Rewind64 v0.2.12 (Linux x86-64 experimental)

Rewind64 v0.2.12 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This experimental update introduces a continue-to-next-signal interactive command and verifies a real series of handled signal-delivery stops. The debugger remains a forward-only, single self-launched Linux x86-64 target debugger.

New: until-signal / u

At an interactive prompt:

rewind64> until-signal
Interactive signal stop: signal 10 pending; choose step, until-signal, continue or quit.
rewind64> signals
Signal history [0]: signal=10 si_code=0 step=0
rewind64> u
Interactive signal stop: signal 10 pending; choose step, until-signal, continue or quit.
rewind64> signals
Signal history [0]: signal=10 si_code=0 step=0
Signal history [1]: signal=10 si_code=0 step=0

The example uses a target with a real SIGUSR1 handler; actual signal codes and counts depend on the program. until-signal performs PTRACE_CONT and returns to the command prompt at the next validated application signal-delivery stop, with that new signal not yet forwarded.

• At a pending signal stop: another u, step or continue forwards the pending signal exactly once on a successful ptrace resume.
• At a new validated signal stop: the session records the stop in the bounded eight-entry signals ring and returns to the interactive prompt. signals and events remain read-only.
• If the tracee exits first: the target's actual status is returned; no synthetic signal stop is invented.
• Across exec events: ordinary ptrace exec events are followed and don't count as application signal stops.
• Existing ordinary continue behavior is unchanged: it runs onward and automatically forwards signals.
• The exact commands until-signal / u are accepted even if the final input line has no newline. Extra arguments are rejected.

Repeated handled-signal verification

A new native NASM Linux x86-64 fixture sends itself ten SIGUSR1 signals sequentially and verifies that a real installed handler ran ten times before exiting successfully. With repeated u requests, the debugger must:

• Stop at each of the ten signal-delivery events, retaining at most the latest eight records in chronological order.
• Distinguish 10 observed vs 9 forwarded signal events while paused at the tenth stop, then report 10 forwarded after the final resume.
• Leave the stopped target unchanged during signals, events, history and status inspections.

The full Python-free Bash/native NASM suite has 204 integration tests, exercised on Ubuntu 22.04 and Ubuntu 24.04. The prerelease publishing workflow reruns make clean && make test before packaging the native executable archive and SHA256SUMS.txt.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Interactive commands include step [1..16]/s, until-signal/u, history [1..16]/h, events/e, signals/g, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help, and quit/q.

Scope and safety

Debug only programs you own or have permission to inspect. Linux ptrace restrictions apply; Rewind64 is not a security sandbox and can reveal sensitive process state. No multi-thread/process following, Windows/macOS backend, attach, breakpoints, disassembly, persistent execution traces, historic memory/register restoration, deterministic replay or reverse stepping is implemented. This is an experimental pre-release, not stable.

License: Boost Software License 1.0. Repository: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.11 (Linux x86-64 experimental)

Rewind64 v0.2.11 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This experimental update provides a bounded, read-only history of validated application signal-delivery stops for the single self-launched Linux x86-64 tracee.

New: signals / g

At an interactive debugger prompt:

rewind64> signals
Signal history: no validated signal-delivery stops yet.
rewind64> step
Interactive signal stop: signal 4 pending; choose step, continue or quit.
rewind64> g
Signal history [0]: signal=4 si_code=2 step=0

The output is illustrative; signal numbers and si_code depend on the target and the Linux kernel.

• Records only validated signal-delivery stops from PTRACE_GETSIGINFO: signal number, signed siginfo_t.si_code, and completed instruction-step count at the time of observation.
• Holds the latest eight observations in a fixed 128-byte, debugger-local circular buffer, displayed oldest-to-newest. The oldest stop is replaced when full.
• Does not count synthetic PTRACE_SINGLESTEP traps, exec/exit ptrace events, invalid commands, or read-only memory/register inspections.
• Reading signals / g never resumes the tracee, forwards pending signals or modifies registers and memory.
• Exact commands also work as a final EOF-terminated input line without a newline. Unexpected arguments are rejected as unknown commands.
• events / e remains available for total observed and submitted forward signal counts, plus pending signal and ptrace event counters. Those counts measure different actions and need not match.

Validation

190/190 native Assembly/Bash integration tests passed on both Ubuntu 22.04 and Ubuntu 24.04 on the corrected development code, including 13 new signal-history regression cases. The release workflow rebuilds and runs make clean && make test before publishing a Linux x86-64 executable archive and its SHA256SUMS.txt manifest. No Python is needed.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other interactive commands: step [1..16]/s, history [1..16]/h, events/e, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help, and quit/q.

Limitations and safety

Rewind64 is experimental and forward-only, for Linux x86-64 single self-launched targets. It does not offer process attachment, breakpoint insertion, source-level debugging, multi-thread tracing, disassembly, persistent recording, historic memory or CPU-state restoration, replay, or reverse stepping. Use it only on programs you own or have authorization to debug. It is not a sandbox; memory and signal diagnostics can expose sensitive process information. Normal Linux ptrace permission rules apply.

License: Boost Software License 1.0. Source repository: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.10 (Linux x86-64 experimental)

Rewind64 v0.2.10 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This milestone adds read-only process lifecycle diagnostics within an interactive debugger stop. Rewind64 remains a Linux x86-64 single-launched-process, forward-only experimental debugger written in NASM Assembly.

New: events / e

Type events or e at the stopped interactive prompt:

rewind64> events
Lifecycle: pid=1234 steps=0 observed_signals=0 forwarded_signals=0 pending_signal=0 exec_events=0 exit_events=0

A genuine signal-delivery stop can be inspected without forwarding its pending signal:

rewind64> step
Interactive signal stop: signal 4 pending; choose step, continue or quit.
rewind64> e
Lifecycle: pid=1234 steps=0 observed_signals=1 forwarded_signals=0 pending_signal=4 exec_events=0 exit_events=0
Last signal stop: signal=4 si_code=2

(The PID and signal code above are illustrative; the actual kernel supplies these values.)

• observed_signals increments when a valid application signal-delivery stop is classified using PTRACE_GETSIGINFO. Synthetic single-step traps and ptrace events are excluded.
• forwarded_signals increments only on a successful ptrace resume request with a nonzero injected signal. This measures forwarding requests, not proof that a signal handler ran or received it.
• pending_signal is the signal that would be submitted if the user chooses to step or continue. Read-only inspection, quit, and EOF do not forward it.
• exec_events and exit_events are ptrace event totals observed so far, not full process event logs. The current debugger automatically resumes following these ptrace events; the interactive prompt does not stop there.
• The optional Last signal stop line contains the most recent genuine signal number and signed si_code (absent before the first valid signal-delivery stop).
• Exact events and e commands work with or without a final newline at EOF. Extra arguments are unsupported. No target state changes, ptrace operations, or filesystem output are triggered by this command.

Validation and assets

The Bash/native NASM regression suite contains 177 checks, including 13 new scenarios for initial state, aliases, repeated inspection, completed steps, pending SIGILL/SIGSEGV/SIGTRAP, compact output, invalid commands and newline-free EOF. The Linux CI matrix covers Ubuntu 22.04 and Ubuntu 24.04. The release workflow runs the native tests again before packaging a Linux x86-64 executable archive and SHA-256 checksums.

No Python is needed in the debugger, build, or tests.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other commands include step [1..16]/s, history [1..16]/h, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Security and limitations

Use the debugger only on code you own or are authorized to inspect. It is not a security sandbox and traced process addresses and memory content can be sensitive. Linux ptrace restrictions apply. No process attachment, multi-process/thread tracking, Windows/macOS backend, reverse execution, persistent traces, deterministic replay, breakpoint engine or stable release is included.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.9 (Linux x86-64 experimental)

Rewind64 v0.2.9 — experimental Linux x86-64 pre-release

Explore execution. Trace every instruction. Understand the past.

This milestone upgrades the bounded interactive RIP history to show a verified cumulative instruction-step number for each sampled address and optionally the last N observations. The debugger remains experimental and forward-only.

New: step-numbered history [N] / h [N]

rewind64> step 3
...
rewind64> history 2
RIP history [0]: 0x0000000000401002 step=2
RIP history [1]: 0x0000000000401003 step=3
rewind64> h 1
RIP history [0]: 0x0000000000401003 step=3

• history and h with no count still print all available samples (at most 16) in chronological order.
• history N and h N accept a strict decimal N from 1 to 16, selecting the most recent N entries, oldest first. If the session has fewer than N available, all current entries are displayed.
• Each entry now has the cumulative verified instruction-step number. The initial post-exec stop is step=0; subsequent successful steps are labeled step=1, step=2, etc.
• Count parsing rejects zero, 17+, signs, leading zeros, extra whitespace and trailing arguments without resuming the stopped tracee.
• The debugger stores at most 16 pairs of RIP and step number in bounded in-memory rings, evicting old samples together on wraparound. Read-only commands, invalid input and application signal-delivery stops are not recorded as successful steps.

Tests and packaging

The expanded Bash/native NASM integration suite has 164 regression checks on Linux x86-64, including 12 new scenarios for count parsing, newest-N filtering, step-label consistency across ring wraps, signal handling, code inspection and EOF. CI runs on Ubuntu 22.04 and 24.04; the pre-release workflow repeats native build and tests before packaging the .tar.gz Linux x86-64 executable and SHA256SUMS.txt. No Python is required.

Running Rewind64

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other interactive commands include step [1..16]/s, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Important limits

History records only sampled instruction pointer addresses and step numbers. It is not a full CPU or memory state trace and cannot rewind execution. There is no breakpoint engine, process attachment, Windows/macOS backend, multi-thread tracing, execution recording, deterministic replay, or stable release. Linux ptrace permissions apply. Debug only targets you own or are authorized to inspect. Addresses and memory output may contain sensitive information.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.8 (Linux x86-64 experimental)

Rewind64 v0.2.8 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This milestone adds a small in-memory history of observed instruction-pointer addresses. The debugger remains experimental, Linux x86-64 only and forward-only. This is not a reverse debugger or deterministic execution recorder.

New: history / h

From an interactive stop:

rewind64> step 2
...
rewind64> history
RIP history [0]: 0x0000000000401000
RIP history [1]: 0x0000000000401001
RIP history [2]: 0x0000000000401002

• Records one RIP sample at the initial post-exec stop and after each verified single-step completion.
• Displays up to 16 recent RIP samples oldest-first. As execution advances, the oldest entry is replaced in a fixed-size NASM circular buffer. No unbounded memory allocation or persistence.
• Does not add entries for inspecting registers, code/bytes, memory, invalid commands or application signal-delivery stops. A step batch contributes one entry per confirmed step.
• history and h never issue ptrace commands or resume the stopped tracee.
• The stored data is only instruction addresses. It does not retain past memory, register sets, instruction operands, syscall results, signal delivery or enough information to rewind execution.

Validation

• 152 Bash/native Assembly fixture tests passed on Ubuntu 22.04 and Ubuntu 24.04, including 10 new scenarios for exact RIP sequences, wrap-around after 16 samples, multiple wraps, pending signal stops and non-mutating inspection commands.
• The release workflow rebuilds and tests before packaging the experimental Linux x86-64 archive and SHA-256 checksum file.
• No Python files or Python build/test dependencies.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Interactive commands include history/h, step [1..16]/s, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Security and limitations

Only use Rewind64 on programs you own or have permission to debug. The debugger is not a security sandbox; process state and addresses may be sensitive. Linux ptrace permissions and container policy apply. There is no Windows/macOS backend, general multi-process/thread tracing, breakpoints, process attachment, reverse execution, recorded trace format, deterministic replay or stable release.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.7 (Linux x86-64 experimental)

Rewind64 v0.2.7 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release adds bounded, read-only instruction byte inspection at the stopped tracee's instruction pointer. The feature is native NASM Assembly and stays within Rewind64's existing single-launched-process Linux x86-64 debugging model.

New: bytes [N] / b [N]

At a stopped interactive prompt, enter bytes or b to display eight raw bytes at the current RIP, or supply a decimal count from 1 to 8.

rewind64> bytes 4
Instruction byte [+0] at 0x0000000000401000: 0x90
Instruction byte [+1] at 0x0000000000401001: 0x90
Instruction byte [+2] at 0x0000000000401002: 0x90
Instruction byte [+3] at 0x0000000000401003: 0x90
rewind64> b 1
Instruction byte [+0] at 0x0000000000401000: 0x90

This view shows raw bytes in increasing execution address order, unlike the previous code/x command, which displays a full 64-bit word. It does not decode assembly mnemonics, infer instruction boundaries, or implement disassembly.

Safety and error handling

• The count is optional (default 8) and must be one decimal digit 1–8. Other values, whitespace, signs, leading zeros or extra arguments are rejected without invoking ptrace or resuming the target.
• Uses fresh PTRACE_GETREGS and exactly one PTRACE_PEEKTEXT call, with errno-safe handling when valid bytes are all 0xff.
• Unreadable code reports a nonfatal diagnostic and returns to the prompt. Pending application signals are not injected by this inspection command.
• No target memory/register modification, code patching, process attachment, breakpoint management, or unbounded memory dumping is performed.

Validation

142/142 Bash and native NASM integration tests passed on both Ubuntu 22.04 and Ubuntu 24.04, including 11 new cases for known NOP bytes, alias and counts, all-ones code, malformed arguments, combined code/batch stepping, compact output, pending SIGILL and input EOF. The release workflow also rebuilds and tests before packaging a native Linux x86-64 archive with a SHA-256 checksum file. The test/build path remains Python-free.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other commands include step [1..16]/s, regs/r, status/i, code/x, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Limitations

Rewind64 remains experimental and forward-only. Linux x86-64, glibc, native NASM build, and ptrace permission are required. It is not a sandbox. Debug only targets you own or are authorized to inspect; code and memory inspection can reveal sensitive data. Windows/macOS, multiple tracees/threads, reverse execution, recording, replay, disassembly and breakpoints are not yet implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.6 (Linux x86-64 experimental)

Rewind64 v0.2.6 — experimental Linux x86-64 pre-release

Explore execution. Trace every instruction. Understand the past.

This version expands Rewind64's native Assembly interactive debugger with bounded forward instruction batches. It still supports one explicitly launched Linux x86-64 target. It is not a reverse debugger, record/replay system or process attachment tool.

New: step N and s N

At a stopped interactive prompt:

rewind64> step 4
After step: ... 
Register changes: ...
...
rewind64> status
Session status: pid=... steps=4 pending_signal=0
rewind64> s 16
...```

- Specify a strict decimal integer from **1–16**. The original `step` and `s` commands still request **one** instruction.
- Each successfully completed instruction receives a fresh CPU register snapshot and register-change report; `--changes-only` keeps its concise display behavior.
- Invalid counts (`0`, `17`, leading zeros, signs, extra arguments or trailing spaces) print a usage hint **without resuming the target**.
- A verified application signal stop **stops the batch immediately**, preserves the pending signal for explicit operator action, and cancels remaining steps.
- Ptrace exec/exit events also cancel a batch, with existing lifecycle handling continuing as before.

## Validation

**131 native Assembly fixture/Bash integration tests** passed on Ubuntu 22.04 and Ubuntu 24.04. The new 14 cases verify minimum and maximum counts, aliases, sequential batch operations, malformed input, SIGILL/SIGSEGV/SIGTRAP interruption, signal forwarding, early exit, concise output, memory/code inspection coexistence and EOF without newline. Build and tests require NASM, Linux x86-64/glibc, Make, Bash and coreutils; **Python is not used**.

## Usage

```sh
./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other interactive commands remain available: regs/r, status/i, code/x, stack/k, mem 0xHEX [1..4]/m, continue/c, help, quit/q.

Limitations and security

This is experimental single-tracee Linux x86-64 software with forward execution only, not a sandbox. Only run or inspect binaries you own or are authorized to debug. Trace memory/register output can include sensitive information. Linux ptrace permissions and host security policies still apply; Rewind64 does not bypass them.

No Windows/macOS native backends, thread/fork following, arbitrary process attachment, breakpoints, source-level decoding, trace recording, historical state navigation, reverse execution or deterministic replay are implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.5 (Linux x86-64 experimental)

Rewind64 v0.2.5 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This build adds bounded, read-only multi-word memory inspection and strengthens the interactive command parser. Rewind64 remains a forward-only experimental Linux x86-64 debugger for a single explicitly launched target. It does not implement reverse execution, process recording or deterministic replay.

New: bounded memory reads

At a stopped interactive prompt, use mem 0xHEX [COUNT] or m 0xHEX [COUNT].

rewind64> mem 0x402000 2
Memory word at 0x0000000000402000: 0x1122334455667788
Memory word at 0x0000000000402008: 0xffffffffffffffff

• COUNT is optional; default is 1 to preserve v0.2.4 behavior.
• Explicit COUNT must be one decimal digit in 1–4, limiting a command to 8–32 bytes. Spaces are exact; trailing words or junk are rejected.
• Addresses require 0x or 0X and 1–16 hex digits. The parser rejects malformed/overflowing text and preflights address arithmetic to prohibit 64-bit wrap before reading.
• Each word uses PTRACE_PEEKDATA, clearing/checking libc errno so an all-ones value is not mistaken for an error. A failed read is nonfatal to the debugger session and does not forward a pending signal.
• Values are read-only; no memory writing, process attachment, unbounded memory dumps or pointer following.

Interactive command hardening

The bounded 64-byte command input now discards a whole oversized line through newline or EOF. Its trailing bytes are not interpreted as another debugger command. Scripts with a command fragment ending in continue therefore cannot accidentally resume the stopped target.

Validation

• 117 Bash and native NASM integration cases passed on Ubuntu 22.04 and Ubuntu 24.04 before release, including the eight new memory-range and input-boundary scenarios.
• No Python executable, test harness, or dependency was added.
• The release workflow rebuilds and runs the tests before packaging a native Linux x86-64 tarball and SHA-256 checksums.

Usage

./rewind64 run --interactive /path/to/your/authorized/program

Prompt commands: step/s, regs/r, status/i, code/x, stack/k, mem/m, continue/c, help, quit/q.

Important limitations

This project is not a sandbox. Run or inspect only executables you own or have permission to debug. Trace output may expose sensitive data. Linux security settings and ptrace permissions apply; do not bypass them. Windows/macOS, multi-process debugging, breakpoints, disassembly, historical state capture, reverse stepping and replay are not implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.4 (Linux x86-64 experimental)

Rewind64 v0.2.4 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release adds explicitly addressed, read-only single-word memory inspection to Rewind64's Assembly interactive debugger. It is experimental and limited to a single process launched by the debugger, running on Linux x86-64.

New: mem 0xHEX / m 0xHEX

From a stopped interactive session, specify a hexadecimal address:

rewind64> mem 0x402000
Memory word at 0x0000000000402000: 0x1122334455667788
rewind64> m 0x402008
Memory word at 0x0000000000402008: 0xffffffffffffffff

The command reads one 64-bit (eight-byte) machine word using Linux PTRACE_PEEKDATA. It does not write or modify process memory, registers or instruction state. It can be used at the initial program stop, after a recognized instruction step, or while a delivery signal is pending. There is no process attachment or unrestricted memory dump.

Input validation and error handling

• Addresses must begin with 0x or 0X, followed by 1–16 hexadecimal digits. Uppercase and lowercase digits A–F work.
• Rejects missing digits, negative signs, excess digits, embedded/trailing whitespace and nonhexadecimal characters, including otherwise valid prefixes followed by junk. This is an exact NASM parser, without unbounded numeric conversion.
• A syntactically valid but unreadable address produces ptrace(PEEKDATA at address) and returns to the command prompt with the target still stopped. Memory reads do not forward pending signals.
• Before each read the debugger sets libc errno to zero. A ptrace return of -1 is accepted as valid all-ones data if errno is still zero; otherwise it is an error.
• The old code/x command still reads the word at RIP; stack/k still reads up to four words starting at RSP. These commands are complementary.

Python-free native regression tests

Bash integration scripts resolve live symbol addresses from the stack_words and illegal native Assembly ELF fixtures using nm, rather than assuming fixed memory addresses. They verify known data, valid all-ones reads, zero and noncanonical/unreadable addresses, malformed hex, compact output, successive reads, coexistence with code and stack inspection, and signal-pending inspection without reinjection. The project continues to use NASM Assembly for the executable debugger and all test target fixtures, with Make/Bash test orchestration.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

At the prompt enter mem 0xADDRESS. All pre-existing commands—step, regs, status, code, stack, continue, help, quit and their aliases—remain available.

Limitations

Only Linux x86-64 with ptrace permissions and glibc is supported. A read can fail if an address is not mapped or accessible. The machine word is displayed as hexadecimal and is not disassembled, typed, decoded or persisted. Memory values may contain sensitive data; avoid sharing raw trace output. This debugger is not a sandbox; inspect only programs you own or are authorized to debug.

No Windows/macOS binary, thread/fork following, process attach, write-memory operation, breakpoint management, source/symbol debugger, reverse stepping, trace recording or deterministic replay is implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Rewind64 v0.2.3 (Linux x86-64 experimental)

Rewind64 v0.2.3 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release introduces a bounded, read-only stack inspection command to the experimental NASM debugger. Only one explicitly launched Linux x86-64 tracee is supported, and there is no recording or reverse execution.

Interactive stack inspection

While stopped in an interactive session, type stack or its alias k. Rewind64 refreshes the registers through PTRACE_GETREGS, takes the current RSP, and reads at most four contiguous 64-bit words (32 bytes) starting there using Linux PTRACE_PEEKDATA.

rewind64> stack
Stack word [0] at 0x...: 0x...
Stack word [1] at 0x...: 0x...
Stack word [2] at 0x...: 0x...
Stack word [3] at 0x...: 0x...

The data is displayed as 64-bit hexadecimal machine words, not strings, decoded pointers, symbolic backtraces or disassembled instructions. The address is always computed from the live RSP, never an arbitrary user-supplied address, and the command never modifies tracee memory or registers. The existing code/x command still reads a single word at RIP.

Read errors and all-ones data

Before each PTRACE_PEEKDATA, Rewind64 clears libc errno and checks it only if ptrace returns -1. This recognizes a valid 0xffffffffffffffff word and avoids mistaking it for a kernel error. If an address is unreadable, the debugger reports ptrace(PEEKDATA at RSP) and returns to the interactive prompt without resuming the target or forwarding any pending signal. If a read fails after some words, the command stops rather than displaying fabricated data.

Native Assembly regression fixtures

• tests/fixtures/stack_words.asm changes RSP after a single step to an initialized writable region containing four known 64-bit words, including 0xffffffffffffffff and 0x0000000000000000.
• tests/fixtures/invalid_rsp.asm changes RSP to zero after a single step; the debugger attempts a read, reports an expected error, and safely terminates/reaps the stopped test target. The fixture is not resumed after its invalid stack pointer is set.
• Bash black-box tests cover both command spellings, initial stack reading, after-step content, concise display, pending SIGILL, repeated inspection, mixed code and stack, and unreadable-address recovery.

Run it

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Existing step/s, regs/r, status/i, code/x, continue/c, help, and quit/q remain available. Automatic stepping is limited to 1–64 instructions; interactive single steps are requested one at a time.

Testing and limits

GitHub Actions builds the debugger and Assembly fixtures with NASM and runs Bash tests on Ubuntu 22.04 and 24.04. There is no Python in the executable debugger or integration-test dependency chain. This experimental Linux x86-64 release includes no Windows/macOS/ARM64 backend, fork/thread following, process attach, arbitrary-address memory browser, source/symbol disassembler, breakpoint management, persisted trace, reverse stepping or deterministic replay.

Traced programs run under the invoking user's privileges, not in a sandbox; debug only authorized programs. License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64