo).
  • Lifts multi-precision adc / sbb across 8/16/32/64-bit operands with width-aware Flags::Add / Flags::Sub carry/borrow propagation, pre-mutation cf_<ip> / lhs_<ip> / rhs_<ip> snapshotting across flag lifetimes, and CF preservation across inc / dec / not / bswap (#26, #27).
• Complete & Balanced Pseudo-C Slicing (xref slice):
  • Retains reaching definitions across loop back-edges and conditional branches, emits inline typed variable declarations (let -> <type> <var> = ...;) when hoisted block declarations are pruned, preserves skip_<hex> flag declarations and writes when referenced by retained structured guards, pins exact instruction-IP --to <hex_ip> statements via /* @xref_slice_target */, and guarantees balanced { / } braces across nested pruned structures (#26, #27).
• Bounded .rodata Previews & Intra-Instruction ABI Register Tracking:
  • Bounds .rodata string previews on unproven-length lea operands instead of concatenating adjacent constants in .rodata pools, slices exact string lengths at (ptr, len) and bcmp call sites, and records intra-instruction read-before-write ABI register uses (lea rsi, [rsi*2 + 1]) (#26, #27).

Highlights

• Readable Typed Pseudo-C (xref c / xref slice / xref dump):
  • Synthesizes readable C function signatures (ret_ty fn_<hex>(ty arg_0, ...)) with immutable parameter names (arg_0..arg_5) and function header docblocks summarizing caller counts, panic source locations, parameter offset/role evidence, and return usage.
  • Performs bidirectional dataflow type propagation across registers, stack slots, and SSA live-range webs (void *, const void *, u8 *, const u8 *, u16 *, const u16 *, u32 *, const u32 *, u64 *, const u64 *, usize, i64, u64, i32, u32, u16, u8, unk64), including element-indexed SIB array syntax (((u64 *)base)[idx + k]).
  • Annotates direct, PLT, and stripped Rust runtime calls (rust_panic_bounds_check, rust_slice_index_fail, rust_capacity_overflow, bcmp, memcpy, etc.) with inline context comments and resolved string/location arguments.
  • Preserves indirect call arguments read in predecessor guards, prevents memory load base/index pointer leakage across integer Add/Sub, avoids double-scaling typed pointer SIB displacements, and retains normal return blocks in xref slice before cold noreturn panic targets.
• Zero-goto Structured Control Flow:
  • Recognizes stripped Rust cold noreturn panic helpers and inlines cold noreturn blocks directly into their guarding if (...) { ... } branches.
  • Structures multi-level forward jumps, rotated loop epilogue/early-return guards, and detached cold continuation blocks via equivalence-preserving region structuring and scoped skip flags (u8 skip_<hex> = 0;, normalized as @skip_N in xref diff-c).
• Self-Hosted Dark Workbench (docs/):
  • Locked dark static workbench (docs/index.html, docs/recorded-data.js) with 114 verbatim CLI runs across 32 scenarios and 7 stripped self-hosted functions (0 goto statements across all 7 workbench functions).

Highlights

• Backward Program Slicing (xref slice <ADDR> --to <TARGET> [--fields]): Extracts a compact backward slice of reaching variable definitions, enclosing control-flow conditions, and early-exit precondition guards leading to a target call, field, or instruction address.
• Cross-Build Pseudo-C Diff (xref diff-c --other <OTHER_BIN> <ADDR...> [--fields]): Matches stripped functions across builds via xref match invariants, normalizes volatile fn_<hex> and L_<hex> addresses to stable positional identifiers (@fn_N, @L_N), and emits a unified diff of pure logic changes.
• Struct & Vec<T> Field Sugar (xref c --fields & Typed C (->) Web Tab): Lifts raw *(T *)(reg + 0x...) pointer arithmetic into readable reg->f_<off>, &reg->sub_<off>, and reg->vec_<off>.{ptr,len,cap} expressions inferred by xref layout.
• Parallel Modular Source-Tree Dump (xref dump --out <DIR> [--src <PATTERN>] [--fields]): Decompiles functions in parallel across CPU cores into a structured module directory tree (<crate>/src/.../*.c) reconstructed from embedded source-path strings.

What's New in v0.0.2

• Signed arithmetic overflow disambiguation (c): distinguishes add_overflow, sub_overflow (including cmp + jo/jno), mul_overflow, and neg_overflow with explicit (i64) casts (#17, #18).
• Explicit range-slice markers (c --from / --to): emits /* ... slice from 0x... */ and /* ... truncated at 0x... (function ends at 0x...) ... */ so partial slices are never mistaken for complete function bodies (#17, #18).
• Callee parameter provenance & active-register discovery (layout): annotates exact target parameter registers for lea field pointers (-> callee(reg)), direct loaded field values (val-> callee(reg)), 1-hop callee field accesses (via callee(reg)), forwarded-base summary, and alternate struct pointer parameter hints (other pointer args: rsi (N fields)) (#17, #18).
• Single-pass web workbench highlighting: fixes HTML token highlighting edge cases and prioritizes source-mapped crate functions in xref web (#16).

First tagged release of xref (v0.0.1) — fast cross-references, struct layout reconstruction, and structured pseudo-C decompilation of x86-64 ELF binaries.

Highlights

• Structured Pseudo-C Decompiler (xref c / decomp):
  • O(B log B) control-flow structuring (if/else, multi-block while & do/while loops with break;/continue;, jump-table switch/case).
  • Interprocedural System V AMD64 live parameter recovery, caller stack arguments (arg7..), (rax, rdx) tuple returns, and indirect register-saved import calls.
  • Automatic stripped Rust runtime helper recognition (rust_unwrap_failed, rust_panic_bounds_check, rust_panic_fmt, rust_once_call, rust_alloc, rust_dealloc, etc.) and exact byte-length slicing of non-NUL &str & core::fmt::Arguments strings.
  • Expression simplification (lea linear combinations, saturating_add, fs:/gs: TLS).
• Struct Layout Reconstruction (xref layout):
  • Recovers field offsets, byte widths, read/write/lea counts, array element strides, and 1-hop sub-struct callees (--reg, --callees).
• Address-of Field Tracking (xref disp --lea):
  • Reports lea reg, [base+disp] field borrows alongside loads/stores and annotates the receiving callee (; -> <callee>).
• Interactive In-Memory Web Workbench (xref web & docs/):
  • Zero-dependency local HTTP workbench (xref -b BIN web --addr 127.0.0.1:7700) serving interactive Pseudo-C, Struct Layout, Annotated ASM, Callers/Callees, and whole-binary search.