GhostScope v0.1.5

Overview

GhostScope v0.1.5 focuses on making DWARF-backed tracing more expressive and more reliable on optimized binaries.

This release builds on the optimized-build work from v0.1.4 and expands what GhostScope can recover safely from real-world C binaries with debug information. It introduces DWARF-backed casts, debuginfod support, richer dry-run trace plans, better optimized-code value recovery, and several runtime reliability improvements for hot trace paths.

Highlights

• Added DWARF-backed cast support so scripts can inspect memory using explicit source-level types
• Added dry-run trace plan details, making it easier to see resolved targets, visible variables, and planned reads before attaching probes
• Added debuginfod integration for fetching separated debug information and source files by build ID
• Expanded the scripting language with modulo and bitwise expressions
• Strengthened optimized-build tracing with better C integer promotions, signed/unsigned scalar comparisons, DW_OP_piece handling, implicit pointer support, inline entry PCs, and executable static TLS variables
• Improved source, module, and address resolution for combined -t -p sessions, symlinked targets, module-scoped completions, duplicate line rows, and cross-CU DWARF references
• Improved runtime behavior under hot event load with bounded output batches, TUI trace-drop reporting, eBPF output-loss reporting, and bounded sysmon queues
• Improved sysmon and pinned-map handling through newer aya support, helper probing, target-mode sysmon fixes, and stronger pinned-map operations
• Expanded DWARF semantic and optimized-runtime test coverage so regressions in value recovery are easier to catch

Bug Fixes

This release also includes a broad set of correctness and reliability fixes across the tracing pipeline, including:

• Fixed signed and unsigned scalar comparison behavior in optimized C traces
• Fixed C scalar conversion handling across compile lowering
• Fixed dynamic index address expressions
• Fixed compressed DWARF section loading
• Fixed text symbol alias resolution in function lookup
• Fixed optimized inline entry PC handling
• Fixed duplicate DWARF line-row handling and range-bounded source lookup
• Fixed DWARF references across compile units
• Fixed short-lived -t executable target handling
• Fixed script hangs under hot event load
• Fixed pinned-map BTF layout and sysmon pinned-map operations
• Fixed target-mode sysmon enablement
• Rejected top-level non-trace script statements with clearer errors
• Replaced several compiler unwrap paths with fallible errors

What's Next

Next, I plan to focus on implementing a backtrace command built on GhostScope's DWARF-aware tracing pipeline.

That work will continue to improve optimized-code value recovery, dry-run diagnostics, and unsupported-value reporting, because reliable stack unwinding depends on being able to explain what GhostScope can and cannot recover safely before probes are attached.

GhostScope v0.1.4

Overview

GhostScope v0.1.4 focuses on improving DWARF analysis performance and making source-aware tracing much more reliable on highly optimized C binaries.

This release strengthens GhostScope's ability to trace real-world C production builds, especially binaries built with -O1, -O2, -O3, and debug information. It significantly reduces startup indexing overhead, improves fast-path DWARF parsing, expands optimized inline parameter recovery, and adds stronger DW_AT_entry_value handling for optimized compiler output.

Highlights

• Improved startup indexing time by optimizing DWARF fast-path parsing and reducing repeated analysis work
• Improved DWARF analysis performance by using faster parser traversal paths and sharing parsed symbol-name data
• Established benchmark history tracking for DWARF performance so future indexing regressions are easier to catch
• Expanded performance regression coverage with broader DWARF perf baselines
• Significantly strengthened optimized-build tracing for -O1, -O2, and -O3 binaries with debug info
• Improved recovery of inline function parameters, caller values, and optimized-away variables
• Added stronger DW_AT_entry_value support for both inline and non-inline call paths
• Improved DWARF5 support, including rnglistx, split function ranges, and debug_addr entry PC handling
• Improved function lookup reliability through better demangling and symbol-fragment matching
• Hardened global/static variable access, bitfield chains, dereference reads, and aggregate member handling
• Improved PID/module matching in container, overlayfs, and complex proc-maps environments

Bug Fixes

This release also includes a broad set of correctness and reliability fixes across the tracing pipeline, including:

• Fixed PID offset prefill behavior before uprobe attachment
• Fixed multiple optimized inline parameter recovery edge cases
• Fixed non-inline entry-value recovery at runtime
• Fixed DWARF5 range-list and split-range lookup issues
• Fixed runtime DWARF endianness handling
• Fixed direct aggregate member scanning to avoid incorrect recursive matches
• Hardened unsupported DWARF expression handling to fail closed instead of producing misleading results
• Improved overlayfs inode fallback and module identity matching

What's Next

Next, I plan to continue refactoring the DWARF modules, expand test coverage, improve support for highly optimized compiler output, and provide clearer error messages when GhostScope cannot recover a value safely.

These efforts will lay the groundwork for future stack unwinding support and broader programming language support.

GhostScope v0.1.3

Overview

GhostScope v0.1.3 focuses on making source-aware tracing easier to use, especially from the command line and in AI-assisted workflows.

This release significantly improves the CLI experience and introduces installable GhostScope skills, making it much easier to use AI to write GhostScope tracing scripts from source trees, DWARF-enabled binaries, and runtime context. Alongside that, we continued expanding Docker support, strengthened inline and DWARF handling, and fixed a number of important correctness and usability issues.

Highlights

• Improved CLI script-mode usability with better output formatting, color controls, and clearer status reporting
• Added embedded --script-help so scripting help is available directly from the ghostscope binary
• Introduced installable GhostScope skills and curl-based installation
• Made AI-assisted tracing workflows much more practical, helping users generate GhostScope scripts more easily
• Expanded Docker and container support. See the Container Guide for PID namespace behavior, supported topologies, and current limitations.
• Strengthened inline handling and DWARF resolution in optimized and origin-backed cases

Bug Fixes

This release also includes a broad set of fixes across the tracing pipeline, including:

• Better error reporting for print builtin failures via ExprError
• Cleaner separation between script output and status prompts
• Fixes for scalar DWARF expression capture lengths
• Correct trace event PID/TID ordering
• .bss rebasing fixes and stronger global/static variable handling
• Multiple DWARF and inline resolution fixes for optimized and edge-case builds

Thanks

Special thanks to @philipc for helping upgrade gimli and for identifying a critical bug that helped drive several of the DWARF correctness improvements in this release.

What's Next

Next, I will continue focusing on:

• Improving DWARF analysis stability
• Reducing startup-time overhead, especially during the initial DWARF analysis phase

If that work goes well, I plan to start exploring a new backtrace command built on eBPF-powered, DWARF-aware stack unwinding.

GhostScope v0.1.1-beta

What's changed

• Release binaries no longer depend on the libffi dynamic library, making deployments lighter.
• Enhanced scripting language with more user-friendly error messages.
• Improved -t mode with support for probing global variables.
• Better inline-function support: trace/info output now includes address indices and inline markers.
• UI/tooling upgrades: source panel can be hidden via configuration, command parsing is more robust, and long trace messages auto-collapse.
• Numerous bug fixes😁.

Quick Start: See our Tutorial to get started in 10 minutes.

Limitations and Constraints: please see Limitations Documentation.

GhostScope v0.1.0-beta

Overview

GhostScope is a runtime tracing tool that brings the simplicity of printf debugging to production systems. It leverages DWARF debug information and eBPF/uprobe technology to safely extract and display variable values, function arguments, complex data structures, and stack backtraces from running programs — all without stopping or modifying them.

"The most effective debugging tool is still careful thought, coupled with judiciously placed print statements." — Brian Kernighan

Quick Start: See our Tutorial to get started in 10 minutes.

---

⚠️ Beta Release Notice

This is a beta release for early testing and feedback.

Known Limitations

• Language: Currently supports C language only. C++ and Rust basic features support coming soon.
• Platform: x86_64 (amd64) only.
• Optimized Builds: Detection is limited for heavily optimized binaries (e.g., -O2/-O3, LTO). Support is in progress and will improve in upcoming releases

For a complete list of current limitations and constraints, please see Limitations Documentation.