{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/docs/usage.md",
    "https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/requirements.txt",
    "https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/ida-plugin.json",
    "https://github.com/mandiant/xrefer/tree/1aeda163ccae9be7b01dd6172513c28878f758b6/test_samples",
    "https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/LICENSE"
  ],
  "category": "native-analysis",
  "description_en": "A Python plugin for IDA Pro from Google's FLARE team that adds a custom navigation interface. XRefer traces execution paths from entry points, groups the binary into clusters of related functions, and surfaces downstream behaviors and artifacts, with path graphs for context. It can ingest external data such as API traces from the VMRay and CAPE sandboxes, capa results and user-defined indirect cross-references. An optional integration sends extracted artifacts to Google's Gemini model to generate natural-language descriptions of code relationships and cluster-based function labels.",
  "description_zh": "Google FLARE 团队为 IDA Pro 开发的 Python 插件，提供自定义导航界面。XRefer 从入口点追踪执行路径，将二进制划分为相关函数的聚类，并呈现下游行为和产物，配以路径图提供上下文。它可以摄入外部数据，如来自 VMRay 和 CAPE 沙箱的 API 跟踪、capa 结果以及用户自定义的间接交叉引用。可选的集成会把提取的产物发送给 Google 的 Gemini 模型，生成代码关系的自然语言描述和基于聚类的函数标签。",
  "entry_url": "https://awesomerea.org/resources/xrefer/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/xrefer/",
  "evidence_url": "https://github.com/mandiant/xrefer/blob/1aeda163ccae9be7b01dd6172513c28878f758b6/README.md",
  "group": "tools",
  "id": "xrefer",
  "json_url": "https://awesomerea.org/resources/xrefer/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/xrefer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/xrefer/index.md",
  "name": "XRefer",
  "name_zh": "XRefer 二进制导航插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "IDA Pro with Python. Install through hcli or copy plugins/ into IDA’s plugins directory, install requirements.txt, and restart IDA. The asciinet dependency needs a JRE on PATH.",
    "Optional enrichment accepts VMRay and CAPE API traces, capa output and user-defined indirect cross-references.",
    "When enabled, optional LLM features send extracted APIs, strings, library references and function relationships to external services such as Google Gemini; all LLM features can be disabled.",
    "The repository includes two AES-encrypted third-party sample archives under test_samples/ without documented passwords or provenance.",
    "License: Apache-2.0 for the plugin."
  ],
  "requirements_zh": [
    "需要带 Python 的 IDA Pro。可通过 hcli 安装，或将 plugins/ 复制到 IDA 插件目录、安装 requirements.txt 并重启 IDA。asciinet 依赖需要 PATH 中有 JRE。",
    "可选增强功能接受 VMRay 和 CAPE 的 API 跟踪、capa 输出及用户定义的间接交叉引用。",
    "启用可选 LLM 功能后，提取的 API、字符串、库引用和函数关系会发送给 Google Gemini 等外部服务；所有 LLM 功能均可关闭。",
    "仓库的 test_samples/ 中有两个 AES 加密的第三方样本压缩包，未记录密码或来源。",
    "许可证：插件使用 Apache-2.0。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/xrefer",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}