Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ispras/casr/llms.txt

Use this file to discover all available pages before exploring further.

casr-csharp analyzes C# crash output — Unhandled exception. and Unhandled Exception: blocks emitted by the .NET runtime — and produces structured .casrep reports. It integrates with Sharpfuzz, the AFL++-based coverage fuzzer for .NET managed code, and is invoked automatically by casr-afl when a Sharpfuzz target is detected. The target binary must be identified by a .dll, .exe, or .csproj file somewhere in the argument list — CASR uses this to set the executable_path in the report. Both the dotnet CLI and the mono runtime are supported as the process launcher.

​
Synopsis

casr-csharp [OPTIONS] <--stdout|--output <REPORT>> -- <ARGS>...
The -- separator is required. Everything after it is the command CASR will execute (e.g., dotnet run --project … or mono MyApp.exe).

​
Options

​
-o, --output
path
Path to save the .casrep report file. If a directory is provided, the report filename is generated automatically from the crash context.
​
--stdout
flag
Print the CASR report as JSON to stdout instead of writing it to a file. Mutually exclusive with --output; exactly one of the two is required.
​
--stdin
path
Path to a file fed to the target program’s standard input. Use this when the fuzz harness reads the test case from stdin rather than a file argument.
​
-t, --timeout
integer
default:"0"
Maximum number of seconds to wait for the target process to finish. A value of 0 disables the timeout entirely.
​
--ignore
path
Path to a file containing regular expressions for function names and file paths that should be excluded from stack trace analysis.
​
--strip-path
string
A path prefix removed from every file path in the stack trace and crash line. Also settable via CASR_STRIP_PATH.
​
--ld-preload
string
Shared library paths injected via LD_PRELOAD into the target process only. Space or colon delimited. Also settable via CASR_PRELOAD.

​
dotnet vs mono

casr-csharp supports both .NET runtime launchers:
LauncherExample argumentUse case
dotnet run-- dotnet run --project MyApp.csprojBuild-and-run from source
dotnet (pre-built)-- dotnet run --no-build --project MyApp.csprojRun pre-built project (recommended for Sharpfuzz with AFL++)
mono-- mono MyApp.exeMono runtime for .exe assemblies
CASR validates that the argument list contains a .dll, .exe, or .csproj file. If none is found, the tool exits with an error: dotnet/mono target is not specified by .dll, .exe or .csproj executable.

​
Examples

Analyze a dotnet run project crash: 
casr-csharp -o csharp.casrep -- dotnet run \
  --project casr/tests/casr_tests/csharp/test_casr_csharp/test_casr_csharp.csproj
Analyze a pre-built project (faster, recommended when running under AFL++): 
dotnet publish /tmp/test_casr_afl_csharp/test_casr_afl_csharp.csproj \
  -c Debug -o /tmp/test_casr_afl_csharp/bin

casr-csharp -o csharp.casrep -- dotnet run --no-build \
  --project /tmp/test_casr_afl_csharp/test_casr_afl_csharp.csproj crash_input
Analyze a Mono executable crash: 
casr-csharp -o mono.casrep -- mono /path/to/MyApp.exe input_file
Print the report to stdout: 
casr-csharp --stdout -- dotnet run --no-build \
  --project /tmp/test_casr_afl_csharp/test_casr_afl_csharp.csproj crash_input

​
Fuzzer integration

casr-csharp handles single-crash analysis. For bulk triage of Sharpfuzz + AFL++ crash directories, use casr-afl, which auto-detects Sharpfuzz targets and invokes casr-csharp for each crash input. 
# Full Sharpfuzz triage pipeline
cp -r casr/tests/casr_tests/csharp/test_casr_afl_csharp /tmp/test_casr_afl_csharp
dotnet publish /tmp/test_casr_afl_csharp/test_casr_afl_csharp.csproj \
  -c Debug -o /tmp/test_casr_afl_csharp/bin

casr-afl \
  -i casr/tests/casr_tests/casrep/afl-out-sharpfuzz \
  -o casr_afl_csharp_out
To pass custom run arguments when the AFL crash directory lacks a cmdline file, use --ignore-cmdline: 
casr-afl --ignore-cmdline \
  -i casr/tests/casr_tests/casrep/afl-out-sharpfuzz \
  -o casr_afl_csharp_out \
  -- dotnet run --no-build \
     --project /tmp/test_casr_afl_csharp/test_casr_afl_csharp.csproj @@
When using dotnet run with casr-afl and the --ignore-cmdline flag, always build the project first (dotnet build or dotnet publish) and pass --no-build to dotnet run. This avoids rebuild overhead on every crash replay.

Build docs developers (and LLMs) love

Get started for freeTalk to us