Skip to content

Rewind64 v0.2.10 (Linux x86-64 experimental)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 05:52
v0.2.10
98ecbbb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rewind64 v0.2.10 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This milestone adds read-only process lifecycle diagnostics within an interactive debugger stop. Rewind64 remains a Linux x86-64 single-launched-process, forward-only experimental debugger written in NASM Assembly.

New: events / e

Type events or e at the stopped interactive prompt:

rewind64> events
Lifecycle: pid=1234 steps=0 observed_signals=0 forwarded_signals=0 pending_signal=0 exec_events=0 exit_events=0

A genuine signal-delivery stop can be inspected without forwarding its pending signal:

rewind64> step
Interactive signal stop: signal 4 pending; choose step, continue or quit.
rewind64> e
Lifecycle: pid=1234 steps=0 observed_signals=1 forwarded_signals=0 pending_signal=4 exec_events=0 exit_events=0
Last signal stop: signal=4 si_code=2

(The PID and signal code above are illustrative; the actual kernel supplies these values.)

  • observed_signals increments when a valid application signal-delivery stop is classified using PTRACE_GETSIGINFO. Synthetic single-step traps and ptrace events are excluded.
  • forwarded_signals increments only on a successful ptrace resume request with a nonzero injected signal. This measures forwarding requests, not proof that a signal handler ran or received it.
  • pending_signal is the signal that would be submitted if the user chooses to step or continue. Read-only inspection, quit, and EOF do not forward it.
  • exec_events and exit_events are ptrace event totals observed so far, not full process event logs. The current debugger automatically resumes following these ptrace events; the interactive prompt does not stop there.
  • The optional Last signal stop line contains the most recent genuine signal number and signed si_code (absent before the first valid signal-delivery stop).
  • Exact events and e commands work with or without a final newline at EOF. Extra arguments are unsupported. No target state changes, ptrace operations, or filesystem output are triggered by this command.

Validation and assets

The Bash/native NASM regression suite contains 177 checks, including 13 new scenarios for initial state, aliases, repeated inspection, completed steps, pending SIGILL/SIGSEGV/SIGTRAP, compact output, invalid commands and newline-free EOF. The Linux CI matrix covers Ubuntu 22.04 and Ubuntu 24.04. The release workflow runs the native tests again before packaging a Linux x86-64 executable archive and SHA-256 checksums.

No Python is needed in the debugger, build, or tests.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other commands include step [1..16]/s, history [1..16]/h, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Security and limitations

Use the debugger only on code you own or are authorized to inspect. It is not a security sandbox and traced process addresses and memory content can be sensitive. Linux ptrace restrictions apply. No process attachment, multi-process/thread tracking, Windows/macOS backend, reverse execution, persistent traces, deterministic replay, breakpoint engine or stable release is included.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Assets 4
Loading