# Pathfinder
The **Pathfinder** window finds call paths between functions by searching the cross-reference graph, and visualizes the results as an expanded cross-references tree or as an [Xref Graph](/9.4/core/disassembler/concepts/xref-graph.md).
The Pathfinder helps you find answers to questions like: which call chains connect function A to function B? Can input handled here ever reach this API? Is there any route at all?
## Opening the widget
| Action | Default shortcut |
| ------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| Open the Pathfinder ([`OpenPathfinder`](/9.4/ida-actions/openpathfinder.md)) | Shift+F9 |
| Add current function as a waypoint ([`MarkPathfinderEA`](/9.4/ida-actions/markpathfinderea.md)\`) | Ctrl+Shift+F9 |
The widget can also be opened from **View → Open subviews → Pathfinder**, from the toolbar, or via the quick view (Ctrl+1) menu. Ctrl+Shift+F9 works from Disassembly and Pseudocode views; if no Pathfinder is open, it opens one and adds the waypoint in one step.
## Waypoints
Pathfinder operates on an **ordered list of waypoints**. As soon as the list contains two or more entries, the search runs automatically and re-runs whenever the list or the options change.
* Waypoints are **functions**. Adding an address anywhere inside a function adds that function (its start address). Duplicates are rejected.
* **+ Add Waypoint** opens the function chooser.
* Ctrl+Shift+F9 adds the function under the cursor from a Disassembly or Pseudocode view.
* Reorder waypoints by dragging rows. Paths are searched segment by segment, visiting waypoints in list order.
* To remove a waypoint, click its **✕** button or drag the row out of the list.
Between each consecutive pair of waypoints, the list shows the segment result:
```
↓ N nodes, shortest path: M
```
where `N` is the number of distinct functions participating in any path for that segment and M is the length of the shortest one.
## Excluding functions
The Excluded list bans functions from all paths. It's useful to stop the search from routing through ubiquitous helpers (logging, wrappers) that connect everything to everything.
* Drag a waypoint row down into the Excluded list to exclude it.
* Drag an excluded row back into the waypoint list to re-include it.
* Drag an excluded row outside the widget to delete it.
## Options
| Option | Effect |
| ---------------------- | -------------------------------------------------------------------------- |
| **Include data xrefs** | Follow data references in addition to code (call) references. |
| **Shortest path only** | Restrict the result to the shortest path per segment instead of all paths. |
| **Max depth** | Bound the search depth (slider/spin; leftmost = "inf", unlimited). |
The status line summarizes the overall result:
* `Found N unique nodes across M segment(s)` — paths exist for every segment;
* `Warning: X of Y segment(s) have no path` — at least one segment is unreachable;
* `No path found` — no segment has a path.
## Visualizing results
* **Tree (First → Last)** — Opens the [Cross References Tree](/9.4/core/user-interface/concepts/subviews.md#cross-references-tree-window) rooted at the first waypoint, pre-expanded along every discovered path (xrefs *from* direction).
* **Tree (Last ← First)** — The same view from the last waypoint backwards (xrefs *to* direction).
* **Graph** — creates the [Xref Graph](/9.4/core/disassembler/concepts/xref-graph.md#finding-call-paths) containing the found paths. The path spine and the waypoint nodes use dedicated theme colors so the route stands out.
For large results (more than 256 nodes) IDA asks for confirmation before expanding the tree, since the operation may take several seconds; the expansion is cancellable. The confirmation can be suppressed for the rest of the session.
Graphs created by Pathfinder are regular Xref Graphs: they are saved with the database and appear in the [Xref Graph manager](/9.4/core/disassembler/concepts/xref-graph.md#xref-graph-manager).
## Persistence
Pathfinder state is saved in the desktop:
* Waypoints and excludes are saved per database.
* Options (checkboxes, max depth) are saved regardless of the active database.
Reopening the database restores the widget with its waypoint list, and the search re-runs automatically.
## Limitations
* Path search works at function granularity over the cross-reference graph: it answers "which functions reference which", not instruction-level or data-flow reachability.
* With **Max depth** set, paths longer than the bound are not found even if they exist; the segment may report "no path".
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.hex-rays.com/9.4/core/disassembler/concepts/pathfinder.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.