
Crashwalk
#Incident Management#Digital Forensics
Forensics tool for exploring offline Docker filesystems.
Using the Import "github.com/bnagy/crashwalk" in Your Go Code
If you want to use the import "github.com/bnagy/crashwalk" in your own Go code, you can find the documentation at: http://godoc.org/github.com/bnagy/crashwalk
To run the standalone cwtriage tool:
- The cwtriage tool processes crashfiles with instrumentation and outputs results in various formats.
- Usage: cwtriage -root /path/to/afl-dir [-match pattern] -- /path/to/target -in @@ -out whatever (where @@ will be replaced with each crashfile)
- -afl: Prefer the AFL recorded crashing command, if it exists.
- -engine string: Specify the debugging engine to use: [gdb lldb] (default is "gdb").
- -every int: Run every n seconds (default is -1).
- -f string: Specify the template filename to use while running crash.
- -ignore string: Directory skip pattern (uses Go regex syntax).
- -match string: Match pattern for files (uses Go regex syntax).
- -mem int: Set memory limit for target processes (in MB) (default is -1).
- -output string: Choose the output format to use: [json pb text] (default is "text").
- -root string: Define the root directory to search for crashes.
- -seen: Include previously seen results from the database in the output.
- -seendb string: Specify the path to BoltDB (default is "crashwalk.db").
- -strict: Abort the entire run if any crashes fail to reproduce.
- -t int: Set a timeout for target processes (in seconds) (default is 60).
- -tidy: Move crashes that are processed.