Skip to content

Rewind64 v0.2.8 (Linux x86-64 experimental)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 03:43
v0.2.8
342d6be
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rewind64 v0.2.8 — experimental Linux x86-64 prerelease

Explore execution. Trace every instruction. Understand the past.

This milestone adds a small in-memory history of observed instruction-pointer addresses. The debugger remains experimental, Linux x86-64 only and forward-only. This is not a reverse debugger or deterministic execution recorder.

New: history / h

From an interactive stop:

rewind64> step 2
...
rewind64> history
RIP history [0]: 0x0000000000401000
RIP history [1]: 0x0000000000401001
RIP history [2]: 0x0000000000401002
  • Records one RIP sample at the initial post-exec stop and after each verified single-step completion.
  • Displays up to 16 recent RIP samples oldest-first. As execution advances, the oldest entry is replaced in a fixed-size NASM circular buffer. No unbounded memory allocation or persistence.
  • Does not add entries for inspecting registers, code/bytes, memory, invalid commands or application signal-delivery stops. A step batch contributes one entry per confirmed step.
  • history and h never issue ptrace commands or resume the stopped tracee.
  • The stored data is only instruction addresses. It does not retain past memory, register sets, instruction operands, syscall results, signal delivery or enough information to rewind execution.

Validation

  • 152 Bash/native Assembly fixture tests passed on Ubuntu 22.04 and Ubuntu 24.04, including 10 new scenarios for exact RIP sequences, wrap-around after 16 samples, multiple wraps, pending signal stops and non-mutating inspection commands.
  • The release workflow rebuilds and tests before packaging the experimental Linux x86-64 archive and SHA-256 checksum file.
  • No Python files or Python build/test dependencies.

Usage

./rewind64 run --interactive /path/to/your/authorized/program
./rewind64 run --interactive --changes-only /path/to/your/authorized/program

Interactive commands include history/h, step [1..16]/s, regs/r, status/i, code/x, bytes [1..8]/b, stack/k, mem 0xHEX [1..4]/m, continue/c, help and quit/q.

Security and limitations

Only use Rewind64 on programs you own or have permission to debug. The debugger is not a security sandbox; process state and addresses may be sensitive. Linux ptrace permissions and container policy apply. There is no Windows/macOS backend, general multi-process/thread tracing, breakpoints, process attachment, reverse execution, recorded trace format, deterministic replay or stable release.

License: Boost Software License 1.0. Source: https://github.com/sanskarIN/Rewind64

Assets 4
Loading