skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

crash-analysis

Analyzes crash dumps and assesses exploitability using WinDbg, GDB, and sanitizers.

Updated Sep 17, 2026
Search Tags:#vulnerability research#gdb#fuzzing#exploitability#asan#crash analysis#windbg
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill crash-analysis-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: crash-analysis
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-crash-analysis
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill crash-analysis-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Fuzzing and patch diffing produce raw crashes, but determining whether a crash is a real, exploitable vulnerability requires systematic triage. This Skill provides a structured methodology for crash analysis, debugger usage, and exploitability assessment so findings are not lost or misclassified. ## Core Features & Use Cases - Crash Triage Decision Tree: Routes any crash to the right tooling based on source availability, platform (Windows/Linux/mobile), and crash type, covering WinDbg, GDB/Pwndbg, rr, TTD, and CASR. - Sanitizer Interpretation: Explains how to read ASAN, UBSAN, and MSAN reports, configure core dumps, and achieve reproduction fidelity across environments. - Exploitability Assessment: Guides register/stack trace analysis, mitigation checks, control-flow analysis, crash deduplication, minimization with afl-tmin, and PoC creation with pwntools. - Use Case: After AFL++ produces a corpus of crashing inputs against a C target, use this Skill to reproduce each crash reliably, classify it with CASR, deduplicate by stack hash, minimize the input, and determine whether the bug is an exploitable heap overflow or a benign null dereference. ## Quick Start Ask the assistant to analyze a crash dump or sanitizer report from your fuzzing campaign and assess whether the underlying bug is exploitable.

Frequently Asked Questions about crash-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a crash dump from fuzzing?▼

First verify reproduction fidelity by matching OS, libc, input path, and build configuration between fuzzing and analysis environments. Then open the crash in GDB with Pwndbg on Linux or WinDbg on Windows, examine registers and the stack trace, and classify the fault type.

What is the difference between ASAN and GDB for crash analysis?▼

ASAN is a compile-time sanitizer that reports detailed memory error information including allocation and free stack traces, while GDB is a runtime debugger for inspecting program state at crash time. Use ASAN when source is available and GDB for binaries or core dumps.

How do I know if a crash is exploitable?▼

Assess exploitability by checking whether the attacker controls the faulting register or corrupted memory, reviewing active mitigations like ASLR, stack canaries, and NX, and confirming reachability from attacker-controlled input. Tools like CASR automate crash classification.

Why does my fuzzer crash not reproduce locally?▼

Non-reproducing crashes usually come from environment mismatches: different input paths (stdin versus file argument), ASLR state, allocator behavior, or missing environment variables. Use the reproduction fidelity checklist and tools like rr or TTD for non-deterministic crashes.

How do I deduplicate and minimize a large crash corpus?▼

Cluster crashes by stack hash or use CASR classification to group duplicates sharing the same root cause. Then minimize individual inputs with afl-tmin or manual reduction while verifying the crash still triggers reliably.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

performing-fuzzing-with-aflplusplus

Automate coverage-guided fuzzing of compiled binaries with AFL++.

Community
Advanced
dslsdzcdslsdzc
64

re-exploit

Develops ROP chains and heap exploitation primitives from triaged vulnerability crashes.

Community
Advanced
bpnrockstarbpnrockstar

reverse-engineering

Reverse-engineer closed-source binaries and firmware via static and dynamic analysis.

Community
Advanced
riparinoriparino
1

offensive-bug-identification

Identify and classify software vulnerabilities across source, binary, and runtime contexts.

Community
Advanced