RewindNT

Deterministic record/replay for native Windows x64 programs.

RewindNT records selected external inputs, can force the same thread interleaving on replay, and can stop at an exact recorded instruction with the register state and a memory snapshot.

It is not a full replacement for WinDbg TTD or a Windows port of rr. v1 is deliberately scoped to one native process and the main executable module.

Quick start

$dr = .\scripts\fetch-dynamorio.ps1
$env:REWINDNT_DYNAMORIO_HOME = $dr

rewind record --instruction run.rwnt -- .\app.exe
rewind replay --instruction run.rwnt -- .\app.exe
rewind verify run.rwnt

--instruction is the precise mode. --strict schedules at basic-block boundaries and is much lighter.

Replay surface

The Win32 capture layer currently records:

• QueryPerformanceCounter
• GetSystemTimeAsFileTime
• GetTickCount64
• BCryptGenRandom
• synchronous ReadFile
• Sleep
• CreateThread

The DynamoRIO client handles CPU nondeterminism directly:

• RDTSC
• RDTSCP, including TSC_AUX
• RDRAND in 16/32/64-bit forms
• RDSEED in 16/32/64-bit forms

Strict recordings also capture direct application calls to these NT query syscalls and skip the kernel call during replay:

• NtQueryPerformanceCounter
• NtQueryTimerResolution

Syscall numbers are resolved from the active ntdll stubs. They are not hardcoded to one Windows build.

Exact replay points

seek replays to a scheduler step and prints the x64 integer/control context:

rewind seek run.rwnt 1000 -- .\app.exe

Example output:

step=1000
thread=0
module=b85c29683a16fece
offset=190d
rip=7ff75eba190d
rsp=5ba094f840
rflags=202
rax=5ba094f900
...

Recorded locations are module-relative, so normal ASLR does not invalidate a schedule.

Memory snapshots

A snapshot is an instruction replay stop plus the writable application memory that exists at that point:

rewind snapshot run.rwnt 1000 -- .\app.exe

The snapshot is written next to the trace as run.rwnt.snap.

rewind snapshot-info run.rwnt.snap
rewind snapshot-info run.rwnt.snap --regions
rewind snapshot-read run.rwnt.snap 0x0000005ba094f840 64

REWINDNT_SNAPSHOT_MAX_MB controls the snapshot cap. The default is 256 MiB; snapshots that hit the cap are marked as truncated.

Snapshots are for state inspection. RewindNT does not currently restore a process from a snapshot without replaying from the start.

Modes

# external-input tape only
rewind record run.rwnt -- app.exe

# main-module basic-block scheduling
rewind record --strict run.rwnt -- app.exe

# main-module instruction scheduling
rewind record --instruction run.rwnt -- app.exe

Replay uses the same option that was used to record.

A schedule mismatch stops the run instead of trying to force execution through a different path.

Trace files

A strict recording can contain three streams:

run.rwnt        external input events
run.rwnt.sched  thread schedule + CPU-instruction values
run.rwnt.sys    captured NT query results

rewind verify run.rwnt checks the headers, versions and record counts before replay.

Memory snapshots use a separate .snap format. The binary layouts are documented in docs/trace-format.md.

Build

Requirements:

• Windows 10/11 x64
• Visual Studio 2022 with the C++ workload
• CMake 3.24+

$dr = .\scripts\fetch-dynamorio.ps1
cmake -S . -B build -A x64 `
  -DREWINDNT_BUILD_DBI=ON `
  -DDynamoRIO_DIR="$dr\cmake"
cmake --build build --config RelWithDebInfo --parallel

Run the integration suite with:

$env:REWINDNT_DYNAMORIO_HOME = $dr
.\tests\ci.ps1

The tests cover external-input replay, a native unsynchronized data race, raw TSC instructions, hardware RNG instructions, direct NT query syscalls, exact seek, trace verification and memory snapshot reads.

Scope and limits

v1 targets native x64 console-style programs where the behavior of interest lives in the main executable. It does not claim deterministic replay for arbitrary Windows software.

Not covered yet:

• overlapped I/O, IOCP and APC completion ordering
• arbitrary syscall output buffers
• process trees and shared-memory coordination
• exception and kernel-to-user transfer replay
• restore-from-checkpoint acceleration
• GUI, DirectX or GPU state
• kernel drivers

Those are separate pieces of work rather than hidden behind a “works everywhere” claim.

Layout

src/       controller and CLI
hook/      Win32 input capture
dbi/       strict scheduler and NT syscall replay
include/   binary trace formats
demo/      small native repro programs
tests/     end-to-end Windows tests
scripts/   dependency and packaging helpers

docs/architecture.md describes the runtime. docs/prior-art.md covers the relationship to rr, WinDbg TTD and x64dbg.

License

MIT.