Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "XREF" is repeatedly called from various addresses in the file:
What does it mean? I've looked up "xref" all over the web and have been unable to find any definitive answer.
Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.
XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a CALLs to specific addresses.
As can be seen in your screenshot, radare2 mentions that a specific address is referenced from ("XREF from") several different locations (addresses) in the code. Using radare's ax? subcommands you can easily view XREFS. For example, axt 0xfa1afe1 will show you Xrefs to 0xfa1afe1 and axf 0xfa1afe1 will show you Xrefs from 0xfa1afe1.
It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.
