Igor’s tip of the week #18: Decompiler and global cross-references – Hex Rays

Previously we’ve covered cross-references in the disassembly view but in fact you can also consult them in the decompiler (pseudocode) view.

Local cross-references

The most common shortcut (X) works similarly to disassembly: you can use it on labels, variables (local and global), function names, but there are some differences and additions:

• for local variables, the list of cross-references shows pseudocode lines instead of disassembly snippets. 
  
• if you press X on an C statement keyword (e.g. if, while, return), all statements of the same type in the current function will be shown

Global cross-references

If you have a well-analyzed database with custom types used by the program and properly set up function prototypes, you can ask the decompiler to analyze all functions and build a list of cross-references to a structure field, an enum member or a whole local type. The default hotkey is Ctrl–Alt–X.

When you use it for the first time, the list may be empty or include only recently decompiled functions.

To cover all functions, refresh the list from the context menu or by pressing Ctrl–U. This will decompile all functions in the database and gather the complete list. The decompilation results are cached so next time you use the feature it will be faster.