Skip to content

XRef Code v0.2.0 — Ultra Blazing Fast x86-64 ELF & Mach-O Analysis

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 01:39
· 57 commits to main since this release
v0.2.0
02ad5da

XRef Code v0.2.0

Ultra Blazing Fast native binary analysis, now with versioned JSON, local
MCP, bounded evidence trails and supported thin x86-64 Mach-O inputs.

Native analysis for agents

  • xref -b BIN query '<JSON>' and xref -b BIN mcp share the native analysis
    engine. Responses carry schema version 1, exact image SHA-256, static VAs,
    warnings, limits and pagination. MCP runs locally over stdio for one immutable
    image, with cancellation and bounded concurrent requests.
  • The JSON operation investigate connects string hits, references, functions, calls and a selected
    slice. Alternative functions and call sites remain explicit; a selection is
    bound to the image identity. Unknown indirect flow is not treated as absence.
  • The JSON operations call_context, callers and field_origin expose instruction provenance,
    direct-CFG argument/guard evidence, memory access modes and bounded one-hop
    callee evidence. A field address and a loaded value remain different origins.
    CFG uncertainty, untracked origins and traversal limits are reported.

More input and output choices

  • Thin little-endian x86-64 Mach-O executables, dylibs and bundles with usable
    DWARF __eh_frame feed the same CLI, JSON and MCP operations. Entry offsets
    become static VAs relative to __TEXT.vmaddr; supported legacy/chained dyld
    linkage and exports are decoded without guessing encoded pointers.
  • Mixed-CFI gaps and unsupported fixup metadata remain explicit. Partial caller
    sets cannot erase or narrow possible Mach-O RAX/RDX returns.
  • disp --stack includes raw frame displacements and offsets from explicit
    address-taken stack anchors, normalized across proven stack-pointer changes.
  • c --goto, slice --goto and dump --goto preserve residual transitions for
    experts inspecting large functions. Structured output remains the default.

Install

cargo install xref-code --version 0.2.0 --locked
# or use prebuilt release archives / cargo-binstall:
cargo binstall xref-code --version 0.2.0 -y
# Homebrew users with an existing installation:
brew update && brew upgrade alex09x/apps/xref

Release archives support Linux x86-64 (glibc >= 2.34) and macOS Apple Silicon.
The macOS ARM64 host binary analyzes x86-64 inputs; this is not an ARM64 input
backend. ARM64 inputs, PE, fat/universal, encrypted, relocatable and
compact-unwind-only Mach-O remain unsupported. Inspected binaries are never
executed. Pseudo-C, types and layouts remain static reconstructions; use raw
ASM and provenance for critical conclusions.

Documentation and provenance

The website and all nine README translations cover the new release. Guides:
JSON/MCP,
investigations,
field origins,
expert flags,
and Mach-O.

Historical single-run benchmark numbers remain attributed to xref 0.0.5 and
its documented input/hardware. They are not new v0.2.0 measurements. Zenodo archive:
Version DOI 10.5281/zenodo.23902824
(Zenodo record 23902824), Concept DOI
10.5281/zenodo.23878789 (prior v0.1.0
snapshot: 10.5281/zenodo.23878790).

Assets 7
Loading