XRef — Ultra Blazing Fast x86-64 ELF and Mach-O Analysis, Live Linux Process Inspection, Pseudo-C and Local MCP

XRef provides Ultra Blazing Fast cross-references, structure-layout recovery, backward slicing and structured typed pseudo-C for x86-64 ELF and supported thin little-endian x86-64 Mach-O inputs. It is written in Rust. Function-range discovery uses DWARF unwind records with bounded fallback analysis; an FDE interval is evidence for a code range, not proof of a complete source function. Types and layouts are reconstructions rather than recovered source declarations.

Version 0.5.0 adds error-origin tracing. The origin command starts from the text of an error message, finds the enum variant whose Display arm names that text, and lists the stores of that tag (value, width and layout), possible inner-to-outer conversions and calls that pass the tag to a function that stores it, each with the pseudo-C conditions guarding it. A passed tag is followed through callee-saved copies, spills and reloads, stack objects and stack argument slots, a bounded number of calls (--arg-depth, at most 64 functions) and copies of a stack object into its home, and into readers of a record field held in a Vec. The callargs command lists every call passing a given constant in an argument register or stack slot. Reported sites are ranked candidates with their evidence; origin does not prove that a site executes.

The deps command reads build provenance embedded in a binary: the dependency manifest written by cargo-auditable into Rust binaries (root package, runtime and build dependencies), the Go module list in .go.buildinfo including replacements, .comment toolchain strings and the GNU Build-ID or Mach-O LC_UUID. It also works on binaries without unwind tables, such as static Go executables, and bounds decompression. It reports only what the binary embeds: a Rust binary built without cargo-auditable has no manifest, crates are not guessed from strings, and versions are the recorded strings, not checked against a registry or an advisory database. The data command reads typed integer, floating-point, byte or string values at a virtual address and marks zero-initialised values.

The versioned JSON query interface and local stdio MCP server add a first-contact triage in info, a confidence tier (observed, derived or inferred), a deterministic evidence_id and an untrusted_binary_content marker on every answer, new operations (dependencies, card, find, layout, files, where, and origin, callargs and data as paged text reports) and a compact MCP mode. Pseudo-C now types scalar SSE/AVX f32 and f64 parameters, returns and call results; an indirect call through one of several constant vtables lists each possible target with the branch condition that selects it; and refs follows references through Rust format templates and RELR relocations. Critical reconstructed expressions should still be checked against machine instructions and the reported evidence.

Linux x86-64 live process inspection and the offline profile and trace features of earlier versions remain available. Observation requires the documented Linux permissions; probe, watch and trace need privileged perf or tracefs access, instrumentation can perturb the target, and lost events, attachment gaps and observation budgets remain explicit. Static Mach-O support does not imply macOS live support. The Apple Silicon executable is a host build, not an ARM64 input backend; ARM64, PE, universal/fat and compact-unwind-only inputs remain outside the declared supported scope. Historical README timing tables are explicitly attributed to xref 0.0.5 and its recorded x86-64 ELF workload; they are not measurements of version 0.5.0. The repository's command reference, home-page recordings and live walkthrough were recorded with a remapped release build of pre-tag commit b00d4a1, as their provenance text states.

This Software record archives annotated tag v0.5.0 (tag object 758b5a7110fc3c7a4af351a3b1926be8b5f9f466), application commit 27f4fcfc826f173256ee94b523c91f38c019ae2c, tree 675f28e617c93ba1fc2d0ae8ea695f8ef57dfcce. The archive was assembled from verified tagged file bytes with exact Git file modes and checked against all 642 expected Git blobs. The public release manifest identifies the same application and workflow revision. Repository: https://github.com/alex09x/xref . Website: https://xrefcode.com . Release: https://github.com/alex09x/xref/releases/tag/v0.5.0 . License: MIT OR Apache-2.0, at the recipient's option. The existing software family is retained, Concept DOI 10.5281/zenodo.23878789; earlier version records and source tags are unchanged.