{"id":21270124,"url":"https://github.com/ant4g0nist/crashmon","last_synced_at":"2025-07-11T05:31:47.643Z","repository":{"id":68070303,"uuid":"423211637","full_name":"ant4g0nist/crashmon","owner":"ant4g0nist","description":"crashmon - A LLDB Based replacement for CrashWrangler","archived":false,"fork":false,"pushed_at":"2023-11-25T13:00:14.000Z","size":3910,"stargazers_count":46,"open_issues_count":1,"forks_count":9,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-04-01T15:09:34.040Z","etag":null,"topics":["crashwrangler","fuzzing","lldb","macos","triage"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ant4g0nist.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-10-31T17:13:57.000Z","updated_at":"2024-02-04T17:39:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"fda7c2a6-782d-4eb6-ad57-95af5579bfaa","html_url":"https://github.com/ant4g0nist/crashmon","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2Fcrashmon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2Fcrashmon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2Fcrashmon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2Fcrashmon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ant4g0nist","download_url":"https://codeload.github.com/ant4g0nist/crashmon/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225693736,"owners_count":17509227,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crashwrangler","fuzzing","lldb","macos","triage"],"created_at":"2024-11-21T08:15:34.923Z","updated_at":"2024-11-21T08:15:35.418Z","avatar_url":"https://github.com/ant4g0nist.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crashmon\ncrashmon - A CrashWrangler replacement based on LLDB\n\nCrashmon, same as CrashWrangelr, is a LLDB wrapper together with [Lisa.py](https://github.com/ant4g0nist/lisa.py) that can be used to determine if a crash is an exploitable security issue, and if a crash is a duplicate of another known crash.\n\n# Usage\n\n========= Build Instruction =========\n```sh\nmacOSResearch ✗ git clone https://github.com/ant4g0nist/crashmon\nmacOSResearch ✗ cd crashmon\ncrashmon git:(main) ✗ make\n```\n\n## Setup lisa.py\nPlease use lisa.py provided in crashmon folder as it has a modified version of exploitable command to pass the output as json.\n\n```sh\ncp crashmon/lisa.py ~/lisa.py\n```\n\n## Usage\n```\nCW_LISA_PY=~/lisa.py/lisa.py •/bin/crashmon tests/binaries/crashexec\n```\n\n![example](https://raw.githubusercontent.com/ant4g0nist/crashmon/main/imgs/example1.png)\n\nFor debugging macOS System Applications/Services, it is expected that you disable SIP as crashmon uses LLDB.\n\n### ========= Environment Variable Reference =========\nCW_LISA_PY: \n\tPath of the lisa.py on your system. \n\nCW_CURRENT_CASE: \nPath of the test case file that is being open in the target application.\nIf set, crashmon will read and save the content of the test case file to triaged crash folder. This will be handy while fuzzing!\n\nCW_ATTACH_PID:\nIf set, use this pid as the process to monitor for crashes.  \ne.g. \nenv CW_ATTACH_PID=12313 CW_CURRENT_CASE=foo ./crashmon\nor \nsudo env CW_ATTACH_PID=12313 CW_CURRENT_CASE=foo ./crashmon\n\nCW_LOG_DIR: (Default ./crashlogs)\nThe directory to output crashlogs to.\n\nCW_JSON_STDOUT: (Default false)\nWrite exploitable output as json to stdout.\n\nCWE_*:\n If there are any environment variables prefixed with CWE_, delete the prefix and set the environment variable in the child.  This does not apply when using CW_ATTACH_PID or CW_REGISTER_LAUNCHD_NAME.\n\n### ========= crashmon return values =========\nNo crash = 0\nCrash = 1\nTimeout = 2\n\n### ========= Exploitability algorithm =========\n\nThe algorithm for determining exploitability looks like this:\n\nExploitable if\n\tCrash on write instruction\n\tCrash executing invalid address\n\tCrash calling an invalid address\n\tIllegal instruction exception\n\tAbort due to -fstack-protector, _FORTIFY_SOURCE, heap corruption detected\n\tStack trace of crashing thread contains certain functions such as malloc, free, szone_error, objc_MsgSend, etc.\n\nNot exploitable if\n\tDivide by zero exception\n\tStack grows too large due to recursion\n\tNull dereference(read or write)\n\tOther abort\n\tCrash on read instruction\n\n## PS\nThis is meant to be used just as an initial triage system! Don't really 100% on the crashmon's output as there might be bugs in `lisa.py`. I appreciate pull requests. \n\nSo, it's recommended to run the test case again with libgmalloc(3) on, and see if the crash changes to one that is considered to be exploitable.\n\n## todo\n- [x] add lisa.py exploitable checks\n- [ ] test moreeee\n- [ ] follow xpc services (target function -\u003e 'xpc_connection_get_pid'. Usecase: Safari-\u003eWebContent)\n\n### thanks\n- @apple for crashwrangler\n- LLVM\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fant4g0nist%2Fcrashmon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fant4g0nist%2Fcrashmon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fant4g0nist%2Fcrashmon/lists"}