A computer-readable storage medium storing computer-executable instructions for controlling a computing device to generate a crash report when an application crashes, the application being organized as a module with functions, the computer-executable instructions comprising instructions that: install a crash handler to execute in the same process as the application when the application crashes, wherein the application and the crash handler execute in a user mode within the process; and under control of the crash handler executing in the process of the application after the application crashes, identify a call chain of functions using offsets, comprising: identify a victim thread of the process that was executing at the time of a crash, retrieve a stack pointer for the victim thread and an instruction pointer to an instruction at the time of the crash, identify a function that was executing at the time of the crash based on said instruction pointer by using a module function map, said module function map containing an entry for each function of the module along with a reference to the starting point of that module in the address space of the application, walk a call stack of the victim thread to identify return addresses for returning from called functions of the application, identify the offsets within the module, the offsets corresponding to the return addresses and identify the functions within the module that include the identified offsets; and create a crash report based on the identified call chain. install a crash handler to execute in the same process as the application when the application crashes, wherein the application and the crash handler execute in a user mode within the process; and under control of the crash handler executing in the process of the application after the application crashes, identify a call chain of functions using offsets, comprising: identify a victim thread of the process that was executing at the time of a crash, retrieve a stack pointer for the victim thread and an instruction pointer to an instruction at the time of the crash, identify a function that was executing at the time of the crash based on said instruction pointer by using a module function map, said module function map containing an entry for each function of the module along with a reference to the starting point of that module in the address space of the application, walk a call stack of the victim thread to identify return addresses for returning from called functions of the application, identify the offsets within the module, the offsets corresponding to the return addresses and identify the functions within the module that include the identified offsets; and identify a victim thread of the process that was executing at the time of a crash, retrieve a stack pointer for the victim thread and an instruction pointer to an instruction at the time of the crash, identify a function that was executing at the time of the crash based on said instruction pointer by using a module function map, said module function map containing an entry for each function of the module along with a reference to the starting point of that module in the address space of the application, walk a call stack of the victim thread to identify return addresses for returning from called functions of the application, identify the offsets within the module, the offsets corresponding to the return addresses and identify the functions within the module that include the identified offsets; and create a crash report based on the identified call chain.