Signature generation at xref sites
find_xref_signaturesGenerates shortest code signatures at cross-reference sites for addresses that cannot be signed directly, such as data, vtable entries, or string references.
Instructions
Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Number of shortest signatures to return per address (default: 5) | |
| addrs | Yes | Address(es) or name(s) to find XREF signatures for (e.g. a data address referenced by code) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes (default: 250) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |