xref-code 0.3.0

Ultra blazing fast cross-references, layout recovery, slicing & pseudo-C for x86-64 ELF and Mach-O binaries, plus live Linux process inspection
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

/*
 * XRef Code — evidence-producing binary analysis
 * Copyright (c) 2026 Alexander Panasenko
 * Contact: alex@prod.codes
 * Author: https://prod.codes/about/
 * Project: https://github.com/alex09x/xref
 * SPDX-License-Identifier: MIT OR Apache-2.0
 */
use super::super::types::{ApiError, Data, FunctionInfo, Pagination};
use schemars::JsonSchema;
use serde::{Deserialize, Serialize};

#[derive(Clone, Debug, Deserialize, JsonSchema)]
#[serde(deny_unknown_fields)]
pub struct Request {
    pub seed: Seed,
    #[serde(default)]
    pub direction: Direction,
    /// Optional callee FDE address: retain every matching callsite, not just the first.
    pub callee: Option<String>,
    pub selection: Option<Selection>,
    #[serde(default)]
    pub limits: Limits,
}
#[derive(Clone, Debug, Deserialize, JsonSchema)]
#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
pub enum Seed {
    Text { text: String },
    Function { address: String },
}
#[derive(Clone, Copy, Debug, Default, Deserialize, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum Direction {
    #[default]
    Callees,
    Callers,
    Both,
}
#[derive(Clone, Debug, Deserialize, Serialize, JsonSchema)]
#[serde(deny_unknown_fields)]
pub struct Selection {
    pub image_sha256: String,
    pub function: String,
    pub call_site: String,
}
#[derive(Clone, Debug, Deserialize, JsonSchema)]
#[serde(default, deny_unknown_fields)]
pub struct Limits {
    pub depth: usize,
    pub functions: usize,
    pub steps: usize,
    pub rows: usize,
    pub contexts: usize,
    pub output_bytes: usize,
    pub slice_bytes: usize,
}
impl Default for Limits {
    fn default() -> Self {
        Self { depth: 1, functions: 8, steps: 24, rows: 10, contexts: 4, output_bytes: 32768, slice_bytes: 4096 }
    }
}
impl Limits {
    pub(super) fn validate(&self) -> Result<(), ApiError> {
        if self.depth > 3
            || !(1..=16).contains(&self.functions)
            || !(1..=32).contains(&self.steps)
            || !(1..=20).contains(&self.rows)
            || self.contexts > 8
            || !(4096..=48000).contains(&self.output_bytes)
            || !(4..=8192).contains(&self.slice_bytes)
        {
            return Err(ApiError::new(
                "invalid_limits",
                "depth 0..3; functions 1..16; steps 1..32; rows 1..20; contexts 0..8; output_bytes 4096..48000; slice_bytes 4..8192",
            ));
        }
        Ok(())
    }
}
#[derive(Debug, Serialize, JsonSchema)]
pub struct Investigation {
    pub scope: &'static str,
    pub evidence: Vec<Step>,
    pub string_matches: Vec<StringMatch>,
    pub ambiguities: Vec<&'static str>,
    pub functions: Vec<FunctionCandidate>,
    pub call_sites: Vec<Candidate>,
    pub selected: Option<Selection>,
    pub stops: Vec<&'static str>,
}
#[derive(Debug, Serialize, JsonSchema)]
pub struct Step {
    pub id: usize,
    pub parent: Option<usize>,
    pub operation: &'static str,
    pub address: Option<String>,
    pub target: Option<String>,
    pub data: Option<Box<Data>>,
    pub error: Option<ApiError>,
    pub warnings: Vec<&'static str>,
    pub page: Option<Pagination>,
}
#[derive(Debug, Serialize, JsonSchema)]
pub struct FunctionCandidate {
    pub function: FunctionInfo,
    pub evidence_step: usize,
    pub depth: usize,
}
#[derive(Debug, Serialize, JsonSchema)]
pub struct Candidate {
    pub selection: Selection,
    pub target: Option<String>,
    pub evidence_step: usize,
    pub context_step: Option<usize>,
}

#[derive(Debug, Serialize, JsonSchema)]
pub struct StringMatch {
    pub start: String,
    pub end_exclusive: String,
    pub evidence_step: usize,
}