get_xrefs_to_field
Find all cross-references to a specific struct field in IDA Pro, enabling efficient reverse engineering and analysis of struct member usage.
Instructions
Get all cross references to a named struct field (member)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field_name | Yes | Name of the field (member) to get xrefs to | |
| struct_name | Yes | Name of the struct (type) containing the field |
Implementation Reference
- Handler function for getting cross-references to structure fields. Takes struct and field names, resolves the type ID, and returns XrefsTo that field.
@tool @idaread def xrefs_to_field(queries: list[StructFieldQuery] | StructFieldQuery) -> list[dict]: """Get cross-references to structure fields""" if isinstance(queries, dict): queries = [queries] results = [] til = ida_typeinf.get_idati() if not til: return [ { "struct": q.get("struct"), "field": q.get("field"), "xrefs": [], "error": "Failed to retrieve type library", } for q in queries ] for query in queries: struct_name = query.get("struct", "") field_name = query.get("field", "") try: tif = ida_typeinf.tinfo_t() if not tif.get_named_type( til, struct_name, ida_typeinf.BTF_STRUCT, True, False ): results.append( { "struct": struct_name, "field": field_name, "xrefs": [], "error": f"Struct '{struct_name}' not found", } ) continue idx = ida_typeinf.get_udm_by_fullname(None, struct_name + "." + field_name) if idx == -1: results.append( { "struct": struct_name, "field": field_name, "xrefs": [], "error": f"Field '{field_name}' not found in '{struct_name}'", } ) continue tid = tif.get_udm_tid(idx) if tid == ida_idaapi.BADADDR: results.append( { "struct": struct_name, "field": field_name, "xrefs": [], "error": "Unable to get tid", } ) continue xrefs = [] xref: ida_xref.xrefblk_t for xref in idautils.XrefsTo(tid): xrefs += [ Xref( addr=hex(xref.frm), type="code" if xref.iscode else "data", fn=get_function(xref.frm, raise_error=False), ) ] results.append({"struct": struct_name, "field": field_name, "xrefs": xrefs}) except Exception as e: results.append( { "struct": struct_name, "field": field_name, "xrefs": [], "error": str(e), } ) return results - Input schema TypedDict for the tool parameters: struct name and field name.
class StructFieldQuery(TypedDict): """Struct field query for xrefs""" struct: Annotated[str, "Structure name"] field: Annotated[str, "Field name"] - src/ida_pro_mcp/ida_mcp/api_analysis.py:17-18 (registration)Import of @tool decorator used to register the MCP tool.
from .rpc import tool from .sync import idaread, is_window_active - Output Xref type used in the results.
class Xref(TypedDict): addr: str type: str fn: Optional[Function]