Skip to content

Rewind64 v0.2.7 (Linux x86-64 experimental)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 03:28
v0.2.7
b80e4dc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rewind64 v0.2.7 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This release adds bounded, read-only instruction byte inspection at the stopped tracee's instruction pointer. The feature is native NASM Assembly and stays within Rewind64's existing single-launched-process Linux x86-64 debugging model.

New: bytes [N] / b [N]

At a stopped interactive prompt, enter bytes or b to display eight raw bytes at the current RIP, or supply a decimal count from 1 to 8.

rewind64> bytes 4
Instruction byte [+0] at 0x0000000000401000: 0x90
Instruction byte [+1] at 0x0000000000401001: 0x90
Instruction byte [+2] at 0x0000000000401002: 0x90
Instruction byte [+3] at 0x0000000000401003: 0x90
rewind64> b 1
Instruction byte [+0] at 0x0000000000401000: 0x90

This view shows raw bytes in increasing execution address order, unlike the previous code/x command, which displays a full 64-bit word. It does not decode assembly mnemonics, infer instruction boundaries, or implement disassembly.

Safety and error handling

  • The count is optional (default 8) and must be one decimal digit 1–8. Other values, whitespace, signs, leading zeros or extra arguments are rejected without invoking ptrace or resuming the target.
  • Uses fresh PTRACE_GETREGS and exactly one PTRACE_PEEKTEXT call, with errno-safe handling when valid bytes are all 0xff.
  • Unreadable code reports a nonfatal diagnostic and returns to the prompt. Pending application signals are not injected by this inspection command.
  • No target memory/register modification, code patching, process attachment, breakpoint management, or unbounded memory dumping is performed.

Validation

142/142 Bash and native NASM integration tests passed on both Ubuntu 22.04 and Ubuntu 24.04, including 11 new cases for known NOP bytes, alias and counts, all-ones code, malformed arguments, combined code/batch stepping, compact output, pending SIGILL and input EOF. The release workflow also rebuilds and tests before packaging a native Linux x86-64 archive with a SHA-256 checksum file. The test/build path remains Python-free.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Other commands include step [1..16]/s, regs/r, status/i, code/x, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Limitations

Rewind64 remains experimental and forward-only. Linux x86-64, glibc, native NASM build, and ptrace permission are required. It is not a sandbox. Debug only targets you own or are authorized to inspect; code and memory inspection can reveal sensitive data. Windows/macOS, multiple tracees/threads, reverse execution, recording, replay, disassembly and breakpoints are not yet implemented.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Assets 4
Loading