PTTDB: Time-Travel Debugger

PTTDB is a low-level systems utility engineered to capture deterministic execution histories by tracking target processes instruction-by-instruction. It forks and traces binaries using raw ptrace(2) PTRACE_SINGLESTEP loops, logging the full processor register file at every instruction step alongside full-process memory snapshots reconstructed dynamically via periodic /proc/<pid>/mem checkpoints. Once recorded, debugging is entirely decoupled from execution, allowing backward and forward navigation by treating time-travel steps like a structured data cursor.

To safely intercept non-deterministic mutations like filesystem modifications, I built a feature called Total Kernel Virtualization. By trapping calls with PTRACE_SYSCALL at both entry and exit boundaries, the debugger captures full buffers for file I/O operations (open, read, pread64, close). During virtualized replays, file subsystem requests are systematically hijacked, rewriting active operations into harmless no-op primitives (getpid) while streaming the originally captured execution bytes directly into the caller's process allocation memory space. This lets you delete the real asset from disk entirely while the process still executes perfectly.

To tackle concurrent multi-threaded execution traces without corruption, the engine implements a custom round-robin single-instruction scheduler that actively enforces strict deterministic interleaving across pthreads captured via PTRACE_O_TRACECLONE hooks. Furthermore, the application is entirely dependency-free, implementing a custom ELF64 section parser to map memory function strings and a DWARF version 5 line-number state machine to map raw memory pointers down to source-level file and line symbols. It also incorporates x86_64 hardware debug registers (DR0-DR3) to capture exact per-instruction memory watchpoints for deep cross-thread data race analysis.