Find the build UUID in a Crash Report

Posted 2020-10-16 zzfx

1) Find the build UUID in a Crash Report

The first line in the "Binary Images:" section of a crash report includes the build UUID, inside <>, of the app that crashed.

The line ends with the full path of the app‘s executable on the system.

Note: On ios the path to the app‘s executable will have the form /var/mobile/Applications/<CONTAINER_UUID>/<PATH_TO_APP_EXECUTABLE...>. The CONTAINER_UUID is not the UUID you are looking for. To keep apps separate, iOS places them inside their own container directory. To ensure it‘s unique, the container is given a UUID as a name, which is intentionally unrelated to the app itself. Don‘t be thrown off by this second UUID, the one you want is inside <>.

 

The last parts of this path, after the CONTAINER_UUID, points to the executable inside the app bundle, and will be useful in Step 2.

Listing 1  Crash Report Excerpt

$ grep --after-context=2 "Binary Images:" Example.crash

Binary Images:

0xb6000 - 0xb7fff +Example armv7 <270a9b9d7a333a4a9f1aaf8186f81394> /var/mobile/Applications/28D4F177-D312-4D3B-A76C-C2ACB4CB7DAD/Example.app/Example

0x2feb5000 - 0x2fed6fff dyld armv7 <4a817f3e0def30d5ae2032157d889c1d> /usr/lib/dyld

Here, the build UUID is 270a9b9d7a333a4a9f1aaf8186f81394, and the path to the app‘s executable is Example.app/Example. 28D4F177-D312-4D3B-A76C-C2ACB4CB7DAD is the CONTAINER_UUID, and can be ignored.

Back to Top