aftermath
aftermath copied to clipboard
2.0.0 - libc++abi: terminating due to uncaught exception of type NSException - Abort trap: 6
macOS 13.5.2 - M1 Mac Mini + Xcode 15 (15A240d)
I followed the instruction to Build, which worked (except for having to go in and change the DEVELOPMENT_TEAM from 6PV5YF2UES to my own)
I compiled using Xcode 15, and the binary runs, but errors out with:
$ sudo aftermath -o $HOME/Desktop --deep
Password:
___ ______ __ __
/ | / __/ /____ _________ ___ ____ _/ /_/ /_
/ /| | / /_/ __/ _ \/ ___/ __ `__ \/ __ `/ __/ __ \
/ ___ |/ __/ /_/ __/ / / / / / / / /_/ / /_/ / / /
/_/ |_/_/ \__/\___/_/ /_/ /_/ /_/\__,_/\__/_/ /_/
Temporary Aftermath directory created at /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/Aftermath_H2WG304GQ6NY
2023-09-19T12:12:18Z - Command.swift - Running Aftermath Version 2.0.0
2023-09-19T12:12:18Z - Command.swift - Aftermath Collection Started
2023-09-19T12:12:18Z - Command.swift - Collection started at 2023-09-19T12:12:18Z
2023-09-19T12:12:18Z - Command.swift - Starting ES logging...
2023-09-19T12:12:18Z - ESLogs.swift - Collecting ES logs...
2023-09-19T12:12:18Z - Command.swift - Running pcap...
2023-09-19T12:12:18Z - Command.swift - Started system recon
2023-09-19T12:12:19Z - Command.swift - Finished system recon
2023-09-19T12:12:19Z - Command.swift - Started gathering network information...
2023-09-19T12:12:19Z - NetworkConnections.swift - Collecting airport information...
2023-09-19T12:12:19Z - NetworkConnections.swift - Gathering results of lsof...
2023-09-19T12:12:19Z - Command.swift - Finished gathering network information
2023-09-19T12:12:19Z - Command.swift - Starting process dump...
2023-09-19 12:12:19.575 aftermath[24867:7322047] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[__NSArrayM insertObject:atIndex:]: object cannot be nil'
*** First throw call stack:
(
0 CoreFoundation 0x00000001a6fdb154 __exceptionPreprocess + 176
1 libobjc.A.dylib 0x00000001a6afa4d4 objc_exception_throw + 60
2 CoreFoundation 0x00000001a70c59b8 -[__NSCFString characterAtIndex:].cold.1 + 0
3 CoreFoundation 0x00000001a70c1f80 -[__NSArrayM insertObject:atIndex:].cold.2 + 0
4 CoreFoundation 0x00000001a6f0328c -[__NSArrayM insertObject:atIndex:] + 912
5 aftermath 0x00000001029761d0 __parse_block_invoke + 640
6 CoreFoundation 0x00000001a6f55cb4 __NSARRAY_IS_CALLING_OUT_TO_A_BLOCK__ + 24
7 CoreFoundation 0x00000001a6f55b3c -[__NSArrayM enumerateObjectsWithOptions:usingBlock:] + 196
8 aftermath 0x0000000102975bf8 parse + 380
9 aftermath 0x00000001029759c0 getSubmittedByPlist + 556
10 aftermath 0x00000001029a9bbc $s9aftermath4TreeC20createNodeDictionarySDySiAA0D0CyypGGyF + 1980
11 aftermath 0x000000010299d96c $s9aftermath13ProcessModuleC3runyyF + 416
12 aftermath 0x000000010297dc50 $s9aftermath7CommandC5startyyFZ + 6384
13 aftermath 0x000000010297bf14 $s9aftermath7CommandC4mainyyFZ + 60
14 aftermath 0x000000010298179c $s9aftermath7CommandC5$mainyyFZ + 40
15 aftermath 0x0000000102981884 main + 28
16 dyld 0x00000001a6b2bf28 start + 2236
)
libc++abi: terminating due to uncaught exception of type NSException
Abort trap: 6
Seeing this as well. A reboot fixed it in my case, but we are hoping to automate collection of Aftermath logs with Jamf Pro/Jamf Protect