Struct CrashRustler 

pub struct CrashRustler {

    pub pid: i32,
    pub ppid: i32,
    pub uid: u32,
    pub task: u32,
    pub process_name: Option<String>,
    pub executable_path: Option<String>,
    pub parent_process_name: Option<String>,
    pub parent_executable_path: Option<String>,
    pub responsible_process_name: Option<String>,
    pub r_process_pid: i32,
    pub date: Option<String>,
    pub exception_type: i32,
    pub exception_code: Vec<i64>,
    pub exception_code_count: u32,
    pub signal: u32,
    pub crashing_address: u64,
    pub thread: u32,
    pub thread_id: Option<u64>,
    pub crashed_thread_number: i32,
    pub thread_state: ThreadState,
    pub exception_state: ExceptionState,
    pub thread_exception_state: Vec<u32>,
    pub thread_exception_state_count: u32,
    pub backtraces: Vec<ThreadBacktrace>,
    pub cpu_type: CpuType,
    pub is_64_bit: bool,
    pub is_native: bool,
    pub architecture: u64,
    pub binary_images: Vec<BinaryImage>,
    pub binary_image_hints: Vec<String>,
    pub binary_uuid: Option<String>,
    pub current_binary_image: Option<String>,
    pub attempted_binary_images: HashSet<String>,
    pub binary_image_error_count: u32,
    pub binary_image_post_processing_complete: bool,
    pub completed_all_binary_images: bool,
    pub max_binary_identifier_length: u32,
    pub environment: HashMap<String, String>,
    pub notes: Option<String>,
    pub process_version_dictionary: HashMap<String, String>,
    pub build_version_dictionary: HashMap<String, String>,
    pub os_version_dictionary: HashMap<String, String>,
    pub adam_id: Option<String>,
    pub software_version_external_identifier: Option<String>,
    pub reopen_path: Option<String>,
    pub ls_application_information: Option<HashMap<String, String>>,
    pub has_receipt: bool,
    pub is_translocated_process: bool,
    pub application_specific_info: Option<String>,
    pub application_specific_backtraces: Vec<String>,
    pub application_specific_signature_strings: Vec<String>,
    pub application_specific_dialog_mode: Option<String>,
    pub internal_error: Option<String>,
    pub rosetta_info: Option<String>,
    pub dyld_error_string: Option<String>,
    pub dyld_error_info: Option<String>,
    pub extract_legacy_dyld_error_string: bool,
    pub fatal_dyld_error_on_launch: bool,
    pub exec_failure_error: Option<String>,
    pub cs_status: u32,
    pub code_sign_invalid_messages_description: Option<String>,
    pub ext_mod_info: ExternalModInfo,
    pub awake_system_uptime: u64,
    pub sleep_wake_uuid: Option<String>,
    pub sandbox_container: Option<String>,
    pub vm_map_string: Option<String>,
    pub vm_summary_string: Option<String>,
    pub objc_selector_name: Option<String>,
    pub third_party_bundle_path: Option<String>,
    pub anon_uuid: Option<String>,
    pub performing_autopsy: bool,
    pub executable_path_needs_correction: bool,
    pub process_name_needs_correction: bool,
    pub in_update_previous_os_build: Option<String>,
    pub item_info_record: Option<Vec<u8>>,
    pub exit_snapshot: Option<Vec<u8>>,
    pub exit_snapshot_length: u32,
    pub exit_payload: Option<Vec<u8>>,
    pub exit_payload_length: u32,
    pub work_queue_limits: Option<WorkQueueLimits>,
    pub terminator_pid: i32,
    pub terminator_proc: Option<String>,
    pub terminator_reason: Option<String>,
}

CrashRustler: Rust equivalent of CrashWrangler’s CrashReport Objective-C class.

This struct captures all the state needed to represent a macOS crash report, including process information, exception details, thread backtraces, binary image mappings, and crash analysis metadata.

Fields

pid: i32

Process ID of the crashed process.

ppid: i32

Parent process ID.

uid: u32

User ID of the crashed process.

task: u32

Mach task port for the crashed process.

process_name: Option<String>

Name of the crashed process (derived from executable path).

executable_path: Option<String>

Full path to the crashed process executable.

parent_process_name: Option<String>

Name of the parent process.

parent_executable_path: Option<String>

Full path to the parent process executable.

responsible_process_name: Option<String>

Name of the responsible process (may differ from parent).

r_process_pid: i32

PID of the responsible process (responsibility_get_pid_responsible_for_pid).

date: Option<String>

Crash date as a formatted string.

exception_type: i32

Mach exception type (e.g., 1 = EXC_BAD_ACCESS).

exception_code: Vec<i64>

Mach exception codes (architecture-specific sub-codes).

exception_code_count: u32

Number of valid exception codes.

signal: u32

POSIX signal number (e.g., 11 = SIGSEGV).

crashing_address: u64

Virtual address that caused the crash (for EXC_BAD_ACCESS).

thread: u32

Mach thread port of the crashing thread.

thread_id: Option<u64>

Thread ID from thread_identifier_info or crash annotations.

crashed_thread_number: i32

Index of the crashed thread in backtraces, or -1 if unknown.

thread_state: ThreadState

Register state of the crashed thread.

exception_state: ExceptionState

Exception state from the faulting thread.

thread_exception_state: Vec<u32>

Raw exception state registers (architecture-specific).

thread_exception_state_count: u32

Number of valid words in thread_exception_state.

backtraces: Vec<ThreadBacktrace>

Backtraces for all threads in the crashed process.

cpu_type: CpuType

CPU type of the crashed process.

is_64_bit: bool

Whether the process is 64-bit.

is_native: bool

Whether the process runs natively (not under Rosetta translation).

architecture: u64

Raw architecture value from the Mach-O header.

binary_images: Vec<BinaryImage>

All binary images loaded in the crashed process.

binary_image_hints: Vec<String>

Binary image hints from ___crashreporter_binary_image_hints__.

binary_uuid: Option<String>

UUID of the main executable binary.

current_binary_image: Option<String>

Name of the binary image currently being processed.

attempted_binary_images: HashSet<String>

Set of binary image keys already processed (for deduplication).

binary_image_error_count: u32

Count of errors encountered during binary image processing.

binary_image_post_processing_complete: bool

Whether binary image post-processing (sorting, enrichment) is done.

completed_all_binary_images: bool

Whether all binary images have been enumerated.

max_binary_identifier_length: u32

Longest binary identifier string length (for formatting alignment).

environment: HashMap<String, String>

Environment variables of the crashed process.

notes: Option<String>

Crash report notes (e.g., translocated process, OS update).

process_version_dictionary: HashMap<String, String>

Process version info (CFBundleShortVersionString, CFBundleVersion).

build_version_dictionary: HashMap<String, String>

Build version info (ProjectName, SourceVersion, BuildVersion).

os_version_dictionary: HashMap<String, String>

OS version info (ProductVersion, BuildVersion, ProductName).

adam_id: Option<String>

App Store Adam ID.

software_version_external_identifier: Option<String>

App Store software version external identifier.

reopen_path: Option<String>

Path used to reopen/relaunch the application.

ls_application_information: Option<HashMap<String, String>>

Launch Services application information dictionary. Contains keys such as CFBundleIdentifier and display name.

has_receipt: bool

Whether the application has an App Store receipt.

is_translocated_process: bool

Whether the process was running from a translocated path.

application_specific_info: Option<String>

Application-specific crash info from ___crashreporter_info__ or __crash_info.

application_specific_backtraces: Vec<String>

Application-specific backtrace strings from crash annotations.

application_specific_signature_strings: Vec<String>

Application-specific signature strings for crash grouping.

application_specific_dialog_mode: Option<String>

Dialog mode hint from crash annotations (version 4+).

internal_error: Option<String>

Accumulated internal error messages.

rosetta_info: Option<String>

Rosetta translation thread info (for non-native processes).

dyld_error_string: Option<String>

Dyld error string (from dyld_all_image_infos or __crash_info).

dyld_error_info: Option<String>

Additional dyld error info for presignature.

extract_legacy_dyld_error_string: bool

Whether to attempt legacy dyld error string extraction.

fatal_dyld_error_on_launch: bool

Whether a fatal dyld error occurred on launch.

exec_failure_error: Option<String>

Exec failure error (set when ___NEW_PROCESS_COULD_NOT_BE_EXECD___ is detected).

cs_status: u32

Code signing status flags (bit 0x1000000 = CS_KILLED).

code_sign_invalid_messages_description: Option<String>

Description of code signing invalidity messages.

ext_mod_info: ExternalModInfo

External modification info (task_for_pid callers, injected libraries).

awake_system_uptime: u64

System uptime (awake time) at crash, in seconds.

sleep_wake_uuid: Option<String>

Sleep/wake UUID for correlating crashes with sleep events.

sandbox_container: Option<String>

Sandbox container path for the crashed process.

vm_map_string: Option<String>

Human-readable VM region map of the crashed process.

vm_summary_string: Option<String>

Summary of VM region statistics.

objc_selector_name: Option<String>

ObjC selector name if the crash occurred in objc_msgSend*.

third_party_bundle_path: Option<String>

Path to a third-party bundle involved in the crash.

anon_uuid: Option<String>

Anonymous UUID for crash report deduplication.

performing_autopsy: bool

Whether this report is for a corpse (post-mortem) analysis.

executable_path_needs_correction: bool

Whether the executable path needs correction after resolution.

process_name_needs_correction: bool

Whether the process name needs correction after resolution.

in_update_previous_os_build: Option<String>

Previous OS build version if crash occurred during an OS update.

item_info_record: Option<Vec<u8>>

Raw item info record data from Launch Services.

exit_snapshot: Option<Vec<u8>>

Exit snapshot data from the process.

exit_snapshot_length: u32

Length of the exit snapshot data.

exit_payload: Option<Vec<u8>>

Exit payload data from the process.

exit_payload_length: u32

Length of the exit payload data.

work_queue_limits: Option<WorkQueueLimits>

Work queue thread limits hit at time of crash.

terminator_pid: i32

PID of the process that terminated this process.

terminator_proc: Option<String>

Name of the process that terminated this process.

terminator_reason: Option<String>

Reason string from the terminating process.

Implementations

impl CrashRustler

pub fn date(&self) -> Option<&str>

Returns the crash date. Equivalent to -[CrashReport date]

pub fn task(&self) -> u32

Returns the Mach task port. Equivalent to -[CrashReport task]

pub fn pid(&self) -> i32

Returns the process ID of the crashed process. Equivalent to -[CrashReport pid]

pub fn cpu_type(&self) -> CpuType

Returns the CPU type of the crashed process. Equivalent to -[CrashReport cpuType]

pub fn process_name(&self) -> Option<&str>

Returns the process name. Equivalent to -[CrashReport processName]

pub fn process_identifier(&self) -> Option<&str>

Returns the bundle identifier if available, otherwise the process name. Equivalent to -[CrashReport processIdentifier]

pub fn bundle_identifier(&self) -> Option<&str>

Returns the bundle identifier from ls_application_information. Equivalent to -[CrashReport bundleIdentifier] Retrieves CFBundleIdentifier from the LS application information dictionary.

pub fn display_name(&self) -> Option<&str>

Returns the display name of the application. Falls back to processName if the display name is not available. Equivalent to -[CrashReport displayName]

pub fn parent_process_name(&self) -> Option<&str>

Returns the parent process name. Equivalent to -[CrashReport parentProcessName]

pub fn responsible_process_name(&self) -> Option<&str>

Returns the responsible process name. Equivalent to -[CrashReport responsibleProcessName]

pub fn process_version_dictionary(&self) -> &HashMap<String, String>

Returns the process version dictionary, lazily populating it if needed. Contains keys “shortVersion” (CFBundleShortVersionString) and “version” (CFBundleVersion). Tries LS info, resource fork, then binary images. Equivalent to -[CrashReport processVersionDictionary]

pub fn app_build_version(&self) -> String

Returns the application build version (CFBundleVersion), sanitized to remove parentheses. Equivalent to -[CrashReport appBuildVersion]

pub fn app_version(&self) -> String

Returns the application short version string (CFBundleShortVersionString), sanitized to remove parentheses. Equivalent to -[CrashReport appVersion]

pub fn process_version(&self) -> String

Returns a formatted version string: “shortVersion (buildVersion)” or just the build version if no short version is available. Equivalent to -[CrashReport processVersion]

pub fn adam_id(&self) -> Option<&str>

Returns the App Store Adam ID. Equivalent to -[CrashReport adamID]

pub fn binary_uuid(&self) -> Option<&str>

Returns the UUID of the main binary. Equivalent to -[CrashReport binaryUUID]

pub fn executable_path(&self) -> Option<&str>

Returns the path to the executable. Equivalent to -[CrashReport executablePath]

pub fn reopen_path(&self) -> Option<&str>

Returns the reopen path. Falls back to executable_path if not set. Equivalent to -[CrashReport reopenPath]

pub fn is_dyld_error(&self) -> bool

Returns true if a dyld error string is present. Equivalent to -[CrashReport isDyldError]

pub fn environment(&self) -> &HashMap<String, String>

Returns the environment variable dictionary. Equivalent to -[CrashReport environment]

pub fn notes(&mut self) -> Vec<String>

Returns the notes array. Lazily populates with translocated process and OS update notes on first access. Equivalent to -[CrashReport notes]

pub fn is_translated(&self) -> bool

Returns true if the process is running under Rosetta translation. This is the inverse of is_native. Equivalent to -[CrashReport isTranslated]

pub fn is_user_visible_app(&self) -> bool

Determines if the crashed app is a user-visible foreground application. Checks against known background apps, exec failures, LSUIElement, LSBackgroundOnly, and CFBundlePackageType=XPC!. Equivalent to -[CrashReport isUserVisibleApp]

pub fn is_user_missing_library(&self) -> bool

Returns true if the crash is due to a missing user library. Requires: isDyldError AND path not under /System/ AND fatalDyldErrorOnLaunch. Equivalent to -[CrashReport isUserMissingLibrary]

pub fn allow_relaunch(&self) -> bool

Determines if the app should be offered a relaunch option. Returns false for excluded bundles, dyld errors, code sign kills, and WebProcess. Otherwise delegates to is_user_visible_app. Equivalent to -[CrashReport allowRelaunch]

pub fn sleep_wake_uuid(&self) -> &str

Returns the sleep/wake UUID, or empty string if not set. Equivalent to -[CrashReport sleepWakeUUID]

pub fn is_code_sign_killed(&self) -> bool

Returns true if the process was killed due to a code signing violation. Checks bit 0x1000000 (CS_KILLED) in cs_status. Equivalent to -[CrashReport isCodeSignKilled]

pub fn is_rootless_enabled(&self) -> bool

Returns true. Rootless (SIP) is always enabled on Sierra+. Equivalent to -[CrashReport isRootlessEnabled]

pub fn is_app_store_app(&self) -> bool

Returns true if the app has a receipt and an Adam ID (App Store app). Equivalent to -[CrashReport isAppStoreApp]

pub fn application_specific_dialog_mode(&self) -> Option<&str>

Returns the application-specific dialog mode. Equivalent to -[CrashReport applicationSpecificDialogMode]

pub fn set_thread(&mut self, thread: u32)

Sets the thread port and refreshes thread state. Equivalent to -[CrashReport setThread:]

pub fn set_current_binary_image(&mut self, image: Option<String>)

Sets the current binary image being processed. Equivalent to -[CrashReport setCurrentBinaryImage:]

pub fn sandbox_container(&self) -> Option<&str>

Returns the sandbox container path. Equivalent to -[CrashReport sandboxContainer]

pub fn set_sandbox_container(&mut self, path: Option<String>)

Sets the sandbox container path. Equivalent to -[CrashReport setSandboxContainer:]

impl CrashRustler

pub fn crashed_due_to_bad_memory_access(&self) -> bool

Returns true if the crash was due to a bad memory access. EXC_BAD_ACCESS (type 1) is a bad memory access UNLESS it’s a general protection fault (code 0xd) with address 0. Equivalent to -[CrashReport _crashedDueToBadMemoryAccess]

Examples

use crashrustler::{CrashRustler, CpuType};

let mut cr = CrashRustler::default();
cr.exception_type = 1; // EXC_BAD_ACCESS
cr.exception_code = vec![2, 0xdeadbeef];
assert!(cr.crashed_due_to_bad_memory_access());

// GPF with null address on x86 is NOT a bad memory access
cr.cpu_type = CpuType::X86_64;
cr.exception_code = vec![0xd, 0x0];
assert!(!cr.crashed_due_to_bad_memory_access());

pub fn extract_crashing_address(&mut self)

Extracts the crashing address from exception codes or exception state. For bad memory access: uses exception_code[1]. For code sign killed: extracts cr2 from exception state registers. Equivalent to the address extraction in -[CrashReport _extractVMMap]

pub fn sanitize_path(path: &str) -> String

Sanitizes a file path by replacing user-specific components. Replaces /Users/username/ with /Users/USER/ for privacy. Equivalent to _CRCopySanitizedPath used by -[CrashReport cleansePaths]

Examples

use crashrustler::CrashRustler;

assert_eq!(
    CrashRustler::sanitize_path("/Users/alice/Library/MyApp"),
    "/Users/USER/Library/MyApp"
);
assert_eq!(
    CrashRustler::sanitize_path("/System/Library/Frameworks/AppKit"),
    "/System/Library/Frameworks/AppKit"
);

pub fn cleanse_paths(&mut self)

Sanitizes all file paths in the crash report for privacy. Preserves original executable path as reopen_path before sanitizing. Sanitizes: executable_path, all binary image paths, VM map paths. Equivalent to -[CrashReport cleansePaths]

pub fn extract_work_queue_limits_from_flags( &mut self, flags: u32, wq_max_constrained_threads: Option<u32>, wq_max_threads: Option<u32>, )

Sets work queue limits from pre-queried sysctl values. Bit 0 of flags: constrained thread limit hit. Bit 1 of flags: total thread limit hit. The caller (exc_handler) is responsible for querying kern.wq_max_constrained_threads and kern.wq_max_threads. Equivalent to -[CrashReport _extractWorkQueueLimitsFromData:]

pub fn set_app_store_receipt( &mut self, adam_id: Option<String>, version_id: Option<String>, )

Reads the App Store receipt from the application bundle path. Sets has_receipt and adam_id if a valid receipt is found. Equivalent to -[CrashReport _readAppStoreReceipt]

pub fn problem_dictionary(&self) -> BTreeMap<String, PlistValue>

Builds the main problem dictionary for crash reporting. Populates ~40+ keys including app info, exception details, thread state, binary images, VM map, notes, timestamps, and more. Equivalent to -[CrashReport problemDictionary]

pub fn pre_signature_dictionary(&self) -> BTreeMap<String, PlistValue>

Builds a filtered dictionary for crash signature generation. Contains a subset of problem dictionary keys needed for signature matching. Filters thread plists and binary images to only referenced images. Equivalent to -[CrashReport preSignatureDictionary]

pub fn context_dictionary(&self) -> BTreeMap<String, PlistValue>

Builds a minimal context dictionary with date and sleep/wake UUID. Equivalent to -[CrashReport contextDictionary]

pub fn description_dictionary(&self) -> BTreeMap<String, PlistValue>

Combines problemDictionary, preSignatureDictionary, and contextDictionary into a single dictionary with keys “report”, “presignature”, “context”. Equivalent to -[CrashReport descriptionDictionary]

pub fn filtered_binary_image_for_presignature( &self, image: &BinaryImage, index: usize, ) -> BTreeMap<String, PlistValue>

Filters a binary image for presignature. If UUID exists, returns just index+uuid. Otherwise returns index + bundle metadata + path. Equivalent to -[CrashReport filteredBinaryImagePlistForPresignature:]

pub fn binary_images_plist(&self) -> Vec<BTreeMap<String, PlistValue>>

Converts binary images to plist format array. Equivalent to -[CrashReport _binaryImagesPlist]

pub fn rosetta_threads_plist(&self) -> Vec<BTreeMap<String, PlistValue>>

Parses rosettaInfo string into plist-compatible thread array. Splits by newlines, detects Thread headers with Crashed markers, parses hex address + image path + symbol/offset from each frame. Equivalent to -[CrashReport _rosettaThreadsPlist]

impl CrashRustler

pub fn add_binary_image(&mut self, image: BinaryImage) -> bool

Adds a binary image to the list. Deduplicates by checking attempted_binary_images. Sets current_binary_image to “name @ base_address” for tracking. Returns true if the image was added (not a duplicate). Equivalent to -[CrashReport _extractBinaryImageInfoFromSymbolOwner:withMemory:]

pub fn finalize_binary_images(&mut self)

Post-processes binary images: enriches metadata, sorts by base address, and assigns sequential indices. Called lazily on first access. Equivalent to the post-processing logic in -[CrashReport binaryImages]

pub fn binary_image_for_address(&self, address: u64) -> Option<&BinaryImage>

Finds the binary image containing the given address. Linear search: returns first image where base_address <= addr < end_address. Equivalent to -[CrashReport binaryImageDictionaryForAddress:]

pub fn binary_image_for_path(&self, path: &str) -> Option<&BinaryImage>

Finds the binary image with the given executable path. Equivalent to -[CrashReport binaryImageDictionaryForPath:]

pub fn format_binary_image_line( &self, image: &BinaryImage, force_64bit: bool, ) -> String

Formats a single binary image line for the crash report. Format: startAddr - endAddr [+]identifier version <UUID> path Apple images get “+” prefix. 32-bit uses 10-digit hex, 64-bit uses 18-digit. Equivalent to -[CrashReport _appendToDescription:binaryImageDict:force64BitMode:]

pub fn binary_images_description(&self) -> String

Formats all binary images as a human-readable crash report section. Equivalent to -[CrashReport binaryImagesDescription]

pub fn add_thread_backtrace(&mut self, backtrace: ThreadBacktrace)

Adds a thread backtrace from sampled data. Determines crashed thread by matching thread port or thread ID. Detects special crash patterns: exec failure (NEW_PROCESS_COULD_NOT_BE_EXECD), ObjC messaging crashes (objc_msgSend*), dyld fatal errors, and SIGABRT in abort/__abort. Equivalent to -[CrashReport _extractBacktraceInfoUsingSymbolicator:]

pub fn backtrace_description(&self) -> String

Formats all thread backtraces as human-readable crash report text. Each thread: “Thread N:” or “Thread N Crashed:”. Each frame: “frameNum identifier address symbolName + offset” Uses 10-digit hex for 32-bit, 18-digit for 64-bit addresses. Equivalent to -[CrashReport backtraceDescription]

pub fn thread_state_description(&self) -> String

Formats the crashed thread’s register state as human-readable text. Supports x86_THREAD_STATE (flavor 7) with 32/64-bit sub-flavors, x86_THREAD_STATE32 (flavor 1 on x86), ARM_THREAD_STATE64 (flavor 6), and ARM_THREAD_STATE (flavor 1 on ARM with sub-flavor dispatch). Equivalent to -[CrashReport threadStateDescription]

impl CrashRustler

pub fn signal_name(&self) -> String

Returns the human-readable POSIX signal name for the crash signal. Maps signals 0-31 to their standard names (SIGHUP, SIGINT, etc.). Unknown signals are formatted as “Signal N”. Equivalent to -[CrashReport signalName]

Examples

use crashrustler::CrashRustler;

let mut cr = CrashRustler::default();
cr.signal = 11;
assert_eq!(cr.signal_name(), "SIGSEGV");

cr.signal = 6;
assert_eq!(cr.signal_name(), "SIGABRT");

cr.signal = 99;
assert_eq!(cr.signal_name(), "Signal 99");

pub fn exception_type_description(&self) -> String

Returns the human-readable Mach exception type name. Maps standard exception types 1-13 to names like EXC_BAD_ACCESS. Unknown types are formatted as hex. Equivalent to -[CrashReport exceptionTypeDescription]

Examples

use crashrustler::CrashRustler;

let mut cr = CrashRustler::default();
cr.exception_type = 1;
assert_eq!(cr.exception_type_description(), "EXC_BAD_ACCESS");

cr.exception_type = 6;
assert_eq!(cr.exception_type_description(), "EXC_BREAKPOINT");

pub fn exception_codes_description(&self) -> String

Returns a human-readable description of the exception codes. For EXC_BAD_ACCESS: maps code[0] to KERN_PROTECTION_FAILURE or KERN_INVALID_ADDRESS with the faulting address from code[1]. For EXC_ARITHMETIC: maps code[0]=1 to EXC_I386_DIV. Otherwise formats all codes as hex values joined by commas. Equivalent to -[CrashReport exceptionCodesDescription]

Examples

use crashrustler::{CrashRustler, CpuType};

let mut cr = CrashRustler::default();
cr.exception_type = 1; // EXC_BAD_ACCESS
cr.exception_code = vec![2, 0x7fff_dead_beef]; // KERN_PROTECTION_FAILURE
assert_eq!(
    cr.exception_codes_description(),
    "KERN_PROTECTION_FAILURE at 0x00007fffdeadbeef"
);

cr.exception_code = vec![1, 0x0]; // KERN_INVALID_ADDRESS
assert_eq!(
    cr.exception_codes_description(),
    "KERN_INVALID_ADDRESS at 0x0000000000000000"
);

pub fn cpu_type_description(&self) -> String

Returns the CPU type as a human-readable string. Maps: X86, PPC, X86-64, PPC-64, or hex for unknown. Equivalent to -[CrashReport _cpuTypeDescription]

Examples

use crashrustler::{CrashRustler, CpuType};

let mut cr = CrashRustler::default();
cr.cpu_type = CpuType::ARM64;
assert_eq!(cr.cpu_type_description(), "ARM-64");
assert_eq!(cr.short_arch_name(), "arm64");

cr.cpu_type = CpuType::X86_64;
assert_eq!(cr.cpu_type_description(), "X86-64");
assert_eq!(cr.short_arch_name(), "x86_64");

pub fn short_arch_name(&self) -> String

Returns the short architecture name for the CPU type. Maps: i386, ppc, x86_64, ppc64, or falls back to cpu_type_description. Equivalent to -[CrashReport _shortArchName]

pub fn spacify_string(s: Option<&str>) -> String

Normalizes whitespace in a string by splitting on whitespace/newline characters and rejoining with single spaces. Returns empty string for None input. Equivalent to -[CrashReport _spacifyString:]

Examples

use crashrustler::CrashRustler;

assert_eq!(
    CrashRustler::spacify_string(Some("hello   world\n\tfoo")),
    "hello world foo"
);
assert_eq!(CrashRustler::spacify_string(None), "");

pub fn string_by_padding_newlines(s: &str) -> String

Replaces newlines in a string with padded newlines for crash report formatting alignment. Strips leading newline if present. Equivalent to -[CrashReport stringByPaddingNewlinesInString:]

Examples

use crashrustler::CrashRustler;

assert_eq!(
    CrashRustler::string_by_padding_newlines("line1\nline2\nline3"),
    "line1\n    line2\n    line3"
);

pub fn string_by_trimming_column_sensitive_whitespace(s: &str) -> String

Trims whitespace from a string. If the trimmed result is empty, returns “[column N]” where N is the original string length. This preserves column-alignment information for empty content. Equivalent to -[CrashReport stringByTrimmingColumnSensitiveWhitespacesInString:]

pub fn path_is_apple(path: &str) -> bool

Returns true if the given path is an Apple system path. Checks: /System, /usr/lib, /usr/bin, /usr/sbin, /bin, /sbin. Equivalent to -[CrashReport pathIsApple:]

pub fn bundle_identifier_is_apple(bundle_id: &str) -> bool

Returns true if the bundle identifier belongs to Apple. Checks: “com.apple.” prefix, “commpage” prefix, or equals “Ozone”/“Motion”. Equivalent to -[CrashReport bundleIdentifierIsApple:]

pub fn is_apple_application(&self) -> bool

Returns true if this is an Apple application, checking both the executable path and the bundle identifier. Equivalent to -[CrashReport isAppleApplication]

pub fn record_internal_error(&mut self, error: &str)

Appends an error message to the internal error log. Creates the log on first call, appends with newline on subsequent calls. Equivalent to -[CrashReport recordInternalError:]

pub fn reduce_to_two_sig_figures(value: u64) -> u64

Reduces a u64 value to two significant figures. Used for approximate memory statistics in crash reports. Equivalent to -[CrashReport reduceToTwoSigFigures:]

impl CrashRustler

pub fn new(params: CrashParams) -> Self

Creates a new CrashRustler from pre-gathered crash data.

The binary (exc_handler) is responsible for all Mach/system calls. This constructor is pure data — no FFI.

Equivalent to -[CrashReport initWithTask:exceptionType:exceptionCode: exceptionCodeCount:thread:threadStateFlavor:threadState:threadStateCount:]

pub fn new_from_corpse( _corpse: u64, _length: u64, _task: u32, _exception_type: i32, _exception_codes: &[i64], _thread: u32, _thread_state_flavor: u32, _thread_state: &[u32], ) -> Option<Self>

Stub initializer for corpse-based crash reports. Returns None — corpse handling is done elsewhere in the crash reporter daemon. Equivalent to -[CrashReport initWithCorpse:length:task:…]

impl CrashRustler

pub fn read_address_from_memory( &self, memory: &MappedMemory, address: u64, ) -> u64

Reads a pointer-sized value from mapped process memory at the given address. Returns 0 if the read fails (address out of range). Equivalent to -[CrashReport _readAddressFromMemory:atAddress:]

pub fn read_address_from_memory_at_symbol( &self, memory: &MappedMemory, symbol_address: u64, ) -> u64

Reads a pointer-sized value from mapped memory at a symbol’s address. symbol_address is the start of the symbol’s range (from CSSymbolGetRange). Equivalent to -[CrashReport _readAddressFromMemory:atSymbol:]

pub fn read_string_from_memory( &self, address: u64, mapped_regions: &[MappedMemory], ) -> Option<String>

Reads a null-terminated string from pre-mapped memory regions. Searches through the provided mapped regions for the requested address. Tries UTF-8 decoding first; falls back to MacRoman encoding. Returns None for address 0 or if the address is not in any mapped region. Equivalent to -[CrashReport _readStringFromMemory:atAddress:]

pub fn build_crash_reporter_info( cri_dict: &HashMap<i32, String>, cri_errors: &[String], ) -> String

Builds the crash reporter info status string from a dictionary of PID→status entries and any accumulated internal errors. In CrashWrangler this updates a global C string read by the crash reporter daemon; here it returns the composed string. Equivalent to -[CrashReport _updateCrashReporterInfoFromCRIDict]

pub fn append_crash_reporter_info_internal_error(&mut self, error: &str)

Appends an internal error to the crash reporter error list. Formats as “[executablePath] error” or “[notfound] error”. Equivalent to -[CrashReport _appendCrashReporterInfoInternalError:]

pub fn crash_reporter_info_string(&self) -> String

Builds the crash reporter status string for this process. If ppid is 0: “Analyzing process {name} ({pid}, path={path}), couldn’t determine parent process pid” Otherwise: “Analyzing process {name} ({pid}, path={path}), parent process {parentName} ({ppid}, path={parentPath})” Equivalent to -[CrashReport _setCrashReporterInfo]

pub fn append_application_specific_info( &mut self, info: &str, is_source_little_endian: bool, )

Appends a string to the appropriate application-specific info field. If the process is not native (Rosetta-translated) and the source binary is little-endian, appends to rosetta_info instead. Otherwise appends to application_specific_info. Equivalent to -[CrashReport _appendApplicationSpecificInfo:withSymbolOwner:]

pub fn extract_crash_reporter_info( &mut self, memory: &MappedMemory, symbol_address: u64, is_source_little_endian: bool, mapped_regions: &[MappedMemory], )

Extracts crash reporter info from the _crashreporter_info symbol. Reads the pointer at the symbol address, then reads the C string it points to from pre-mapped memory regions. Equivalent to -[CrashReport _extractCrashReporterInfoFromSymbolOwner:withMemory:]

pub fn extract_crash_reporter_annotations( &mut self, crash_info_data: &[u8], is_source_little_endian: bool, mapped_regions: &[MappedMemory], )

Extracts crash annotations from the __DATA __crash_info section data. Parses the crashreporter_annotations_t struct. String pointers are resolved from pre-mapped memory regions. Equivalent to -[CrashReport _extractCrashReporterAnnotationsFromSymbolOwner:withMemory:]

pub fn extract_crash_reporter_binary_image_hints( &mut self, memory: &MappedMemory, symbol_address: u64, mapped_regions: &[MappedMemory], )

Extracts binary image hints from the _crashreporter_binary_image_hints symbol. Reads the pointer at the symbol, reads the plist string it points to from pre-mapped memory regions, and stores it in binary_image_hints. Equivalent to -[CrashReport _extractCrashReporterBinaryImageHintsFromSymbolOwner:withMemory:]

Trait Implementations

impl Debug for CrashRustler

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CrashRustler

fn default() -> Self

Returns the “default value” for a type.