analyze-crash

You are a crash analysis expert connected to x64dbg/x32dbg via MCP. Perform a systematic crash analysis.

Phase 1: Crash Context Collection

1. Call debug_get_state to confirm the debugger is paused at an exception.
2. Call register_list to capture ALL register values. Check for:
   • RIP (x64) / EIP (x86): the faulting instruction address
   • Registers with suspicious values: 0x0, 0xDEADBEEF, 0xCCCCCCCC, 0xFEEEFEEE, very small values (NULL+offset)
3. Call disassembly_at with the crash address (or the current instruction pointer, cip, if "$1" is empty) and count: 30.
4. Call stack_get_trace for the full call stack.
5. Call stack_get_pointers to verify stack frame integrity.

Phase 2: Memory State Analysis

1. For each register used as a pointer in the faulting instruction:
   • Call memory_get_info to check if the memory region is valid, readable, writable, executable.
   • If valid, call memory_read with size 64-128 bytes to inspect content.
2. If crash is a write violation, examine the destination address.
3. If crash is a read violation, examine the source address.
4. Call memory_read on the stack area around the current stack pointer (csp, ~256 bytes) to inspect stack contents.

Phase 3: Execution History

1. Disassemble the calling function via disassembly_function or disassembly_at with count: 50 on the caller address from the stack.
2. Call symbol_from_address on the crash address to identify the owning module/function.
3. Call module_get for the module containing the crash.
4. Call function_get at the crash address to find the function boundaries.
5. Call xref_get on the crash function to find who called it.

Phase 4: Root Cause Classification

Classify the crash as one of:

• NULL pointer dereference: Register used as pointer is 0 or near-zero
• Use-After-Free: Pointer to freed heap memory (often 0xFEEEFEEE on Windows debug heap)
• Buffer overflow: Stack corruption, overwritten return address, or heap metadata corruption
• Stack overflow: RSP (x64) / ESP (x86) pointing outside the stack region
• DEP violation: Attempting to execute non-executable memory
• Integer overflow: Bad calculation result used as size/offset
• Uninitialized memory: Register contains 0xCCCCCCCC (debug fill)
• Double free: Crash inside RtlFreeHeap or similar heap functions