xAnalyzer provides command-line interface commands for performing analysis and cleanup operations. You can execute these commands in the x64dbg command window or bind them to custom hotkeys.
Analysis commands
xanal selection
Analyzes a selection of instructions in the disassembly window.
Syntax
Description
Performs fast analysis on the currently selected instructions. Select multiple lines in the disassembly window, then execute this command to analyze API calls, function arguments, and data types within the selection.
Usage
- Select one or more instructions in the disassembly window
- Execute
xanal selection in the command window
- Analysis results appear as comments and labels in the selected range
Example
> xanal selection
[xAnalyzer]: Analyzing selection...
[xAnalyzer]: Analysis completed in 0.523s
Bind this command to a hotkey for quick access. This is useful when analyzing specific code blocks without processing entire functions.
xanal function
Analyzes the entire function containing the currently selected instruction.
Syntax
Description
Automatically discovers and analyzes the complete function that contains your current instruction pointer. xAnalyzer processes all instructions from function prolog to return statements, detecting:
- API calls with argument definitions
- Function arguments and data types
- Loops within function boundaries
- Indirect function calls
Usage
- Position your cursor anywhere within a function
- Execute
xanal function in the command window
- The entire function is analyzed and annotated
Example
> xanal function
[xAnalyzer]: Analyzing function at 0x00401000...
[xAnalyzer]: Detected 23 instructions
[xAnalyzer]: Found 4 API calls
[xAnalyzer]: Analysis completed in 0.145s
Function boundaries are determined by prologs and return statements. Functions with mid-function returns may have limited loop detection.
xanal module
Performs comprehensive analysis on the entire module.
Syntax
Description
Executes full analysis across the entire loaded module. This command respects the Extended Analysis configuration option:
- Standard mode: Analyzes executable code sections
- Extended mode: Deep analysis of all code sections (may consume significant time and memory)
Usage
- Load an executable in x64dbg
- Execute
xanal module in the command window
- Monitor progress in the log window
- Analysis data appears throughout the disassembly
Example
> xanal module
[xAnalyzer]: Analyzing module...
[xAnalyzer]: Module: example.exe
[xAnalyzer]: Code section: .text (0x00401000 - 0x0045A000)
[xAnalyzer]: Progress: 25%...
[xAnalyzer]: Progress: 50%...
[xAnalyzer]: Progress: 75%...
[xAnalyzer]: Progress: 100%
[xAnalyzer]: Analysis completed in 12.456s
[xAnalyzer]: Processed 8,472 instructions
[xAnalyzer]: Detected 342 API calls
Module analysis can take considerable time for large executables. With Extended Analysis enabled, memory usage may be significant.
Cleanup commands
xanalremove selection
Removes analysis data from the selected instructions.
Syntax
Description
Clears all analysis annotations (comments, labels, and extra information) from the currently selected instructions. Use this when you want to remove analysis data from specific code regions.
Usage
- Select the instructions to clear
- Execute
xanalremove selection in the command window
- Analysis data is removed from the selection
Example
> xanalremove selection
[xAnalyzer]: Removing analysis from selection...
[xAnalyzer]: Cleanup completed
xanalremove function
Removes analysis data from the entire function.
Syntax
Description
Clears all analysis annotations from the complete function containing the current instruction. This is the inverse of xanal function.
Usage
- Position your cursor within the function to clear
- Execute
xanalremove function in the command window
- All analysis data is removed from that function
Example
> xanalremove function
[xAnalyzer]: Removing analysis from function at 0x00401000...
[xAnalyzer]: Cleanup completed
xanalremove module
Removes all analysis data from the entire module.
Syntax
Description
Clears all xAnalyzer annotations from the loaded module. This removes:
- Automatic comments from API analysis
- Function argument labels
- Data type annotations
- Loop detection markers
Usage
- Execute
xanalremove module in the command window
- Confirm the operation if prompted
- All analysis data is removed from the module
Example
> xanalremove module
[xAnalyzer]: Removing all analysis from module...
[xAnalyzer]: Cleanup completed in 2.134s
Use this command before re-running module analysis with different configuration options.
Help command
xanal help
Displays command reference in the log window.
Syntax
Description
Shows a summary of all available xAnalyzer commands directly in the x64dbg log window.
Example
> xanal help
[xAnalyzer]: Available commands:
[xAnalyzer]: xanal selection - Analyze selected instructions
[xAnalyzer]: xanal function - Analyze current function
[xAnalyzer]: xanal module - Analyze entire module
[xAnalyzer]: xanalremove selection - Remove analysis from selection
[xAnalyzer]: xanalremove function - Remove analysis from function
[xAnalyzer]: xanalremove module - Remove analysis from module
[xAnalyzer]: xanal help - Show this help message
Command history
Previous command names have been deprecated. The current command set was introduced in version 2.4.1.
Deprecated commands
The following commands are no longer supported:
- Old executable analysis commands (replaced by
xanal module)
- Legacy analysis shortcuts (replaced by current command set)
If you have scripts or hotkeys using deprecated commands, update them to use the current command syntax.
Setting hotkeys
You can bind xAnalyzer commands to keyboard shortcuts in x64dbg:
- Go to Options > Preferences > Shortcuts
- Find the Plugins section
- Locate xAnalyzer commands
- Assign your preferred key combinations
Recommended hotkey setup
Ctrl+Shift+X - Analyze selectionCtrl+X - Analyze functionCtrl+Shift+M - Analyze module
For menu-based alternatives to these commands, see the Menu reference. 