Tutorial: How to properly use CrashReporter to find the culprit of your crashes?

SpringBoard has crashed. There are no suspects.

Hate seeing this? CrashReporter is useless, you say.

Do you want to find out how to figure out what is crashing your device? Then this tutorial was made for you! CrashReporter is not useless at all. It is a very powerful tool. But, to unleash its power, you need to understand how it works.

Part 1: How to use CrashReporter

Firstly (and obviously), you need to download CrashReporter from Cydia. It is available on the BigBoss repository for free. The developer of this tool is Lance Fetters (ashikase).

Once CrashReporter is installed, you'll have a new icon on your SpringBoard. Open it, we will take a look at the main interface of CrashReporter

In CrashReporter's main view, you can find all the applications and all the process which have crashed. If it is the first time that you install it, you might not see anything here. However, since iOS itself does log a few crashes, if you've had one very recently, it may appear.

If you tap on an applications listing, you will see all the crash logs for this application. There is the time and the date corresponding to all the crashes.

Now, if you tap on a crash, you will see the list of the loaded third-party binaries. But that’s not the most important thing present here. The useful things are the 2 big blue buttons present at the bottom: “View crash log” and ‘View syslog”.

The crash log

You can view the crash log of your crash by tapping the first big blue button “View crash log”. There are a lot of useful information concerning the crash in the crash log. For example, we can see the device which had encountered the crash, the process which have crashed, the exact time of the crash, the iOS version of the device which have crashed,…

The crash log can, sometimes, tell you what tweak is responsible of your SpringBoard crash or your app crash. See further for more information.

The syslog

You can view the syslog of your crash by tapping the second big blue button “View syslog”. The syslog is full of “strange lines”. In fact, the syslog shows you what iOS was doing before the crash. The useful lines will usually be present at the end of the syslog. See further for more information.

Part 2: CrashReporter has detected a suspect

CrashReporter have detected the suspect of your crash! Cool! You’re lucky! Just delete the suspected tweak in Cydia and the crashing should stop.

SpringBoard has crashed. There are no suspects. The crash log way

Your SpringBoard has crashed? But there are no suspects? In this part, we will analyze the crash log to find the culprit of your crash.

Let’s open CrashReporter, select the process which have crashed, select the last crash and tap on “View crash log”

We will work on this example: https://pastebin.com/yyrvvWnv

What do we learn in this crash log?

  • The device is an iPhone7,2 (iPhone 6)
  • The process which have crashed is the SpringBoard
  • The SpringBoard was lauched at 2015-08-10 14:03:42.764 +0100
  • The SpringBoard have crashed at 2015-08-10 14:06:40.529 +0100 (3 minutes after)
  • iOS 8.4 is currently installed on this iPhone
  • Some other things but they are not very useful

The next lines (between “Thread 0” and “Thread 1” are useful. In our example, there is a “+” before “TypeStatusClient.dylib”. Now, we clearly know that TypeStatus is the responsible of this crash.

The tweak responsible of the crash is often preceded by a “+”. The plus sign means that the binary comes from a third-party package (i.e. it is not a built-in part of iOS). If you can’t see this sign, check the syslog (See the next part)

SpringBoard has crashed. There are no suspects. The syslog way

If the crash log can’t help you, then the syslog can.

We will analyze this syslog: https://pastebin.com/FZKHvK6X

As you see, there are a lot of “strange lines”. At the end of the syslog, we can see this:

Thu Aug  6 15:38:19 2015: SpringBoard (com.apple.springboard): *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[SBBulletinBannerController observer:addBulletin:forFeed:]: unrecognized selector sent to instance 0x170e78ec0'

A bulletin is a notification. So, this line clearly says that the SpringBoard have crashed because of a banner. Here, the culprit was HoverNotifications because it’s not updated for iOS 8.4.

Unfortunately, this method doesn't work on iOS 10. The "*** Terminating App" type messages don't get sent to the syslog but are instead sent to the new unified logs that CrashReporter does not read. (Thanks for pointing this out /u/tateu)

Part 3: Conclusion

Hopefully you can now understand that CrashReporter is a useful tool. I have to admit that some crashes are really weird and sometimes I even myself cannot find the culprit of them. If this happens to you, I suggest you to disable all your tweaks one by one with iCleaner Pro in order to pinpoint the culprit of your crash.

If a developer has asked for a crashlog or a syslog from you, here is a nice tutorial by @if0u4d & @freemanrepo: http://tweakcrashed.com/. It explains how to extract the logs and send them to him.

Also, if you are still encountering crashes after following this tutorial, I can offer my help. Send the crashlog and the syslog of your crash at ziph0ntweak@gmail.com. I would be happy to help you!

Newsletter

If you like this blog, don't forget to subscribe to my newsletter! You'll receive a mail when a new article is posted.