> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/ida-9.5/core/disassembler/concepts/pathfinder.md).
# Pathfinder
The **Pathfinder** window finds call paths between functions by searching the cross-reference graph, and visualizes the results as an expanded cross-reference tree and as an [Xref Graph](/ida-9.5/core/disassembler/concepts/xref-graph.md), integrated into the Pathfinder view.
The Pathfinder helps you find answers to questions like: which call chains connect function A to function B? Can input handled here ever reach this API? Is there any route at all?
The window stacks the **waypoint list** at the top, with two collapsible panels below it: **Exclusions** and **Options**. Click a panel's label to expand or collapse it: that's where the exclusions list and the search options live.
{% hint style="info" %}
Pathfinder now has a **built-in Xref Graph**, shown directly alongside the waypoint list. It has more actions than a regular Xref Graph; see [Built-in graph actions](#built-in-graph-actions).
{% endhint %}
## Opening the widget
| Action | Default shortcut |
| --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| Open the Pathfinder ([`OpenPathfinder`](/ida-9.5/ida-actions/openpathfinder.md)) | none |
| Create a new path seeded with the current function ([`NewPathfinderPath`](/ida-9.5/ida-actions/newpathfinderpath.md)) | Shift+F9 |
| Add current function to the latest path ([`MarkPathfinderEA`](/ida-9.5/ida-actions/markpathfinderea.md)) | Ctrl+Shift+F9 |
The widget can also be opened from **View → Open subviews → Pathfinder**, from the toolbar, or via the quick view (Ctrl+1) menu. From a Disassembly, Pseudocode, or other address-based view, Ctrl+Shift+F9 adds the function under the cursor to the latest path; unavailable if no path is currently open. Shift+F9 creates a new path instead, seeded with the function under the cursor.
**More than one Pathfinder can be open at once**, each holding its own path. Each one appears on its own tab, titled `Path: ... ` (or just `` if the path contains only one point). The name is derived from the path endpoints unless you rename the graph in the Xref Graph Manager. Empty paths are not saved; a path emptied manually is deleted upon closing. Additional context-menu actions are available for working across them.
## Waypoints
Pathfinder operates on an **ordered list of waypoints**. As soon as the list contains two or more entries, the search runs automatically and re-runs whenever the list or the options change.
Waypoints are **addresses or functions**: adding an address anywhere inside a function adds that function (its start address), and duplicates are rejected. There are **three ways** to add one:
1. **From the waypoint list itself**: right-click it and choose **Add waypoint...**:
then pick a function in the chooser that opens:
2. **By dragging a function from the Functions list** onto the waypoint list:
3. **From a Disassembly, Pseudocode, or other address-based view**: right-click inside a function to open the **Pathfinding** submenu:
* **Add to latest path (\)** (Ctrl+Shift+F9): adds to the most recently used path; hidden if no path is currently open.
* **Create new path** (Shift+F9): always available; opens a new Pathfinder with the function under the cursor as its first waypoint.
* **Add to \**: adds to a specific path already opened; one entry per open path, no shortcut.
Once the list holds two or more waypoints:
* Reorder them by dragging rows. Paths are searched segment by segment, visiting waypoints in list order.
* Remove one by clicking its **✕** button, or right-click the list and choose **Clear** to remove them all at once.
If there are exactly two waypoints and no path exists between them, the Pathfinder first attempts to find a path in the reverse direction; if such a path exists, the two waypoints are automatically swapped, and a message is displayed in the Output.
Between each consecutive pair of waypoints, the list shows the segment result as an expandable row:
```
> N nodes (shortest: M)
```
where `N` is the number of functions strictly between the two waypoints that lie on any path for that segment, and `M` is how many of them the shortest path goes through (`shortest: direct` when it goes through none). Expanding it reveals the nodes. Two directly connected waypoints show `↓ Direct connection` instead, and a segment with no path shows `↓ no path`.
If displaying the full path results in a node count on the graph that exceeds the limit set in **Options → General → Graph → Nodes count threshold**, Pathfinder prompts the user to choose between drawing all nodes or only the shortest paths for each segment. The **Draw all** selection is saved for the specific path; if **Shortest paths** is selected, any segments that have a shorter path alternative are collapsed. The row for a collapsed segment displays information in the format `N nodes (shortest: M)`: the current option is shown in bold, while the alternative appears as a link. To toggle the display for a specific segment, you can click this link or select **Show shortest path for this segment** from the row's context menu. If expanding a segment causes the node count to exceed the threshold, the system requests confirmation for the action.
In the expanded node list, nodes outside the shortest path are shown in gray, with **Promote to waypoint** available for them (see [Built-in graph actions](#built-in-graph-actions)).
Selected nodes can be removed using the Del or Backspace keys (or the **Delete selected nodes** option in the context menu): a waypoint will revert to a standard node, while a segment node will be removed from the graph but remain in the path, displayed as struck-through. The **Show in graph again** option restores it. A node added manually by the user will simply be deleted.
## Excluding functions
The **Exclusions** panel (click its label to expand it) holds a list of addresses or functions banned from all paths. It's useful to stop the search from routing through ubiquitous helpers (logging, wrappers) that connect everything to everything.
* Right-click the waypoint list and choose **Add exclusion...** to exclude a function without first adding it as a waypoint.
* Drag a waypoint row down into the Excluded list to exclude it.
* Drag an excluded row back into the waypoint list to re-include it.
* Remove an excluded row with its **✕** button, or right-click the list and choose **Clear** to remove them all.
## Options
The search options live in the collapsible **Options** panel. Click its label to expand it.
| Option | Effect |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Include data xrefs** | Follow data references in addition to code (call) references. |
| **Shortest path only** | Restrict the result to the shortest path per segment instead of all paths. |
| **Max depth** | Bound the search depth per segment. A logarithmic slider from 1 up to 1000; the rightmost position reads `inf` and lifts the bound. |
## Visualizing results
The built-in [Xref Graph](/ida-9.5/core/disassembler/concepts/xref-graph.md#finding-call-paths) is shown directly alongside the waypoint list. The path spine and the waypoint nodes use dedicated theme colors so the route stands out.
The [Cross References Tree](/ida-9.5/core/user-interface/concepts/subviews.md#cross-references-tree-window) is available from the waypoint list's context menu (see [Waypoints](#waypoints)):
* **Open xref tree (first → last)**: rooted at the first waypoint, pre-expanded along every discovered path (xrefs *from* direction).
* **Open xref tree (last ← first)**: the same view from the last waypoint backwards (xrefs *to* direction).
For large results (more than 256 nodes) IDA asks for confirmation before expanding the tree, since the operation may take several seconds; the expansion is cancellable. The confirmation can be suppressed for the rest of the session.
Graphs created by Pathfinder are saved with the database and appear in the [Xref Graph manager](/ida-9.5/core/disassembler/concepts/xref-graph.md#xref-graph-manager), but they are not plain Xref Graphs; see [Built-in graph actions](#built-in-graph-actions) below.
### Built-in graph actions
You can manually extend the graph: click a node's **More references** chevron, or select nodes and press X (**Add xrefs...**) to pick functions from the chooser. Nodes added in this way appear in the list under the waypoint they were extended from; they persist through path recalculations and are saved as part of the path.
The Xref Graph built into Pathfinder has extra actions beyond a regular Xref Graph:
* **Promote to waypoint**: turns a regular node into a waypoint. Also available from the waypoint list.
* **Exclude from path**: turns a regular node into an excluded node (see [Excluding functions](#excluding-functions)).
* **Show in graph again**: restores a node you deleted from the graph (`D`); a deleted node is marked with a strikethrough in the node list until restored.
## Persistence
Pathfinder state is saved in the desktop:
* Waypoints and excludes are saved per database.
* Options (checkboxes, max depth) are saved regardless of the active database.
Reopening the database restores the widget with its waypoint list, and the search re-runs automatically.
## Limitations
* Path search works at function granularity over the cross-reference graph: it answers "which functions reference which", not instruction-level or data-flow reachability.
* With **Max depth** set, paths longer than the bound are not found even if they exist; the segment may report `no path`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.hex-rays.com/ida-9.5/core/disassembler/concepts/pathfinder.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.