kxxt · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026
diff --git a/README.md b/README.md
@@ -7,139 +7,18 @@ tracexec helps you to figure out what and how programs get executed when you exe
 It's useful for debugging build systems, understanding what shell scripts actually do, figuring out what programs
 does a proprietary software run, etc.
 
-- [Installation Guide](INSTALL.md)
-
-## Showcases
-
-### Perfetto Trace Export
-
-tracexec supports exporting exec traces to perfetto trace format,
-which could be viewed in the [Perfetto UI](https://ui.perfetto.dev/).
-The trace follows a tree format in the UI, where processes resulting from successful execs are represented as slices and exec failures are represented as instant events.
-
-The following video shows analyzing the build process of tracexec with itself:
-
-https://github.com/user-attachments/assets/fc825d55-eb2f-43cd-b454-a11b5f9b44bc
-
-The shape of the traces in the Perfetto UI could give you a rough idea of how
-parallel the build is at process-level. The trace tree and details of slices
-enable identification of bottlenecks, troubleshooting, and a deep understanding
-of how the build works.
-
-Start collecting a perfetto trace with the following command:
-
-```bash
-tracexec collect --format=perfetto -o out.pftrace -- cmd
-```
-
-### TUI mode with pseudo terminal
-
-TUI mode allocates a pseudo terminal by default, allowing you to view the details of exec events and interact
-with the processes within the pseudo terminal. Use `--no-tty` when a pseudo terminal is not wanted; the tracee's
-stdin, stdout, and stderr will be redirected to `/dev/null`.
-
-![TUI demo](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tui-demo.gif?raw=true)
-
-### Tracing setuid binaries
-
-With root privileges, you can also trace setuid binaries and see how they work.
-But do note that this is not compatible with seccomp-bpf optimization so it is much less performant.
-You can use eBPF mode which is more performant in such scenarios.
-
-```
-sudo tracexec --user $(whoami) tui -- sudo ls
-```
-
-![Tracing sudo ls](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tracing-sudo.png?raw=true)
-
-Nested setuid binary tracing is also possible: A real world use case is to trace `extra-x86_64-build`(Arch Linux's build tool that requires sudo):
-
-![Tracing extra-x86_64-build](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tracing-nested-setuid.gif?raw=true)
-
-In this real world example, we can easily see that `_FORTIFY_SOURCE` is redefined from `2` to `3`, which lead to a compiler error.
-
-### Use tracexec as a debugger launcher
-
-tracexec can also be used as a debugger launcher to make debugging programs easier. For example, it's not trivial or convenient
-to debug a program executed by a shell/python script(which can use pipes as stdio for the program). The following video shows how to
-use tracexec to launch gdb to detach two simple programs piped together by a shell script.
-
-https://github.com/kxxt/tracexec/assets/18085551/72c755a5-0f2f-4bf9-beb9-98c8d6b5e5fd
-
-Please [read the gdb-launcher example](demonstration/gdb-launcher/README.md) for more details.
-
-### eBPF mode
-
-Please check [platform support status](https://tracexec.kxxt.dev/support.html#linux-kernel-support-status) before using the eBPF backend.
-
-The following examples shows how to use eBPF in TUI mode.
-The `eBPF` command also supports regular `log` and `collect` subcommands.
-
-#### System-wide Exec Tracing
-
-System-wide tracing has no command to attach to a pseudo terminal, so it runs without one automatically:
+![One tracexec TUI view split diagonally between the built-in (A), Amber (B), and Nord (C) themes.](book/assets/tui-themes.png)
 
-```bash
-sudo -E tracexec ebpf tui
-```
-[ebpf-system-wide-tui.webm](https://github.com/user-attachments/assets/12cec4ef-8884-4580-a93a-c9144ec7102b)
-
-#### Follow Fork mode with eBPF
-
-```bash
-sudo -E tracexec --user $(whoami) ebpf tui -- bash
-```
-
-[ebpf-follow-forks.webm](https://github.com/user-attachments/assets/997e1992-df85-4d45-ae68-faf693c6b99b)
-
-### Log mode
-
-In log mode, by default, `tracexec` will print filename, argv and the diff of the environment variables and file descriptors.
-
-example: `tracexec log -- bash` (In an interactive bash shell)
-
-[![asciicast](https://asciinema.org/a/sNptWG6De3V5xwUvXJAxWlO3i.svg)](https://asciinema.org/a/sNptWG6De3V5xwUvXJAxWlO3i)
-
-### Reconstruct the command line with `--show-cmdline`
-
-```bash
-$ tracexec log --show-cmdline -- <command>
-# example:
-$ tracexec log --show-cmdline -- firefox
-```
-
-[![asciicast](https://asciinema.org/a/AWTG4iHaFPMcEGCVtqAl44YFW.svg)](https://asciinema.org/a/AWTG4iHaFPMcEGCVtqAl44YFW)
-
-### Try to reproduce stdio in the reconstructed command line
-
-`--stdio-in-cmdline` and `--fd-in-cmdline` can be used to reproduce(hopefully) the stdio used by a process.
-
-But do note that the result might be inaccurate when pipes, sockets, etc are involved.
-
-```bash
-tracexec log --show-cmdline --stdio-in-cmdline -- bash
-```
-
-[![asciicast](https://asciinema.org/a/NkBTaoNHS7P7bolO0hNuRwGlQ.svg)](https://asciinema.org/a/NkBTaoNHS7P7bolO0hNuRwGlQ)
-
-### Show the interpreter indicated by shebang with `--show-interpreter`
-
-And show the cwd with `--show-cwd`.
-
-```bash
-$ tracexec log --show-interpreter --show-cwd -- <command>
-# example: Running Arch Linux makepkg
-$ tracexec log --show-interpreter --show-cwd -- makepkg -f
-```
-
-[![asciicast](https://asciinema.org/a/7jDtrlNRx5XUnDXeDBsMRj09p.svg)](https://asciinema.org/a/7jDtrlNRx5XUnDXeDBsMRj09p)
+- [Documentation](https://tracexec.kxxt.dev/)
+- [Installation Guide](INSTALL.md)
+- [Showcases](https://tracexec.kxxt.dev/introduction/showcases.html)
 
 ## Usage
 
 General CLI help:
 
 ```bash
-Core crate of tracexec [Internal implementation! DO NOT DEPEND ON!]
+A small utility for tracing execve{,at} and pre-exec behavior.
 
 Usage: tracexec [OPTIONS] <COMMAND>
 
@@ -453,9 +332,7 @@ Example themes are available in the repository's `themes/` directory.
 ## Known issues
 
 - Non UTF-8 strings are converted to UTF-8 in a lossy way, which means that the output may be inaccurate.
-- For eBPF backend, it might be impossible to show some details of the tracee, See https://mozillazg.com/2024/03/ebpf-tracepoint-syscalls-sys-enter-execve-can-not-get-filename-argv-values-case-en.html
 - The output is not stable yet, which means that the output may change in the future.
-- Test coverage is not good enough.
 - The pseudo terminal can't pass through certain key combinations and terminal features.
 
 ## Origin

diff --git a/README.template.md b/README.template.md
@@ -7,132 +7,11 @@ tracexec helps you to figure out what and how programs get executed when you exe
 It's useful for debugging build systems, understanding what shell scripts actually do, figuring out what programs
 does a proprietary software run, etc.
 
-- [Installation Guide](INSTALL.md)
-
-## Showcases
-
-### Perfetto Trace Export
-
-tracexec supports exporting exec traces to perfetto trace format,
-which could be viewed in the [Perfetto UI](https://ui.perfetto.dev/).
-The trace follows a tree format in the UI, where processes resulting from successful execs are represented as slices and exec failures are represented as instant events.
-
-The following video shows analyzing the build process of tracexec with itself:
-
-https://github.com/user-attachments/assets/fc825d55-eb2f-43cd-b454-a11b5f9b44bc
-
-The shape of the traces in the Perfetto UI could give you a rough idea of how
-parallel the build is at process-level. The trace tree and details of slices
-enable identification of bottlenecks, troubleshooting, and a deep understanding
-of how the build works.
-
-Start collecting a perfetto trace with the following command:
-
-```bash
-tracexec collect --format=perfetto -o out.pftrace -- cmd
-```
-
-### TUI mode with pseudo terminal
-
-TUI mode allocates a pseudo terminal by default, allowing you to view the details of exec events and interact
-with the processes within the pseudo terminal. Use `--no-tty` when a pseudo terminal is not wanted; the tracee's
-stdin, stdout, and stderr will be redirected to `/dev/null`.
-
-![TUI demo](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tui-demo.gif?raw=true)
-
-### Tracing setuid binaries
-
-With root privileges, you can also trace setuid binaries and see how they work.
-But do note that this is not compatible with seccomp-bpf optimization so it is much less performant.
-You can use eBPF mode which is more performant in such scenarios.
-
-```
-sudo tracexec --user $(whoami) tui -- sudo ls
-```
-
-![Tracing sudo ls](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tracing-sudo.png?raw=true)
-
-Nested setuid binary tracing is also possible: A real world use case is to trace `extra-x86_64-build`(Arch Linux's build tool that requires sudo):
-
-![Tracing extra-x86_64-build](https://github.com/kxxt/tracexec/blob/v0.15.1/screenshots/tracing-nested-setuid.gif?raw=true)
-
-In this real world example, we can easily see that `_FORTIFY_SOURCE` is redefined from `2` to `3`, which lead to a compiler error.
-
-### Use tracexec as a debugger launcher
-
-tracexec can also be used as a debugger launcher to make debugging programs easier. For example, it's not trivial or convenient
-to debug a program executed by a shell/python script(which can use pipes as stdio for the program). The following video shows how to
-use tracexec to launch gdb to detach two simple programs piped together by a shell script.
-
-https://github.com/kxxt/tracexec/assets/18085551/72c755a5-0f2f-4bf9-beb9-98c8d6b5e5fd
-
-Please [read the gdb-launcher example](demonstration/gdb-launcher/README.md) for more details.
-
-### eBPF mode
-
-Please check [platform support status](https://tracexec.kxxt.dev/support.html#linux-kernel-support-status) before using the eBPF backend.
-
-The following examples shows how to use eBPF in TUI mode.
-The `eBPF` command also supports regular `log` and `collect` subcommands.
-
-#### System-wide Exec Tracing
+![One tracexec TUI view split diagonally between the built-in (A), Amber (B), and Nord (C) themes.](book/assets/tui-themes.png)
 
-System-wide tracing has no command to attach to a pseudo terminal, so it runs without one automatically:
-
-```bash
-sudo -E tracexec ebpf tui
-```
-[ebpf-system-wide-tui.webm](https://github.com/user-attachments/assets/12cec4ef-8884-4580-a93a-c9144ec7102b)
-
-#### Follow Fork mode with eBPF
-
-```bash
-sudo -E tracexec --user $(whoami) ebpf tui -- bash
-```
-
-[ebpf-follow-forks.webm](https://github.com/user-attachments/assets/997e1992-df85-4d45-ae68-faf693c6b99b)
-
-### Log mode
-
-In log mode, by default, `tracexec` will print filename, argv and the diff of the environment variables and file descriptors.
-
-example: `tracexec log -- bash` (In an interactive bash shell)
-
-[![asciicast](https://asciinema.org/a/sNptWG6De3V5xwUvXJAxWlO3i.svg)](https://asciinema.org/a/sNptWG6De3V5xwUvXJAxWlO3i)
-
-### Reconstruct the command line with `--show-cmdline`
-
-```bash
-$ tracexec log --show-cmdline -- <command>
-# example:
-$ tracexec log --show-cmdline -- firefox
-```
-
-[![asciicast](https://asciinema.org/a/AWTG4iHaFPMcEGCVtqAl44YFW.svg)](https://asciinema.org/a/AWTG4iHaFPMcEGCVtqAl44YFW)
-
-### Try to reproduce stdio in the reconstructed command line
-
-`--stdio-in-cmdline` and `--fd-in-cmdline` can be used to reproduce(hopefully) the stdio used by a process.
-
-But do note that the result might be inaccurate when pipes, sockets, etc are involved.
-
-```bash
-tracexec log --show-cmdline --stdio-in-cmdline -- bash
-```
-
-[![asciicast](https://asciinema.org/a/NkBTaoNHS7P7bolO0hNuRwGlQ.svg)](https://asciinema.org/a/NkBTaoNHS7P7bolO0hNuRwGlQ)
-
-### Show the interpreter indicated by shebang with `--show-interpreter`
-
-And show the cwd with `--show-cwd`.
-
-```bash
-$ tracexec log --show-interpreter --show-cwd -- <command>
-# example: Running Arch Linux makepkg
-$ tracexec log --show-interpreter --show-cwd -- makepkg -f
-```
-
-[![asciicast](https://asciinema.org/a/7jDtrlNRx5XUnDXeDBsMRj09p.svg)](https://asciinema.org/a/7jDtrlNRx5XUnDXeDBsMRj09p)
+- [Documentation](https://tracexec.kxxt.dev/)
+- [Installation Guide](INSTALL.md)
+- [Showcases](https://tracexec.kxxt.dev/introduction/showcases.html)
 
 ## Usage
 
@@ -202,9 +81,7 @@ Example themes are available in the repository's `themes/` directory.
 ## Known issues
 
 - Non UTF-8 strings are converted to UTF-8 in a lossy way, which means that the output may be inaccurate.
-- For eBPF backend, it might be impossible to show some details of the tracee, See https://mozillazg.com/2024/03/ebpf-tracepoint-syscalls-sys-enter-execve-can-not-get-filename-argv-values-case-en.html
 - The output is not stable yet, which means that the output may change in the future.
-- Test coverage is not good enough.
 - The pseudo terminal can't pass through certain key combinations and terminal features.
 
 ## Origin

diff --git a/book/SUMMARY.md b/book/SUMMARY.md
@@ -14,6 +14,7 @@
   - [Log Frontend](./features/log.md)
   - [TUI Frontend](./features/tui.md)
     - [Basics](./features/tui/basic.md)
+    - [Search](./features/tui/search.md)
     - [Event Details](./features/tui/details.md)
     - [Built-in Terminal and External Terminal](./features/tui/term.md)
     - [Backtrace](./features/tui/backtrace.md)

diff --git a/book/assets/ebpf-follow-forks-cover.jpg b/book/assets/ebpf-follow-forks-cover.jpg
diff --git a/book/assets/ebpf-system-wide-cover.jpg b/book/assets/ebpf-system-wide-cover.jpg
diff --git a/book/assets/tui-themes.png b/book/assets/tui-themes.png
diff --git a/book/build-from-src.md b/book/build-from-src.md
@@ -5,8 +5,8 @@ To build tracexec from source, the following dependencies are needed:
 - A working rust compiler and `cargo`.
   - Refer to `package.rust-version` in `Cargo.toml` for MSRV.
 - `libbpf`: if not using `vendored-libbpf`
-- `zlib`: if not using `vendored-zlib`
-- `libelf`: if not using `vendored-libbpf`
+- `zlib`: if not using `vendored`
+- `libelf`: if not using `vendored`
 - `libseccomp`: For `seccomp-bpf`.
 - If any library vendoring feature is enabled:
   - `build-essential` `autopoint` `gettext` for Debian based distros