崩溃类型与指令寄存器（指令）

32-bit Intel Architecture

Listing 8 shows the thread state for an Intel-based computer running 32-bit code.

Listing 8: 32-bit Intel thread state

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000000  ebx: 0x942cea07  ecx: 0xbfffed1c  edx: 0x94b3a8e6
  edi: 0x00000000  esi: 0x00000000  ebp: 0xbfffed58  esp: 0xbfffed1c
   ss: 0x0000001f  efl: 0x00010206  eip: 0x00000000   cs: 0x00000017
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
  cr2: 0x00000000

For Intel-based computers running 32-bit code, you should consider the following points:

Focus on two values: eip and the exception address (described earlier).
eip is the program counter at the time that the exception occurred. That is, it's the address of the instruction that caused the exception. For most non-memory access exceptions (for example, EXC_ARITHMETIC/EXC_I386_DIV caused by an integer division by zero), this is the key value.
For memory access exceptions:
- If eip is equal to the exception address, the exception was caused by fetching instructions. Typically this means:
  - you've called a bogus function pointer (or, equivalently, called a method on a bogus object)
  - you've returned to a bad address which, in turn, means that you've corrupted the stack
- If eip is not equal to the exception address, the exception was caused by a memory access instruction (in terms of C, this means that you're dereferencing an invalid pointer).
Finally, as with PowerPC, it can be helpful to look through the other registers for telltale signs.

https://developer.apple.com/library/content/technotes/tn2004/tn2123.html#SECNOSYMBOLS