Crate crashrustler 

CrashRustler: macOS crash report capture and analysis.

This crate provides a Rust equivalent of CrashWrangler’s CrashReport Objective-C class, capturing all the state needed to represent a macOS crash report including process information, exception details, thread backtraces, binary image mappings, and crash analysis metadata.

Key Types

• CrashRustler — The main crash report struct holding all crash state.
• ExceptionType — Mach exception types (e.g., EXC_BAD_ACCESS).
• CpuType — CPU architecture constants (x86, ARM, PowerPC).
• BinaryImage — A loaded binary image in the crashed process.

Example

use crashrustler::{CrashRustler, CpuType};

let mut cr = CrashRustler::default();
cr.cpu_type = CpuType::ARM64;
cr.is_64_bit = true;
cr.exception_type = 1; // EXC_BAD_ACCESS
cr.signal = 11; // SIGSEGV

assert_eq!(cr.exception_type_description(), "EXC_BAD_ACCESS");
assert_eq!(cr.signal_name(), "SIGSEGV");
assert_eq!(cr.short_arch_name(), "arm64");

Modules

exploitability

unwind

Stack unwinding infrastructure for macOS crash reports.

Structs

BacktraceFrame

Represents a single frame in a backtrace.

BinaryImage

Represents a binary image loaded in the crashed process.

CpuType

CPU type constants mirroring mach/machine.h

CrashParams

Pre-gathered crash data passed to CrashRustler::new(). The binary (exc_handler) is responsible for all Mach/system calls; this struct carries the results to the library’s pure-data constructor.

CrashRustler

CrashRustler: Rust equivalent of CrashWrangler’s CrashReport Objective-C class.

ExceptionState

Exception state from the faulting thread.

ExternalModInfo

External modification information.

MappedMemory

Represents a mapped region of process memory for pointer reads. Used by _readAddressFromMemory:atAddress: to read pointer-sized values from a pre-mapped buffer without additional Mach VM calls.

ThreadBacktrace

Represents the backtrace of a single thread.

ThreadState

Thread state register values.

VmRegion

VM region information for the crash report.

WorkQueueLimits

Work queue limits extracted from the process.

Enums

AccessType

Memory access type for the crashing instruction.

ExceptionType

Mach exception types mirroring mach/exception_types.h

ExploitabilityRating

Exploitability classification of a crash. Matches CrashWrangler’s exit code semantics: signal = not exploitable, signal+100 = exploitable.

PlistValue

Heterogeneous plist value type for dictionary/plist output methods. Mirrors the NSObject types used in CrashReport’s NSDictionary outputs.