Correlate Apple Symbols And Crashes
Overview
Prove binary and symbol identity before translating addresses. Preserve every address convention and the source of each recovered name.
Read references/apple-symbol-and-crash-correlation.md when interpreting crash fields, UUID matching, ASLR arithmetic, symbol sources, or Apple symbolication tools.
Workflow
Preserve the report and binaries.
- Record crash or IPS file hash, timestamp, incident identifier, process, OS build, device model, architecture, and report source.
- Preserve candidate binaries and symbol bundles unchanged.
Identify the crashed image.
- Record binary name, bundle identifier and version, UUID, architecture, load address, image range, and path from the report.
- Do not assume the main executable owns a frame from a framework, extension, dyld cache, or translated image.
Match symbols by identity.
- Compare the report image UUID to the binary and dSYM DWARF UUID for the same architecture.
- Reject same-name or same-version candidates with a different UUID.
- Record whether names come from the binary, dSYM, runtime metadata, system symbols, or an analyst database.
Establish address arithmetic.
- Preserve reported runtime address, image load address, preferred image address when needed, ASLR slide, and image-relative offset.
- Confirm which address form the selected tool expects before symbolication.
Symbolicate narrowly.
- Start with the relevant frame or image rather than rewriting the complete report blindly.
- Record exact commands, Xcode archive or symbol source, architecture, and output.
- Preserve unsymbolicated and partially symbolicated frames.
Correlate with static analysis.
- Translate the verified image-relative location into the analysis database's address convention.
- Compare function boundaries, symbols, disassembly, and runtime metadata.
- Record an analyst rename separately from a symbolicated name.
Assess confidence.
- Confirmed: UUID, architecture, address convention, and symbol source match.
- Partial: image match is sound but symbol, inline, or optimization evidence is incomplete.
- Unresolved: candidate binary, dSYM, slide, system symbol, or address convention remains uncertain.
Hand off ordinary Xcode crash debugging or source fixes to apple-dev-skills after the artifact correlation is complete.
Guardrails
- Do not force symbolication with a UUID-mismatched dSYM.
- Do not subtract a slide twice or mix image-relative and absolute runtime addresses.
- Do not treat the nearest symbol as proof that the instruction belongs to that source line or inlined function.
- Do not present a system-framework name recovered from a different OS build as exact evidence.
Output
Return matched artifact identities, address translation, symbol sources, correlated frames, confidence, unresolved images, and the next verification step.
1---2name: correlate-apple-symbols-and-crashes3description: Match Apple binaries, dSYMs, BCSymbolMaps when applicable, crash reports, IPS logs, panic excerpts, and static-analysis databases by UUID, architecture, load address, and exact build. Use when Codex must symbolicate or assess partial symbolication, translate crash addresses, correlate runtime frames with Mach-O functions, validate archived symbols, or hand a supported finding into Xcode or deeper reverse engineering.4---56# Correlate Apple Symbols And Crashes78## Overview910Prove binary and symbol identity before translating addresses. Preserve every address convention and the source of each recovered name.1112Read [references/apple-symbol-and-crash-correlation.md](references/apple-symbol-and-crash-correlation.md) when interpreting crash fields, UUID matching, ASLR arithmetic, symbol sources, or Apple symbolication tools.1314## Workflow15161. Preserve the report and binaries.17 - Record crash or IPS file hash, timestamp, incident identifier, process, OS build, device model, architecture, and report source.18 - Preserve candidate binaries and symbol bundles unchanged.19202. Identify the crashed image.21 - Record binary name, bundle identifier and version, UUID, architecture, load address, image range, and path from the report.22 - Do not assume the main executable owns a frame from a framework, extension, dyld cache, or translated image.23243. Match symbols by identity.25 - Compare the report image UUID to the binary and dSYM DWARF UUID for the same architecture.26 - Reject same-name or same-version candidates with a different UUID.27 - Record whether names come from the binary, dSYM, runtime metadata, system symbols, or an analyst database.28294. Establish address arithmetic.30 - Preserve reported runtime address, image load address, preferred image address when needed, ASLR slide, and image-relative offset.31 - Confirm which address form the selected tool expects before symbolication.32335. Symbolicate narrowly.34 - Start with the relevant frame or image rather than rewriting the complete report blindly.35 - Record exact commands, Xcode archive or symbol source, architecture, and output.36 - Preserve unsymbolicated and partially symbolicated frames.37386. Correlate with static analysis.39 - Translate the verified image-relative location into the analysis database's address convention.40 - Compare function boundaries, symbols, disassembly, and runtime metadata.41 - Record an analyst rename separately from a symbolicated name.42437. Assess confidence.44 - Confirmed: UUID, architecture, address convention, and symbol source match.45 - Partial: image match is sound but symbol, inline, or optimization evidence is incomplete.46 - Unresolved: candidate binary, dSYM, slide, system symbol, or address convention remains uncertain.47488. Hand off ordinary Xcode crash debugging or source fixes to `apple-dev-skills` after the artifact correlation is complete.4950## Guardrails5152- Do not force symbolication with a UUID-mismatched dSYM.53- Do not subtract a slide twice or mix image-relative and absolute runtime addresses.54- Do not treat the nearest symbol as proof that the instruction belongs to that source line or inlined function.55- Do not present a system-framework name recovered from a different OS build as exact evidence.5657## Output5859Return matched artifact identities, address translation, symbol sources, correlated frames, confidence, unresolved images, and the next verification step.
gaelic-ghost