Skip to content

XRef v0.3.0 — Ultra Blazing Fast Reverse Engineering

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 21:36
· 266 commits to main since this release
v0.3.0
6388c5e

XRef v0.3.0

Ultra Blazing Fast native binary analysis, now with Live Linux Process
Inspection (L1–L4), opt-in MCP live tooling, and public product branding as
XRef.

Live Linux Process Inspection (Linux x86-64)

XRef v0.3.0 introduces native live process inspection for running Linux x86-64
targets, connecting runtime process state directly with static image analysis:

  • L1 Maps, Resolve & Memory Scanner:
    • xref live maps --pid PID (xref -b APP live maps --pid PID):
      Inspect /proc/<pid>/maps layout, determine verified executable match, PIE slide,
      heap, thread stacks, VDSO/VVAR, and mapped shared libraries.
    • xref live resolve --pid PID <LIVE_VA>:
      Translate runtime addresses to static image VA, containing function, and file
      offset (for the selected main executable). Addresses inside shared libraries
      are identified as outside the target executable.
    • xref live memscan --pid PID <U64_HEX_PATTERN>:
      Scan readable, writable private process memory (rw-p) for little-endian
      u64 values and classify neighbouring pointers (pointers to code, heap,
      stack, or null).
  • L2 Execution Probes (xref live probe --pid PID <FN_OR_VA> [--callers] [--regs]):
    Attach bounded uprobes via Linux perf events (default) or explicitly via --backend tracefs
    (both require CAP_PERFMON or root; no silent fallback) to target functions or VAs.
    Reports hit counts, one-hop caller return-address evidence, and sampled general-purpose
    registers (rip, rsp, rbp, rax, rdi, rsi, rdx, rcx, r8, r9) with explicit
    coverage caveats. Does not pause or attach via ptrace for breakpoints.
  • L3 Hardware Watchpoints (xref live watch --pid PID [<ADDR>] [--follow ptr_slot=<ADDR>,offset=<BYTES>]):
    Monitor memory writes using x86-64 hardware debug registers (DR0–DR3).
    Reports candidate writer instructions within the target executable with confidence
    classification (e.g. candidate_linear_predecessor_store), candidate store operand value, and distinct
    initial and latest process-memory snapshots (explicitly not proven store-time values).
    With --follow ptr_slot=<ADDR>[,offset=<BYTES>], tracks buffer pointer indirection
    across reallocations without requiring a fixed static address.
  • L4 Opt-in MCP Live Tooling (xref -b APP mcp --allow-live-pid PID):
    Exposes the xref_live tool over local stdio MCP only when explicitly pinned
    to a verified PID via --allow-live-pid. Standard xref -b APP mcp remains
    strictly read-only (xref_query only).
  • Interactive Walkthrough:
    Step-by-step recorded walkthrough on a stripped Linux fixture published at
    https://xrefcode.com/live-walkthrough.

Public Product Branding

  • The public product brand is streamlined to XRef (previously XRef Code).
  • The signature tagline Ultra Blazing Fast is preserved across all headers,
    documentation, and web surfaces.
  • All technical identifiers remain stable: binary name xref, Rust crate
    xref-code, repository alex09x/xref, and website xrefcode.com.

Install

cargo install xref-code --version 0.3.0 --locked
# or use prebuilt release archives / cargo-binstall:
cargo binstall xref-code --version 0.3.0 -y
# Homebrew users with an existing installation:
brew update && brew upgrade alex09x/apps/xref

Release archives support Linux x86-64 (glibc >= 2.34) and macOS Apple Silicon.
Live process inspection is supported on Linux x86-64 kernels with /proc read
access (for L1) and privileged perf access (root or CAP_PERFMON for L2/L3 probes
and watchpoints). Inspected processes continue normal execution.

Documentation and Provenance

Assets 8
Loading