XRef v0.5.0 — Ultra Blazing Fast Reverse Engineering

XRef v0.5.0

Trace an error message back to the code that builds it, read the dependency
manifests embedded in Rust and Go binaries, and give agents a triaged,
evidence-tagged MCP interface.

Error origins (xref origin) and constant arguments (xref callargs)

Start from the text of an error and find the checks that produce it:

xref -b ./app origin "number out of range"
xref -b ./app callargs 0x2c --arg rdx

• origin finds the enum variant whose Display arm names the text, then
  lists the stores of that tag (value, width and layout), possible
  inner-to-outer conversions, and calls that pass the tag as an argument to a
  function that stores it, each with the pseudo-C conditions guarding it.
• A passed tag is followed through callee-saved copies, spills and reloads
  (off rsp, rbp or any frame pointer), stack objects, stack argument
  slots (stack0..stack7), several calls (--arg-depth), and copies of a
  stack object into its real home (memcpy, rep movs).
• When the tag lands in an element of a Vec of records, origin lists the
  readers of that field binary-wide: elements reached by a scaled index or a
  stepped pointer, records copied onto the reader's stack first, loops that
  consume the records by value (memcpy through a register, partial copies,
  copies of copies), and callees handed the record or its payload. A 16- or
  32-byte vector load that only moves the field is listed as such.
• callargs N lists every call passing the constant N in an argument
  register or stack slot, grouped by callee, with the other constants each
  call passes.
• Sites are candidates with their evidence; origin does not prove that a
  site executes.

See docs/cli/origin.md and
docs/cli/callargs.md.

Build provenance (xref deps) and typed data (xref data)

xref -b ./uv deps --filter tokio
xref -b ./gh deps
xref -b ./app data 0x492c0b --as str

• deps reads the dependency manifest cargo-auditable embeds in Rust
  binaries (.dep-v0: root package, runtime and build dependencies) and the
  Go module list (.go.buildinfo, inline and pointer forms, with
  replacements), plus the .comment toolchain strings and the GNU Build-ID
  (Mach-O LC_UUID). It works on binaries without unwind tables, such as
  static Go executables. The zlib stream is bounded to 16 MiB decompressed
  from 4 MiB.
• data reads u8..u64, i8..i64, f32, f64, bytes or a string at
  a virtual address, marks zero-initialised (bss) values and names the
  nearest segment for an address outside the binary.

See docs/cli/deps.md and
docs/cli/data.md.

Structured queries and MCP

• info carries a first-contact triage: language, stripped or not, panic
  locations and source files, Build-ID, toolchains, embedded dependencies,
  packer entropy and ready-to-run recommended_queries.
• Every answer carries a confidence tier (observed, derived,
  inferred), a deterministic evidence_id, and
  untrusted_binary_content: true.
• New operations: dependencies, card, find (bounded predicates; imm
  and disp as numbers or 0x strings), layout, files, where, and
  origin, callargs and data as paged text reports.
• xref mcp --compact (or XREF_MCP_COMPACT=true) leaves outputSchema
  out of tools/list and puts a one-line summary in the text channel.
• A sequential client no longer gets a spurious busy: a worker frees its
  request slot before writing the answer.

See docs/mcp.md.

Pseudo-C, calls and references

• Pseudo-C types scalar SSE/AVX floating point: f32/f64 parameters,
  returns (including a float parameter returned unchanged) and call results,
  and VEX-encoded scalar instructions.
• An indirect call through one of several constant vtables (Rust trait
  objects in position-independent binaries) lists each possible target in
  c and calls with the branch condition that selects it; table dumps
  such records with their relocated pointers.
• refs follows references through Rust format templates and RELR
  relocations, without false positives on plain strings.
• field prints every writer score term and the lead over the next
  candidate.

Compatibility

Inputs remain x86-64 ELF and thin x86-64 Mach-O; xref live remains Linux
x86-64 only. The command reference, home-page recordings and live walkthrough
were recorded with this release's code (the remapped release build of commit
b00d4a1, before the tag).