XRef v0.4.0 — Ultra Blazing Fast Reverse Engineering

XRef v0.4.0

Serialized field search with ranked writers, ordered live call traces, live
and offline CPU profiles, and many analysis improvements driven by a field
report on a large stripped Rust binary.

Serialized field search (xref field)

Find the struct behind a set of serialized keys in a stripped executable and
rank the code that writes it:

xref -b ./app field --keys c,m,e --write --writes-all-of m,e
xref -b ./app field --keys c,m,e --write --writes-all-of m,e --writer-root returned

• Connects literal key strings and lengths to input-relative field offsets,
  with instruction witnesses for every offset.
• Writer candidates are ranked by fields written together, call-graph
  distance from the serializer, store precision against observed field
  widths, immediate stores and compare-then-write updates. Whole-struct
  copies and pointer slots get no precision credit.
• --writer-root returned|argument|loaded keeps only writers relative to a
  pointer returned by a call (for example a map lookup), an argument, or a
  loaded pointer.
• The whole-image index of references, direct calls and writer facts is
  cached under $XDG_CACHE_HOME/xref/field-index-v1 and reused across key
  sets and filters. The scan covers up to 262,144 functions and 128 MiB of
  code within edge and 30-second time budgets; when a limit is hit, coverage
  reports it and the incomplete index is not stored.
• Repeated identical queries replay the stored report; on Unix a background
  field daemon keeps the image and session state in memory and answers
  later queries for the same binary without reloading it. The MCP server exposes a field operation that keeps the
  session state in memory and warms it at start-up.

See docs/field-search.md and
docs/serde-fields.md.

Live analysis (Linux x86-64)

• xref live trace: ordered, thread-scoped call trace windows through
  tracefs uprobes. Windows open at --start (optionally gated by
  --start-filter), close at --stop/--stop-return, expand static callees
  with --callees-of, and stop at explicit window, event and time limits.
• xref live profile: bounded CPU sampling of one process into an
  .xprof recording, with a system-wide trigger that also observes
  short-lived threads.
• xref live probe: per-hit --json-lines on both backends,
  time-aligned --mark-file annotations, and argument filters checked
  ahead of attach.

Offline profiles and traces

• xref profile report|annotate|diff|import: summarize, annotate and compare
  recordings; import perf.data (including grouped reads, compressed records,
  AUX data and bounded Intel PT decoding) or perf script text natively.
• xref symbolize and xref edges: map saved addresses, callchains or folded
  stacks onto the selected executable and import observed call adjacency as
  opt-in graph evidence.

Static analysis

• xref card: function summary card with inputs, return registers, field
  stores, calls with arguments and error paths.
• xref args --filter: resolve dynamic arguments and preflight probe filters
  against call sites.
• xref c --only-paths-to ADDR and xref slice --to-field: pseudo-C limited
  to blocks that reach an address, and slices focused on one struct field.
• xref find --insn instruction predicates and cross-build ambiguity reports.
• Pseudo-C lifts scalar SSE2 double operations and constants, and computes
  SUB/SBB flags from the pre-write value of a stack-slot destination.

Compatibility

xref live remains Linux x86-64 only; trace, probe and profile need
privileged perf or tracefs access. All results state their coverage: counts
are lower bounds when events drop, and ranked writers are candidates, not
proof of a source type.