Xref Graph

Starting with IDA 9.2, the external qwingraph used to make graphs has been replaced with a native and interactive graphing tool, Xref Graph.

The integrated Xref Graph visualizes cross-reference relationships between code and data elements in a binary through an interactive interface. Xref Graph is available right out of the box via View → Graphs → Xrefs to|from and View → Graphs → Manage....

Core Features

• Interactive graph visualization of cross-references

• Multiple node types (code, data, imports) with distinct visual styling and cues

• Filtering options to focus your analysis

• Force-directed layout with interactive adjustment, or aligned hierarchical layout

• Multiple savable graphs per database

• Fully supported dark theme

How to use Xref Graph

Finding call paths

1. Use View → Open Subviews → Pathfinder to select and add start, end, and optional intermediate points (waypoints). For example, if you want to see all possible ways from main to LogError, but want to exclude Socket::Listen, add main and LogError as start and end points, and add Socket::Listen to the Excluded list.

Prepare pathfinding

1. Then visualize all matching paths in the graph by pressing Graph button. After this, you will get a hierarchical graph in which the start and end points, as well as any waypoints, are highlighted with a color scheme. By default, the graph is static, with all nodes pinned, but this can be changed using standard methods.

Path on graph

Exploring functions with aligned graph

You can also start your exploration from the selected entry point.

1. Place the cursor on a function, for example, main — and invoke Xrefs graph from....

Unaligned graph

Large graphs can be hard to read and confusing in the default layout.

1. If the initial graph looks cluttered, press L and get a much cleaner, better-aligned, and static graph.

Aligned graph

1. Zoom in with the mouse wheel and take a closer look at the nodes.

Zoomed aligned graph

Zooming in also reveals the small icons on each node — see Visual Cues for what each one means.

Visual Cues

Nodes display small icons in their headers to indicate associated annotations:

• Bookmark — the node has a bookmark set at that address. Click the icon to open the Bookmarks view filtered to that node.

• Breakpoint — a breakpoint is set at that address. Click the icon to open the Breakpoints view filtered to that node.

• Comment — the node has a comment attached. Click the icon to open a dialog with comments.

• More references - nodes that have cross-references to or from addresses not yet added to the graph are marked with an indicator, signaling that the node has more connections to explore. Click the up or down chevron to open a chooser for adding those xrefs, equivalent to Add xrefs... action filtered to a single direction. One, two, or three chevrons indicate the approximate number of references for this node that have not yet been added to the graph. The more references are missing, the more chevrons are shown, with three chevrons indicating the maximum level. The threshold values for the chevrons can be adjusted.

Node Header with all cues

Xref Graph Basic Controls

• Move nodes around: Click and drag a selected node

• Pan: Click and drag graph background to move the whole graph. Hold Shift while dragging to pan without accidentally selecting and moving nodes.

• Zoom: Hold Ctrl/CMD while scrolling to zoom in/out

• Jump to address: Double-click a node to navigate to the corresponding item in the IDA View

• Layout: Use the Space key to pause or resume the layout mechanism

• Pin: Press P to pin the node in place

• Search: Press Ctrl/CMD+F to navigate to the Search Bar and search for nodes by name

Adding and Removing Nodes

You can add or remove nodes from the graph using the right-click context menu on a node, or by using the following shortcuts with one or more nodes selected:

• Press A to add all cross-referenced nodes (All Xrefs)

• Press F to add nodes referenced by the selected nodes (Xrefs From)

• Press T to add nodes that reference the selected nodes (Xrefs To)

• Press X to open a chooser dialog for selecting specific cross-references (Xref from or to)

• Press D to delete the selected nodes (Delete)

Components of the main graph view

Nodes

Nodes are color-coded by type:

• Blue: Code (functions, instructions)

• Green: Data (variables, structures)

• Pink: Imports (external references)

Each node displays the name of the element it represents.

Information Display

• Node information: Hover over a node to see its name, address, type, and cross-reference count in the top-left corner.

• Edge information: Hover over an edge to see its source, destination, and reference type.

Fit to viewport

The Fit to viewport option adjusts the view to optimally display content:

• W (Now) — Fits selected nodes to the viewer; if no nodes are selected, it fits the entire graph.

• Shift+W (Always) — Enables continuous fitting to the viewer.

Aligning nodes

You can rearrange nodes into a hierarchical layout, placing ancestor nodes above their descendants for a clearer tree-like view. To do so, choose Align from the context menu or press L.

Default layout

Aligned layout

Xref graph manager

You can open Xref Graph manager via View → Graphs → Manage....

Xref Graph Manager

The manager is a dirtree widget that lets you do all the usual things with graphs:

• open graphs in a new tab, or switch to a graph if it is already open;

• delete graphs (or folders containing graphs) using the Del key;

• create new graphs with the Ins key, using the current address as the starting point;

• rename graphs using F2 or Ctrl/CMD+E;

• create a copy of a graph using the Duplicate action;

• rearrange and organize graphs into folders however you prefer;

• view the number of nodes in the graph.

By default, newly created paths (marked with P) are placed in the Paths folder.

Additional elements

Minimap

Press M to toggle the minimap, which shows an overview of the entire graph and helps with navigation in large graphs. The minimap highlights the current viewport area for easy orientation.

Search Bar

Press S to toggle the Search Bar and Layout button.

Options Panel

Press O to toggle the options panel, which includes:

Filters

The filters section allows you to control which elements are displayed:

• Node name filter - Filter nodes by name

• Filter orphan nodes - Hide nodes with no visible connections

• Edge type filters - Show/hide specific edge types (Read, Write, Offset, Code)

• Node type filters - Show/hide specific node types (Code, Data, Import)

The number of filtered (hidden) nodes is displayed at the top of the filter panel.

Options

Go to Options → General → Graph tab to configure the graph display parameters in the Xref Graph section:

• Max node name length: Maximum characters displayed in a node label

• Nodes count threshold: Maximum number of nodes loaded automatically into a new xref graph

• Few missing xrefs threshold: Nodes with fewer missing xrefs than this show the "low amount" indicator. Higher values widen the "low" band (for chevrons)

• Many missing xrefs threshold: Nodes with at least this many missing xrefs show the "high amount" indicator (for chevrons). The displayed count is also capped at this

Low-level Layout Configuration

The force-directed graph layout can be customized with the following parameters, stored in the xref-graph.cfg file:

• Drag - Controls how quickly node movement slows down (damping)

• Gravity - Pulls nodes toward the center of the graph

• Repulsion - Controls how strongly nodes push each other away

• Spring strength - Determines how rigidly the edges hold nodes together

• Spring length - Sets the preferred distance between connected nodes

• Minimum velocity - Threshold below which node movement stops

• Maximum velocity - Caps the maximum speed of node movement

• Node mass - Base mass value for nodes (affects how easily they move)

• Edge mass - Base mass value for edges (affects how easily group of nodes move)

• Timestep - Controls the simulation speed

• Theta threshold - Performance parameter for the Barnes-Hut approximation