Skip to content

Rewind64 v0.2.3 (Linux x86-64 experimental)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 14:43
v0.2.3
2c21983

Rewind64 v0.2.3 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release introduces a bounded, read-only stack inspection command to the experimental NASM debugger. Only one explicitly launched Linux x86-64 tracee is supported, and there is no recording or reverse execution.

Interactive stack inspection

While stopped in an interactive session, type stack or its alias k. Rewind64 refreshes the registers through PTRACE_GETREGS, takes the current RSP, and reads at most four contiguous 64-bit words (32 bytes) starting there using Linux PTRACE_PEEKDATA.

rewind64> stack
Stack word [0] at 0x...: 0x...
Stack word [1] at 0x...: 0x...
Stack word [2] at 0x...: 0x...
Stack word [3] at 0x...: 0x...

The data is displayed as 64-bit hexadecimal machine words, not strings, decoded pointers, symbolic backtraces or disassembled instructions. The address is always computed from the live RSP, never an arbitrary user-supplied address, and the command never modifies tracee memory or registers. The existing code/x command still reads a single word at RIP.

Read errors and all-ones data

Before each PTRACE_PEEKDATA, Rewind64 clears libc errno and checks it only if ptrace returns -1. This recognizes a valid 0xffffffffffffffff word and avoids mistaking it for a kernel error. If an address is unreadable, the debugger reports ptrace(PEEKDATA at RSP) and returns to the interactive prompt without resuming the target or forwarding any pending signal. If a read fails after some words, the command stops rather than displaying fabricated data.

Native Assembly regression fixtures

  • tests/fixtures/stack_words.asm changes RSP after a single step to an initialized writable region containing four known 64-bit words, including 0xffffffffffffffff and 0x0000000000000000.
  • tests/fixtures/invalid_rsp.asm changes RSP to zero after a single step; the debugger attempts a read, reports an expected error, and safely terminates/reaps the stopped test target. The fixture is not resumed after its invalid stack pointer is set.
  • Bash black-box tests cover both command spellings, initial stack reading, after-step content, concise display, pending SIGILL, repeated inspection, mixed code and stack, and unreadable-address recovery.

Run it

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Existing step/s, regs/r, status/i, code/x, continue/c, help, and quit/q remain available. Automatic stepping is limited to 1–64 instructions; interactive single steps are requested one at a time.

Testing and limits

GitHub Actions builds the debugger and Assembly fixtures with NASM and runs Bash tests on Ubuntu 22.04 and 24.04. There is no Python in the executable debugger or integration-test dependency chain. This experimental Linux x86-64 release includes no Windows/macOS/ARM64 backend, fork/thread following, process attach, arbitrary-address memory browser, source/symbol disassembler, breakpoint management, persisted trace, reverse stepping or deterministic replay.

Traced programs run under the invoking user's privileges, not in a sandbox; debug only authorized programs. License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Assets 4
Loading