# XRefer

> A Python plugin for IDA Pro from Google's FLARE team that adds a custom navigation interface. XRefer traces execution paths from entry points, groups the binary into clusters of related functions, and surfaces downstream behaviors and artifacts, with path graphs for context. It can ingest external data such as API traces from the VMRay and CAPE sandboxes, capa results and user-defined indirect cross-references. An optional integration sends extracted artifacts to Google's Gemini model to generate natural-language descriptions of code relationships and cluster-based function labels.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/mandiant/xrefer>
- Primary source: <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/README.md>
- Catalog page: <https://awesomerea.org/resources/xrefer/>
- Record JSON: <https://awesomerea.org/resources/xrefer/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/xrefer/index.md)

## Requirements & limits

- IDA Pro with Python. Install through hcli or copy plugins/ into IDA’s plugins directory, install requirements.txt, and restart IDA. The asciinet dependency needs a JRE on PATH.
- Optional enrichment accepts VMRay and CAPE API traces, capa output and user-defined indirect cross-references.
- When enabled, optional LLM features send extracted APIs, strings, library references and function relationships to external services such as Google Gemini; all LLM features can be disabled.
- The repository includes two AES-encrypted third-party sample archives under test_samples/ without documented passwords or provenance.
- License: Apache-2.0 for the plugin.

## Primary sources

1. <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/README.md>
2. <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/docs/usage.md>
3. <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/requirements.txt>
4. <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/ida-plugin.json>
5. <https://github.com/mandiant/xrefer/tree/1aeda163ccae9be7b01dd6172513c28878f758b6/test_samples>
6. <https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/LICENSE>

## More in Native binaries

- [dsdump (paradiseduo wrapper)](https://awesomerea.org/resources/paradiseduo-dsdump/index.md) · Tool
- [Dr. Memory](https://awesomerea.org/resources/dr-memory/index.md) · Tool
- [Intel XED](https://awesomerea.org/resources/intel-xed/index.md) · Tool
- [Keystone](https://awesomerea.org/resources/keystone/index.md) · Tool
- [Microsoft Detours](https://awesomerea.org/resources/microsoft-detours/index.md) · Tool
- [PANDA](https://awesomerea.org/resources/panda/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.