Cross-References

Understand and navigate program cross-references in Ghidra

Cross-Reference Overview

Cross-references (XREFs) show relationships between code and data, tracking how addresses are accessed throughout a program.

Ghidra’s reference system is powered by multiple analyzers including OperandReferenceAnalyzer and DataOperandReferenceAnalyzer.

Types of References

Code References

References from instructions to addresses:

• Call: Function call instructions
• Jump: Unconditional and conditional jumps
• Callother: Special processor operations
• Computed: Indirect or calculated references

Data References

References from instructions to data:

• Read: Data is read/loaded
• Write: Data is written/stored
• Read/Write: Data is both read and written
• Param: Data passed as parameter

Stack References

References to stack variables:

• Local variable access
• Parameter access
• Stack pointer relative
• Frame pointer relative

External References

References to external locations:

• Import table entries
• External library functions
• External data symbols
• Resolved by ExternalSymbolResolverAnalyzer

Viewing References

Reference Display in Listing

1. Enable XREF Field

   Show references in listing:

   • Edit > Tool Options > Listing Fields
   • Enable XRef field
   • Shows reference indicators
2. Reference Indicators

   Visual cues in listing:

   • Arrow icons for references
   • XREF[n] showing reference count
   • Color coding by type

XRef Window

1. Open XRef Window

   View all references to/from location:

   • Position cursor on address
   • Right-click > References > Show References to...
   • Or press Ctrl + Shift + F
2. Navigate References

   Use the XRef panel:

   • Lists all references
   • Click to navigate to source
   • Shows reference type
   • Displays context
3. References From

   View outgoing references:

   • Right-click > References > Show References from...
   • Shows what this code references
   • Useful for data flow analysis

Use hover tooltips from ReferenceListingHoverPlugin to quickly preview references without opening the full XRef window.

Creating References

Manual Reference Creation

1. Position Cursor

   Select operand to reference:

   • Click on instruction operand
   • Must be a value that could be an address
2. Add Reference

   Create the reference:

   • Right-click > References > Add/Edit References
   • Or press R key
   • Opens reference editor
3. Configure Reference

   Set reference properties:

   • Target address
   • Reference type (read, write, call, etc.)
   • Primary/non-primary status
   • Operand index
4. Apply

   Commit the reference:

   • Click OK
   • Reference appears in XRef display
   • Target address may be created if needed

Removing References

1. Select Reference

   Open reference editor on operand:

   • Press R on operand with references
   • Shows existing references
2. Delete Reference

   Remove unwanted reference:

   • Select reference in list
   • Click Delete button
   • Confirm removal

Reference Analysis

Automatic Reference Creation

Analyzers create references automatically:

Operand References

OperandReferenceAnalyzer creates:

• Direct address operands
• Immediate values as addresses
• PC-relative references
• Call and jump targets

Data References

DataOperandReferenceAnalyzer creates:

• Pointer data types
• String references
• Data table entries
• Constant pools

Stack References

Stack analysis creates:

• Local variable references
• Parameter references
• Stack pointer operations
• Use MakeStackRefs.java for repair

Finding Possible References

1. Run Analysis

   Find potential references:

   • Analysis > Auto Analyze
   • Enable Find Possible References
   • Implemented by FindPossibleReferencesPlugin
2. Review Results

   Check found references:

   • Shows in results table (FindReferencesTableModel)
   • Lists constants that might be addresses
   • Requires manual verification
3. Apply References

   Create verified references:

   • Review each potential reference
   • Add valid references manually
   • Discard false positives

Possible reference analysis finds numeric values that fall within memory ranges, but requires manual verification to avoid false positives.

Reference Validation

Offcut References

References to middle of instructions/data:

• Detected by OffcutReferencesValidator
• May indicate:
  • Obfuscation
  • Incorrect disassembly
  • Data in code section
  • Analysis errors

1. Review Offcut

   Examine the reference:

   • Check source instruction
   • Verify target address
   • Determine if intentional
2. Resolve Issue

   Fix if incorrect:

   • Re-disassemble with correct mode
   • Delete invalid reference
   • Create reference to correct address

Special Reference Types

Switch Tables

Switch statement jump tables:

1. Identify Switch

   Recognize switch pattern:

   • Computed jump instruction
   • Table of addresses
   • Index calculation
2. Create References

   Build switch references:

   • Use AddReferencesInSwitchTable.java
   • Or manually add each case
   • Links switch to case blocks
3. Verify Table

   Check completeness:

   • All cases referenced
   • Default case identified
   • Table boundaries correct

Indirect References

Computed or register-based references:

• Function pointer calls
• Virtual method calls
• Callback tables
• Computed jumps

For complex indirect references, use the decompiler to understand the computation, then create references manually.

Reference Propagation

Constant References

Propagate references through constants:

1. Identify Pattern

   Find constant propagation:

   • Value loaded into register
   • Used in later instruction
   • Should create reference
2. Propagate

   Apply propagation:

   • Use PropagateConstantReferences.java
   • Or platform-specific versions
   • PropagateX86ConstantReferences.java for x86

Reference Navigation Workflows

Tracing Data Flow

1. Start at Data

   Begin at data of interest:

   • Global variable
   • String constant
   • Configuration data
2. Find Readers

   Show references to data:

   • Ctrl + Shift + F for XRefs
   • See all code that accesses
   • Identify read vs write
3. Analyze Usage

   Understand data usage:

   • Navigate to each reference
   • Check context in decompiler
   • Document findings

Tracing Control Flow

1. Start at Function

   Begin at function of interest

2. Find Callers

   Show call references:

   • Right-click > References > Show Call Trees to...
   • See all callers
   • Multi-level call hierarchy
3. Find Callees

   Show called functions:

   • Right-click > References > Show Call Trees from...
   • Map dependencies
   • Analyze call depth

Reference Display Options

XRef Field Configuration

1. Access Options

   Configure XRef display:

   • Edit > Tool Options > Listing Fields > XRef
2. Set Display

   Customize appearance:

   • Show/hide reference count
   • Display reference types
   • Color coding
   • Maximum references shown

Reference Hover

Quick reference preview:

• Hover over reference indicator
• Shows reference details
• Click to navigate
• Implemented by hover plugins

Advanced Reference Analysis

Reference Search

Find specific reference patterns:

1. Program Text Search

   Search for references:

   • Search > Program Text
   • Can search XRef fields
   • Filter by reference type
2. Memory Search

   Search memory for values:

   • Search > Memory
   • Find potential pointers
   • Verify and create references

Reference Statistics

Analyze reference patterns:

• Count references per function
• Find heavily-referenced data
• Identify unreferenced code
• Detect dead code

Use the SelectFunctionsScript.java to select functions based on reference criteria for bulk operations.

External Reference Management

Associating Symbols

1. Link External

   Connect to external symbol:

   • Use AssociateSymbolCmd
   • Links internal reference to external library
   • Enables signature import
2. Resolve Externals

   Auto-resolve external symbols:

   • Run ExternalSymbolResolverAnalyzer
   • Matches import names to libraries
   • Creates proper external references

External Program References

References across programs:

• Shared library analysis
• Multi-binary projects
• Version comparison
• Component interaction

Proper external reference setup is crucial for accurate analysis of programs using shared libraries.