Pathfinder
The Pathfinder window finds call paths between functions by searching the cross-reference graph, and visualizes the results as an expanded cross-reference tree and as an Xref Graph, integrated into the Pathfinder view.
The Pathfinder helps you find answers to questions like: which call chains connect function A to function B? Can input handled here ever reach this API? Is there any route at all?
The window stacks the waypoint list at the top, with two collapsible panels below it: Exclusions and Options. Click a panel's label to expand or collapse it: that's where the exclusions list and the search options live.
Opening the widget
Open the Pathfinder (OpenPathfinder)
Shift+F9
Add current function to the latest path (MarkPathfinderEA)
Ctrl+Shift+F9
The widget can also be opened from View → Open subviews → Pathfinder, from the toolbar, or via the quick view (Ctrl+1) menu. From a Disassembly, Pseudocode, or other address-based view, Ctrl+Shift+F9 adds the function under the cursor to the latest path; unavailable if no path is currently open. Shift+F9 creates a new path instead, seeded with the function under the cursor.
More than one Pathfinder can be open at once, each holding its own path. Each is shown in its own tab, titled Path: <first waypoint> ... <last waypoint>. Additional context-menu actions are available for working across them.
Waypoints
Pathfinder operates on an ordered list of waypoints. As soon as the list contains two or more entries, the search runs automatically and re-runs whenever the list or the options change.
Waypoints are addresses or functions: adding an address anywhere inside a function adds that function (its start address), and duplicates are rejected. There are three ways to add one:
From the waypoint list itself: right-click it and choose Add waypoint...:
Add waypoint from context menu then pick a function in the chooser that opens:
Add waypoint from function chooser By dragging a function from the Functions list onto the waypoint list:
Drag a function from the Functions list onto the waypoint list From a Disassembly, Pseudocode, or other address-based view: right-click inside a function to open the Pathfinding submenu:
Add to path from disassembly context menu Add to latest path (<path name>) (Ctrl+Shift+F9): adds to the most recently used path; hidden if no path is currently open.
Create new path (Shift+F9): always available; opens a new Pathfinder with the function under the cursor as its first waypoint.
Add to <path name>: adds to a specific path already stored in the database; one entry per open path, no shortcut.
Once the list holds two or more waypoints:
Reorder them by dragging rows. Paths are searched segment by segment, visiting waypoints in list order.
Remove one by clicking its ✕ button, or right-click the list and choose Clear to remove them all at once.
Between each consecutive pair of waypoints, the list shows the segment result as an expandable row:
where N is the number of distinct functions participating in any path for that segment and M is the length of the shortest one. Expanding it reveals the nodes. Two directly connected waypoints show ↓ Direct connection instead, and a segment with no path shows ↓ no path.
If a segment has more nodes than the graph's node-count threshold (Options → General → Graph → Nodes count threshold), only the shortest path is built by default. Expanding the segment's row then loads the full path, and you can switch a segment back to its shortest-path state at any time.
In the expanded node list, nodes outside the shortest path are shown in gray, with Promote to waypoint available for them (see Built-in graph actions).
Excluding functions
The Exclusions panel (click its label to expand it) holds a list of addresses or functions banned from all paths. It's useful to stop the search from routing through ubiquitous helpers (logging, wrappers) that connect everything to everything.
Right-click the waypoint list and choose Add exclusion... to exclude a function without first adding it as a waypoint.
Drag a waypoint row down into the Excluded list to exclude it.
Drag an excluded row back into the waypoint list to re-include it.
Drag an excluded row outside the widget to delete it.
Options
The search options live in the collapsible Options panel — click its label to expand it.
Include data xrefs
Follow data references in addition to code (call) references.
Shortest path only
Restrict the result to the shortest path per segment instead of all paths.
Max depth
Bound the search depth (slider/spin; leftmost = "inf", unlimited).
The status line summarizes the overall result:
Found N unique nodes across M segment(s): paths exist for every segment;Warning: X of Y segment(s) have no path: at least one segment is unreachable;No path found: no segment has a path.
Visualizing results
The built-in Xref Graph is shown directly alongside the waypoint list. The path spine and the waypoint nodes use dedicated theme colors so the route stands out.
The Cross References Tree is available from the waypoint list's context menu (see Waypoints):
Open xref tree (first → last): rooted at the first waypoint, pre-expanded along every discovered path (xrefs from direction).
Open xref tree (last ← first): the same view from the last waypoint backwards (xrefs to direction).
For large results (more than 256 nodes) IDA asks for confirmation before expanding the tree, since the operation may take several seconds; the expansion is cancellable. The confirmation can be suppressed for the rest of the session.
Graphs created by Pathfinder are saved with the database and appear in the Xref Graph manager, but they are not plain Xref Graphs; see Built-in graph actions below.
Built-in graph actions
The Xref Graph built into Pathfinder has extra actions beyond a regular Xref Graph:
Promote to waypoint: turns a regular node into a waypoint. Also available from the waypoint list.
Exclude from path: turns a regular node into an excluded node (see Excluding functions).
Show in graph again: restores a node you deleted from the graph (
D); a deleted node is marked with a strikethrough in the node list until restored.
Persistence
Pathfinder state is saved in the desktop:
Waypoints and excludes are saved per database.
Options (checkboxes, max depth) are saved regardless of the active database.
Reopening the database restores the widget with its waypoint list, and the search re-runs automatically.
Limitations
Path search works at function granularity over the cross-reference graph: it answers "which functions reference which", not instruction-level or data-flow reachability.
With Max depth set, paths longer than the bound are not found even if they exist; the segment may report "no path".
Last updated
Was this helpful?