Skip to content

Rewind64 v0.2.4 (Linux x86-64 experimental)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 15:23
v0.2.4
a9b0828

Rewind64 v0.2.4 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release adds explicitly addressed, read-only single-word memory inspection to Rewind64's Assembly interactive debugger. It is experimental and limited to a single process launched by the debugger, running on Linux x86-64.

New: mem 0xHEX / m 0xHEX

From a stopped interactive session, specify a hexadecimal address:

rewind64> mem 0x402000
Memory word at 0x0000000000402000: 0x1122334455667788
rewind64> m 0x402008
Memory word at 0x0000000000402008: 0xffffffffffffffff

The command reads one 64-bit (eight-byte) machine word using Linux PTRACE_PEEKDATA. It does not write or modify process memory, registers or instruction state. It can be used at the initial program stop, after a recognized instruction step, or while a delivery signal is pending. There is no process attachment or unrestricted memory dump.

Input validation and error handling

  • Addresses must begin with 0x or 0X, followed by 1–16 hexadecimal digits. Uppercase and lowercase digits A–F work.
  • Rejects missing digits, negative signs, excess digits, embedded/trailing whitespace and nonhexadecimal characters, including otherwise valid prefixes followed by junk. This is an exact NASM parser, without unbounded numeric conversion.
  • A syntactically valid but unreadable address produces ptrace(PEEKDATA at address) and returns to the command prompt with the target still stopped. Memory reads do not forward pending signals.
  • Before each read the debugger sets libc errno to zero. A ptrace return of -1 is accepted as valid all-ones data if errno is still zero; otherwise it is an error.
  • The old code/x command still reads the word at RIP; stack/k still reads up to four words starting at RSP. These commands are complementary.

Python-free native regression tests

Bash integration scripts resolve live symbol addresses from the stack_words and illegal native Assembly ELF fixtures using nm, rather than assuming fixed memory addresses. They verify known data, valid all-ones reads, zero and noncanonical/unreadable addresses, malformed hex, compact output, successive reads, coexistence with code and stack inspection, and signal-pending inspection without reinjection. The project continues to use NASM Assembly for the executable debugger and all test target fixtures, with Make/Bash test orchestration.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

At the prompt enter mem 0xADDRESS. All pre-existing commands—step, regs, status, code, stack, continue, help, quit and their aliases—remain available.

Limitations

Only Linux x86-64 with ptrace permissions and glibc is supported. A read can fail if an address is not mapped or accessible. The machine word is displayed as hexadecimal and is not disassembled, typed, decoded or persisted. Memory values may contain sensitive data; avoid sharing raw trace output. This debugger is not a sandbox; inspect only programs you own or are authorized to debug.

No Windows/macOS binary, thread/fork following, process attach, write-memory operation, breakpoint management, source/symbol debugger, reverse stepping, trace recording or deterministic replay is implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Assets 4
Loading