XRef Code (xref) recovers function ranges from .eh_frame unwind tables (with span fallback) and runs whole-binary scans across CPU cores via rayon in memory — no multi-minute database import, no stale cache, and millisecond xrefs, layout recovery, backward slices, and typed pseudo-C on stripped Rust release binaries (shown below analyzing stripped xref itself, with 0 gotos across all 7 recorded functions).
brew tap alex09x/apps brew install xref && xref --version
cargo install --git https://github.com/alex09x/xref --tag v0.1.0 --locked xref -b /path/to/binary.elf stats
curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.1.0/xref-v0.1.0-x86_64-unknown-linux-gnu.tar.gz curl -fsSLO https://github.com/alex09x/xref/releases/download/v0.1.0/xref-v0.1.0-x86_64-unknown-linux-gnu.tar.gz.sha256 sha256sum -c xref-v0.1.0-x86_64-unknown-linux-gnu.tar.gz.sha256 && tar -xzf xref-v0.1.0-x86_64-unknown-linux-gnu.tar.gz
Loading recorded scenarios…
Loading recorded functions…
| Operation | Command | ELF Load | Total Time |
|---|---|---|---|
| Binary inventory (1,974 functions, 588 panic locations) | xref -b xref.stripped stats | 0.84 ms | 2.2 ms |
| Whole-binary string & pointer cross-reference scan | xref -b xref.stripped refs "goto L_" | 0.80 ms | 3.9 ms |
| Rust module mapping from embedded panic locations | xref -b xref.stripped where src/loops.rs | 0.79 ms | 3.4 ms |
| Interprocedural struct layout recovery (1-hop callees) | xref -b xref.stripped layout 0xa2270 --reg rsi --callees | 0.81 ms | 2.6 ms |
| Backward program slice + field offset hints (38 / 131 lines) | xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields | 0.81 ms | 5.1 ms |
| Cross-build function matching & normalized pseudo-C diff | xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xc7d60 | 0.86 ms | 13.4 ms |
xref 0.0.5 on AMD Ryzen 9 9950X (16 cores / 32 threads, Linux 6.8 x86_64) against two stripped target ELF builds compiled with rustc 1.99.1 (58cf8f9c3 2026-10-13) on x86_64-unknown-linux-gnu via strip --strip-all: primary target xref.stripped from commit 68aa57b (1,962,608 B, sha256:3f3ba3b311f3eca8e26a929285d4fc9ffef4e4b6e8fc015105766180a2a6869d) and comparison target xref-v0.0.2.stripped from tag v0.0.2 / commit e6037d0 (1,899,096 B, sha256:151d7fa78ad7f479ffee73e104230753f929ed9925a6cfd52fefe95e11e467d0). Timings are single-process CLI wall times printed to stderr on warm OS page cache, not browser-side timings.Recovers immutable arg_* signatures, live-range webs (ptr_*, v_*, slot_*), 1-operand widening mul/div (u128/i128), multi-precision adc/sbb carry chains, and optional f_* offset hints.
Recognizes stripped rust_panic_bounds_check, rust_slice_index_fail, and rust_capacity_overflow helpers, bounds unproven .rodata previews, and slices exact &str / core::panic::Location descriptors.
Aggregates memory displacements, access widths, read/write/lea counts, SIB array strides, and 1-hop forwarded callee parameter offsets per pointer argument register.
Intersects callees, referenced strings, immediate constants, struct displacements, Rust source paths, and byte size bounds in one parallel pass across all functions.
Matches stripped functions across compiler builds via structural invariants and diffs normalized pseudo-C with shifted addresses, labels, and skip flags abstracted away.
xref slice isolates balanced statements and guards reaching an exact instruction IP, call, or panic site; xref dump groups stripped functions by panic source paths into modular .c files.
xref -b xref.stripped stats # functions, code bytes, pointers, imports, panic locations xref -b xref.stripped refs "goto L_" # code & data slots referencing text or address (--inline) xref -b xref.stripped disp 0x18 --lea --in 0x65e30 # struct field loads/stores/leas + receiving callee (--all, --stride) xref -b xref.stripped layout 0xa2270 --reg rsi --callees # aggregate struct offsets, widths, strides & 1-hop callees xref -b xref.stripped imm 59 --cmp --in 0xc7d60 # immediate constants (--store, --cmp, --in FN) xref -b xref.stripped find --src src/loops.rs --calls 0x160bb0 # multi-predicate function search in one parallel pass xref -b xref.stripped where src/image.rs --line 46 # map Rust source file & line to stripped function ranges xref -b xref.stripped args 0xa2270 # constant & symbolic arguments across all call sites xref -b xref.stripped path 0xc7fc0 0x160bb0 # shortest call chains between two functions xref -b xref.stripped tree 0xd0aa0 --callers --depth 2 # indented caller/callee tree with panic locations xref -b xref.stripped variant 0xc7fc0 2 # jump-table arms & string literals for enum discriminant xref -b xref.stripped match --other xref-v0.0.2.stripped 0xc7d60 --top 2 # relocate shifted functions across two stripped builds xref -b xref.stripped diff-c --other xref-v0.0.2.stripped 0xd57c0 # cross-build normalized pseudo-C diff xref -b xref.stripped c 0xc7d60 --fields # structured pseudo-C with heuristic offset hints xref -b xref.stripped slice 0xc7d60 --to fn_160bb0 --fields # backward program slice to target call, IP, or string xref -b xref.stripped dump --out out-loops --src src/loops.rs # parallel modular pseudo-C export by source file
XRef Code is authored by Alexander Panasenko. For academic, security, or archival reference, cite the published v0.1.0 release via its versioned Zenodo DOI (or use the concept DOI to reference all versions):
@software{panasenko_2026_23878790,
author = {Panasenko, Alexander},
title = {XRef Code — Ultra Blazing Fast x86-64 ELF Cross-References \& Pseudo-C Decompiler},
month = nov,
year = 2026,
publisher = {Zenodo},
version = {0.1.0},
doi = {10.5281/zenodo.23878790},
url = {https://doi.org/10.5281/zenodo.23878790}
}
Alexander Panasenko (2026). XRef Code — Ultra Blazing Fast x86-64 ELF Cross-References & Pseudo-C Decompiler (v0.1.0). Zenodo. https://doi.org/10.5281/zenodo.23878790 (concept DOI: 10.5281/zenodo.23878789).