rr — authorized record/replay debugger

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

rr (rr-debugger/rr) is a Linux record/replay debugger. Release 5.10.0 (2026-10-15 UTC) was the latest non-prerelease on 2026-10-24. License is MIT-style per upstream LICENSE (GitHub often shows NOASSERTION). Record only programs and hosts you are authorized to instrument.

On this page

Snapshot

FieldValue
LicenseMIT-style (LICENSE; GitHub often NOASSERTION)
Latest checked5.10.0 (2026-10-15 UTC)
JobRecord once, replay under GDB-compatible debugging
Stars (order of magnitude)~10.7k on GitHub (counts change daily)
PeersGDB/LLDB, edb, pwndbg/GEF

Allowed framing

  • Deterministic debugging of your Linux builds and services.
  • Classroom labs with owned VMs and clear rollback.
  • IR research on disposable hosts your org owns.

Scope we will not cover

  • No anti-cheat / DRM / license-check bypass recipes.
  • No “undetectable cheat” framing.
  • No remote recording of systems without authorization.

Beginner path (authorized only)

  1. Prefer a disposable Linux lab VM; check CPU/performance-counter requirements in upstream docs.
  2. Install from official rr-debugger/rr Releases or your distro package when policy allows.
  3. Record a tiny program you built before touching IR samples.
  4. Replay under rr replay / GDB remote; keep the trace next to case hashes.
  5. Fall back to ordinary GDB when a single attach is enough.
Which to pick
  • Choose rr when you need deterministic replay on Linux hosts you control.
  • Prefer classic GDB for ordinary one-shot debugging.
  • Refuse anti-cheat and DRM bypass framing.

For legal, authorized and educational use only.

FAQ

What is rr?

rr is a record-and-replay debugger for Linux that records a process (and its children) once, then lets you replay the same execution under GDB-compatible debugging as many times as you need.

Which version is cited?

5.10.0 published 2026-10-15 UTC on rr-debugger/rr Releases (latest non-prerelease checked 2026-10-24).

What license applies?

Upstream LICENSE is an MIT-style grant (Mozilla Foundation and contributors). GitHub often reports NOASSERTION for SPDX — read LICENSE in the tree you pin (checked 2026-10-24).

GDB or rr?

Prefer plain GDB/LLDB for one-shot attach sessions. Prefer rr when a hard-to-reproduce bug needs deterministic replay on a Linux lab host you control.

Does this teach game anti-cheat bypass?

No. Authorized debugging and education only — no anti-cheat, DRM or authenticity bypass.

Sources