Mac - fix p_gid error in proc overlay

2026-06-08 18:04:46 +00:00 · 2013-01-29 19:21:03 +00:00
parent 61565e9c18
commit dd88f0cafa
1 changed files with 12 additions and 12 deletions
@@ -64,8 +64,19 @@ class VolatilityMacIntelValidAS(obj.VolatilityMagic):
            yield True
        else:
            yield False
+        
+class proc(obj.CType):   
+    @property
+    def p_gid(self):
+        cred = self.p_ucred
+
+        if hasattr(cred, "cr_posix"):
+            ret = cred.cr_posix.cr_groups[0]
+        else:
+            ret = cred.cr_groups[0]     
+    
+        return ret

-class proc(obj.CType):
    @property
    def p_uid(self):
        cred = self.p_ucred
@@ -77,17 +88,6 @@ class proc(obj.CType):
        
        return ret
    
-    @property
-    def p_gid(self):
-        cred = self.p_ucred
-
-        if hasattr(cred, "cr_posix"):
-            ret = cred.cr_posix.cr_gid
-        else:
-            ret = cred.cr_gid     
-        
-        return ret
-    
    def get_process_address_space(self):
        task = obj.Object("task", offset=self.task, vm=self.obj_vm)  
        cr3  = task.map.pmap.pm_cr3