Repolode
Submit
mandiant

mandiant/xrefer

An IDA Pro plugin that maps execution paths from entry points, clusters related functions, and uses Gemini to describe binary behavior.

View on GitHub
Stars
325
Forks
44
Open issues
12
Last commit
13 days ago

What is it?

XRefer is a Python plugin for the IDA Pro disassembler that adds a custom navigation interface for reverse engineering. It follows execution paths from entry points, groups the binary into clusters of related functions, and highlights downstream behaviors and artifacts so analysts can get oriented faster.

The plugin can incorporate external data such as API traces from the VMRay and CAPE sandboxes, capa analysis output, and user-defined indirect xrefs, and it presents path graphs for additional context. Clusters can also be given labels for functions. Configuration, default entry point or custom entry point analysis, and exclusion lists are managed from the IDA Edit menu.

LLM features are optional. When enabled, XRefer integrates with Google's Gemini model or other configured endpoints to generate natural language descriptions of code relationships. These features send portions of analyzed data, such as APIs, strings, and function relationships, to external services, so they can be disabled for sensitive samples.

Key features

  • 01Follows execution paths from entry points to map binary behavior.
  • 02Clusters related functions and labels them for faster navigation.
  • 03Ingests VMRay and CAPE API traces, capa output and user-defined xrefs.
  • 04Provides path graphs for additional context.
  • 05Optionally generates natural language descriptions using Gemini or other LLM endpoints.

Use cases

  • Triaging unfamiliar malware samples inside IDA Pro.
  • Analyzing DLLs or libraries by specifying a custom entry point.
  • Correlating sandbox API traces and capa results with static code paths.

Quick start

  1. 1

    Install the plugin and its dependencies with hcli

    hcli install xrefer
  2. 2

    Restart IDA and find XRefer under Edit -> XRefer

Things to know

  • Requires IDA Pro, a commercial disassembler, to run.
  • Needs Java on the PATH because the asciinet dependency requires it.
  • LLM features send analyzed data such as APIs, strings and function relationships to external services like Google Gemini unless disabled.

In collections

Reverse engineering tools

Topics

#reverse-engineering#ida-pro#binary-analysis#malware-analysis#idapython#threat-intelligence#gsoc-2026#idaplugin

FAQ

What is xrefer?
An IDA Pro plugin that maps execution paths from entry points, clusters related functions, and uses Gemini to describe binary behavior. XRefer is a Python plugin for the IDA Pro disassembler that adds a custom navigation interface for reverse engineering. It follows execution paths from entry points, groups the binary into clusters of related functions, and highlights downstream behaviors and artifacts so analysts can get oriented faster.
Is xrefer free to use? What license does it have?
xrefer is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is xrefer still maintained?
Actively maintained. The last commit to xrefer was on Oct 26, 2026.
What can I use xrefer for?
Triaging unfamiliar malware samples inside IDA Pro. Analyzing DLLs or libraries by specifying a custom entry point. Correlating sandbox API traces and capa results with static code paths.
How do I install xrefer?
Install the plugin and its dependencies with hcli: hcli install xrefer Restart IDA and find XRefer under Edit -> XRefer
Where can I get xrefer?
The source code and installation instructions are on GitHub: https://github.com/mandiant/xrefer

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects