# Xref Graph

{% hint style="info" %}
Starting with IDA 9.2, the external *qwingraph* used to make graphs has been replaced with a native and interactive graphing tool, **Xref Graph**.
{% endhint %}

The integrated **Xref Graph** visualizes cross-reference relationships between code and data elements in a binary through an interactive interface. Xref Graph is available right out of the box via **View → Graphs → Xrefs to|from** and **View → Graphs → Manage...**.

## Core Features

* Interactive graph visualization of cross-references
* Multiple node types (code, data, imports) with distinct visual styling and cues
* Filtering options to focus your analysis
* Force-directed layout with interactive adjustment, or aligned hierarchical layout
* Multiple savable graphs per database
* Fully supported dark theme

## How to use Xref Graph

### Finding call paths

1. Use **View → Open Subviews →** [**Pathfinder**](/9.4/core/user-interface/concepts/subviews.md#pathfinder) to select and add start, end, and optional intermediate points (waypoints). For example, if you want to see all possible ways from `main` to `LofError`, but want to exclude `Socket::Listen`, add `main` and `LofError` as start and end points, and add `Socket::Listen` to the *Excluded* list.

![Prepare pathfinding](/files/hU4D8dePOpJS9MtML00l)

2. Then [visualize](/9.4/core/disassembler/concepts/pathfinder.md#visualizing-results) all matching paths in the graph by pressing **Graph** button. After this, you will get a hierarchical graph in which the start and end points, as well as any waypoints, are highlighted with a color scheme. By default, the graph is static, with all nodes pinned, but this can be changed using [standard methods](#xref-graph-basic-controls).

![Path on graph](/files/mrUTuHgKwRytWqis2tdC)

### Exploring functions with aligned graph

You can also start your exploration from the selected entry point.

1. Place the cursor on a function, for example, `main` — and invoke **Xrefs graph from...**.

![Unaligned graph](/files/MTfwRmiHAdVc5ariqfyd)

Large graphs can be hard to read and confusing in the default layout.

2. If the initial graph looks cluttered, press `L` and get a much cleaner, better-aligned, and static graph.

![Aligned graph](/files/NZK8ZWI5bgpnxyU5bppe)

3. Zoom in with the mouse wheel and take a closer look at the nodes.

![Zoomed aligned graph](/files/yPhcbIH3OmXYN4I9Qqjv)

Zooming in also reveals the small icons on each node — see [Visual Cues](#visual-cues) for what each one means.

## Visual Cues

Nodes display small icons in their headers to indicate associated annotations:

* **Bookmark** — the node has a bookmark set at that address. Click the icon to open the Bookmarks view filtered to that node.
* **Breakpoint** — a breakpoint is set at that address. Click the icon to open the Breakpoints view filtered to that node.
* **Comment** — the node has a comment attached. Click the icon to open a dialog with comments.
* **More references** - nodes that have cross-references to or from addresses not yet added to the graph are marked with an indicator, signaling that the node has more connections to explore. Click the up or down chevron to open a chooser for adding those xrefs, equivalent to [**Add xrefs...**](/9.4/ida-actions/xrefgraphchoosexrefs.md) action filtered to a single direction. One, two, or three chevrons indicate the approximate number of references for this node that have not yet been added to the graph. The more references are missing, the more chevrons are shown, with three chevrons indicating the maximum level. The threshold values for the chevrons can be [adjusted](#options).

![Node Header with all cues](/files/ZChVRpQQBzsWDWsXXgyl)

## Xref Graph Basic Controls

* **Move nodes around**: Click and drag a selected node
* **Pan**: Click and drag graph background to move the whole graph. Hold <kbd>Shift</kbd> while dragging to pan without accidentally selecting and moving nodes.
* **Zoom**: Hold <kbd>Ctrl</kbd>/<kbd>CMD</kbd> while scrolling to zoom in/out
* **Jump to address**: Double-click a node to navigate to the corresponding item in the IDA View
* **Layout**: Use the <kbd>Space</kbd> key to pause or resume the layout mechanism
* **Pin**: Press <kbd>P</kbd> to pin the node in place
* **Search**: Press <kbd>Ctrl</kbd>/<kbd>CMD</kbd>+<kbd>F</kbd> to navigate to the Search Bar and search for nodes by name

### Adding and Removing Nodes

You can add or remove nodes from the graph using the right-click context menu on a node, or by using the following shortcuts with one or more nodes selected:

* Press <kbd>A</kbd> to add all cross-referenced nodes (**A**ll Xrefs)
* Press <kbd>F</kbd> to add nodes referenced by the selected nodes (Xrefs **F**rom)
* Press <kbd>T</kbd> to add nodes that reference the selected nodes (Xrefs **T**o)
* Press <kbd>X</kbd> to open a chooser dialog for selecting specific cross-references (**X**ref from or to)
* Press <kbd>D</kbd> to delete the selected nodes (**D**elete)

### Components of the main graph view

#### Nodes

Nodes are color-coded by type:

* **Blue**: Code (functions, instructions)
* **Green**: Data (variables, structures)
* **Pink**: Imports (external references)

Each node displays the name of the element it represents.

#### Information Display

* **Node information**: Hover over a node to see its name, address, type, and cross-reference count in the top-left corner.
* **Edge information**: Hover over an edge to see its source, destination, and reference type.

## Fit to viewport

The Fit to viewport option adjusts the view to optimally display content:

* <kbd>W</kbd> (Now) — Fits selected nodes to the viewer; if no nodes are selected, it fits the entire graph.
* <kbd>Shift</kbd>+<kbd>W</kbd> (Always) — Enables continuous fitting to the viewer.

## Aligning nodes

You can rearrange nodes into a hierarchical layout, placing ancestor nodes above their descendants for a clearer tree-like view. To do so, choose [**Align**](/9.4/ida-actions/xrefgraphalignlayout.md) from the context menu or press <kbd>L</kbd>.

![Default layout](/files/fpubb2ygyl1g2QicNpLk) ![Aligned layout](/files/qUOuEfUfP4Pnzquk0Bbv)

## Xref graph manager

You can open Xref Graph manager via **View → Graphs → Manage...**.

![Xref Graph Manager](/files/99i1X9bgBLbGYy99zn0f)

The manager is a dirtree widget that lets you do all the usual things with graphs:

* open graphs in a new tab, or switch to a graph if it is already open;
* delete graphs (or folders containing graphs) using the <kbd>Del</kbd> key;
* create new graphs with the <kbd>Ins</kbd> key, using the current address as the starting point;
* rename graphs using <kbd>F2</kbd> or <kbd>Ctrl</kbd>/<kbd>CMD</kbd>+<kbd>E</kbd>;
* create a copy of a graph using the **Duplicate** action;
* rearrange and organize graphs into folders however you prefer;
* view the number of nodes in the graph.

By default, newly created paths (marked with `P`) are placed in the `Paths` folder.

## Additional elements

### Minimap

Press <kbd>M</kbd> to toggle the minimap, which shows an overview of the entire graph and helps with navigation in large graphs. The minimap highlights the current viewport area for easy orientation.

### Search Bar

Press <kbd>S</kbd> to toggle the Search Bar and Layout button.

### Options Panel

Press <kbd>O</kbd> to toggle the options panel, which includes:

#### Filters

The filters section allows you to control which elements are displayed:

* **Node name filter** - Filter nodes by name
* **Filter orphan nodes** - Hide nodes with no visible connections
* **Edge type filters** - Show/hide specific edge types (Read, Write, Offset, Code)
* **Node type filters** - Show/hide specific node types (Code, Data, Import)

The number of filtered (hidden) nodes is displayed at the top of the filter panel.

## Options

Go to **Options → General → Graph** tab to configure the graph display parameters in the Xref Graph section:

* **Max node name length**: Maximum characters displayed in a node label
* **Nodes count threshold**: Maximum number of nodes loaded automatically into a new xref graph
* **Few missing xrefs threshold**: Nodes with fewer missing xrefs than this show the "low amount" indicator. Higher values widen the "low" band (for chevrons)
* **Many missing xrefs threshold**: Nodes with at least this many missing xrefs show the "high amount" indicator (for chevrons). The displayed count is also capped at this

## Low-level Layout Configuration

The force-directed graph layout can be customized with the following parameters, stored in the **xref-graph.cfg** file:

* **Drag** - Controls how quickly node movement slows down (damping)
* **Gravity** - Pulls nodes toward the center of the graph
* **Repulsion** - Controls how strongly nodes push each other away
* **Spring strength** - Determines how rigidly the edges hold nodes together
* **Spring length** - Sets the preferred distance between connected nodes
* **Minimum velocity** - Threshold below which node movement stops
* **Maximum velocity** - Caps the maximum speed of node movement
* **Node mass** - Base mass value for nodes (affects how easily they move)
* **Edge mass** - Base mass value for edges (affects how easily group of nodes move)
* **Timestep** - Controls the simulation speed
* **Theta threshold** - Performance parameter for the Barnes-Hut approximation


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.hex-rays.com/9.4/core/disassembler/concepts/xref-graph.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
