crash-analysis

Load the dump in WinDbg on Windows or GDB with Pwndbg on Linux, then examine registers, the stack trace, and the faulting instruction. The skill provides a decision tree that picks the right tool based on platform and source availability.

Use WinDbg with TTD for Windows binaries and GDB with Pwndbg for Linux binaries. For non-deterministic crashes, use rr on Linux or Time Travel Debugging on Windows to record and replay execution.

ASAN halts via SIGABRT by default, which may skip core dump generation. Set ASAN_OPTIONS="abort_on_error=1:disable_coredump=0" and verify coredumpctl captures signal 6, or run under GDB to catch the abort.

Match the discovery environment exactly: OS and libc versions, ASLR state, argv, environment variables, and input path (stdin vs file vs network). The reproduction fidelity checklist and a 10-run test script verify whether the crash rate is reliable.

Assess exploitability by checking binary mitigations (PIE, canary, RELRO), analyzing whether attacker input controls registers or the instruction pointer, and confirming reachability from attacker-controlled input. CASR can automate classification for large crash corpora.

Use CASR clustering or stack hashing to group duplicate crashes, then minimize individual inputs with afl-tmin or manual reduction. This reduces thousands of crashes to a small set of unique, minimal reproducers.