Skip to main content

​
Cross-Reference Overview

Cross-references (XREFs) show relationships between code and data, tracking how addresses are accessed throughout a program.
Ghidra’s reference system is powered by multiple analyzers including OperandReferenceAnalyzer and DataOperandReferenceAnalyzer.

​
Types of References

References from instructions to addresses:
  • Call: Function call instructions
  • Jump: Unconditional and conditional jumps
  • Callother: Special processor operations
  • Computed: Indirect or calculated references

​
Viewing References

​
Reference Display in Listing

1

Enable XREF Field

Show references in listing:
  • Edit > Tool Options > Listing Fields
  • Enable XRef field
  • Shows reference indicators
2

Reference Indicators

Visual cues in listing:
  • Arrow icons for references
  • XREF[n] showing reference count
  • Color coding by type

​
XRef Window

1

Open XRef Window

View all references to/from location:
  • Position cursor on address
  • Right-click > References > Show References to...
  • Or press Ctrl + Shift + F
2

Navigate References

Use the XRef panel:
  • Lists all references
  • Click to navigate to source
  • Shows reference type
  • Displays context
3

References From

View outgoing references:
  • Right-click > References > Show References from...
  • Shows what this code references
  • Useful for data flow analysis
Use hover tooltips from ReferenceListingHoverPlugin to quickly preview references without opening the full XRef window.

​
Creating References

​
Manual Reference Creation

1

Position Cursor

Select operand to reference:
  • Click on instruction operand
  • Must be a value that could be an address
2

Add Reference

Create the reference:
  • Right-click > References > Add/Edit References
  • Or press R key
  • Opens reference editor
3

Configure Reference

Set reference properties:
  • Target address
  • Reference type (read, write, call, etc.)
  • Primary/non-primary status
  • Operand index
4

Apply

Commit the reference:
  • Click OK
  • Reference appears in XRef display
  • Target address may be created if needed

​
Removing References

1

Select Reference

Open reference editor on operand:
  • Press R on operand with references
  • Shows existing references
2

Delete Reference

Remove unwanted reference:
  • Select reference in list
  • Click Delete button
  • Confirm removal

​
Reference Analysis

​
Automatic Reference Creation

Analyzers create references automatically:
OperandReferenceAnalyzer creates:
  • Direct address operands
  • Immediate values as addresses
  • PC-relative references
  • Call and jump targets

​
Finding Possible References

1

Run Analysis

Find potential references:
  • Analysis > Auto Analyze
  • Enable Find Possible References
  • Implemented by FindPossibleReferencesPlugin
2

Review Results

Check found references:
  • Shows in results table (FindReferencesTableModel)
  • Lists constants that might be addresses
  • Requires manual verification
3

Apply References

Create verified references:
  • Review each potential reference
  • Add valid references manually
  • Discard false positives
Possible reference analysis finds numeric values that fall within memory ranges, but requires manual verification to avoid false positives.

​
Reference Validation

​
Offcut References

References to middle of instructions/data:
  • Detected by OffcutReferencesValidator
  • May indicate:
    • Obfuscation
    • Incorrect disassembly
    • Data in code section
    • Analysis errors
1

Review Offcut

Examine the reference:
  • Check source instruction
  • Verify target address
  • Determine if intentional
2

Resolve Issue

Fix if incorrect:
  • Re-disassemble with correct mode
  • Delete invalid reference
  • Create reference to correct address

​
Special Reference Types

​
Switch Tables

Switch statement jump tables:
1

Identify Switch

Recognize switch pattern:
  • Computed jump instruction
  • Table of addresses
  • Index calculation
2

Create References

Build switch references:
  • Use AddReferencesInSwitchTable.java
  • Or manually add each case
  • Links switch to case blocks
3

Verify Table

Check completeness:
  • All cases referenced
  • Default case identified
  • Table boundaries correct

​
Indirect References

Computed or register-based references:
  • Function pointer calls
  • Virtual method calls
  • Callback tables
  • Computed jumps
For complex indirect references, use the decompiler to understand the computation, then create references manually.

​
Reference Propagation

​
Constant References

Propagate references through constants:
1

Identify Pattern

Find constant propagation:
  • Value loaded into register
  • Used in later instruction
  • Should create reference
2

Propagate

Apply propagation:
  • Use PropagateConstantReferences.java
  • Or platform-specific versions
  • PropagateX86ConstantReferences.java for x86

​
Reference Navigation Workflows

​
Tracing Data Flow

1

Start at Data

Begin at data of interest:
  • Global variable
  • String constant
  • Configuration data
2

Find Readers

Show references to data:
  • Ctrl + Shift + F for XRefs
  • See all code that accesses
  • Identify read vs write
3

Analyze Usage

Understand data usage:
  • Navigate to each reference
  • Check context in decompiler
  • Document findings

​
Tracing Control Flow

1

Start at Function

Begin at function of interest
2

Find Callers

Show call references:
  • Right-click > References > Show Call Trees to...
  • See all callers
  • Multi-level call hierarchy
3

Find Callees

Show called functions:
  • Right-click > References > Show Call Trees from...
  • Map dependencies
  • Analyze call depth

​
Reference Display Options

​
XRef Field Configuration

1

Access Options

Configure XRef display:
  • Edit > Tool Options > Listing Fields > XRef
2

Set Display

Customize appearance:
  • Show/hide reference count
  • Display reference types
  • Color coding
  • Maximum references shown

​
Reference Hover

Quick reference preview:
  • Hover over reference indicator
  • Shows reference details
  • Click to navigate
  • Implemented by hover plugins

​
Advanced Reference Analysis

Find specific reference patterns:
1

Program Text Search

Search for references:
  • Search > Program Text
  • Can search XRef fields
  • Filter by reference type
2

Memory Search

Search memory for values:
  • Search > Memory
  • Find potential pointers
  • Verify and create references

​
Reference Statistics

Analyze reference patterns:
  • Count references per function
  • Find heavily-referenced data
  • Identify unreferenced code
  • Detect dead code
Use the SelectFunctionsScript.java to select functions based on reference criteria for bulk operations.

​
External Reference Management

​
Associating Symbols

1

Link External

Connect to external symbol:
  • Use AssociateSymbolCmd
  • Links internal reference to external library
  • Enables signature import
2

Resolve Externals

Auto-resolve external symbols:
  • Run ExternalSymbolResolverAnalyzer
  • Matches import names to libraries
  • Creates proper external references

​
External Program References

References across programs:
  • Shared library analysis
  • Multi-binary projects
  • Version comparison
  • Component interaction
Proper external reference setup is crucial for accurate analysis of programs using shared libraries.

Build docs developers (and LLMs) love

Get started for freeTalk to us