3

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "XREF" is repeatedly called from various addresses in the file:

enter image description here

What does it mean? I've looked up "xref" all over the web and have been unable to find any definitive answer.

4

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.

XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a CALLs to specific addresses.

As can be seen in your screenshot, radare2 mentions that a specific address is referenced from ("XREF from") several different locations (addresses) in the code. Using radare's ax? subcommands you can easily view XREFS. For example, axt 0xfa1afe1 will show you Xrefs to 0xfa1afe1 and axf 0xfa1afe1 will show you Xrefs from 0xfa1afe1.

| improve this answer | |
2

It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.