mandiant / mandiant/macos-UnifiedLogs

Weird 0xAAAA_AAAA EUID, perhaps worth documenting or acknowledging as Option::None

Open
#159 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
376
Forks
43
Avg merge
1d 21h
Merged PRs (30d)
8

Description

In our tests we found euid as value 2863311530

for instance (but we have quite a lot of these) :

----- Catalog Procinfo Section       -----
[000]
           proc id : 1@1
               pid : 1
              euid : 2863311530
        persona_id : 0
             index : 20
             flags : 0
         main uuid : 0BF131EC-6CDC-3AD5-8079-C443F2D847E4
          dsc uuid : 4782AA70-FDE8-3994-86E3-B88B1AC323F6
         uuidinfos : 0
        subsystems : 2
                <        id : 65532,  subsystem :  2439,   category :   394>
                <        id : 65534,  subsystem :  2520,   category :   394>

I think it's just a "filler" that represent the absence of value, in a field where 0 is actually root
So it should be red as unset => Option::None

It's a work for later, but perhaps we should change the euid field type to Option<u32> and detect this value as None

What do you think ?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the parser entry point for the euid field and any existing tests or fixtures, then verify whether 2863311530 (0xAAAA_AAAA) is the absence sentinel while 0 represents root. Done when the sentinel is consistently represented as Option::None and coverage or documentation records the distinction.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.