From dd88f0cafa2e21cf2a080ad849dbeac3c308a85c Mon Sep 17 00:00:00 2001
From: atcuno <andrew@memoryanalysis.net>
Date: Tue, 29 Jan 2013 19:21:03 +0000
Subject: [PATCH] Mac - fix p_gid error in proc overlay

---
 volatility/plugins/overlays/mac/mac.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/volatility/plugins/overlays/mac/mac.py b/volatility/plugins/overlays/mac/mac.py
index 42ebe8ed..2fcd7d01 100644
--- a/volatility/plugins/overlays/mac/mac.py
+++ b/volatility/plugins/overlays/mac/mac.py
@@ -64,8 +64,19 @@ class VolatilityMacIntelValidAS(obj.VolatilityMagic):
             yield True
         else:
             yield False
+        
+class proc(obj.CType):   
+    @property
+    def p_gid(self):
+        cred = self.p_ucred
+
+        if hasattr(cred, "cr_posix"):
+            ret = cred.cr_posix.cr_groups[0]
+        else:
+            ret = cred.cr_groups[0]     
+    
+        return ret
 
-class proc(obj.CType):
     @property
     def p_uid(self):
         cred = self.p_ucred
@@ -77,17 +88,6 @@ class proc(obj.CType):
         
         return ret
     
-    @property
-    def p_gid(self):
-        cred = self.p_ucred
-
-        if hasattr(cred, "cr_posix"):
-            ret = cred.cr_posix.cr_gid
-        else:
-            ret = cred.cr_gid     
-        
-        return ret
-    
     def get_process_address_space(self):
         task = obj.Object("task", offset=self.task, vm=self.obj_vm)  
         cr3  = task.map.pmap.pm_cr3