mandiant / mandiant/macos-UnifiedLogs
Weird 0xAAAA_AAAA EUID, perhaps worth documenting or acknowledging as Option::None
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 376
- Forks
- 43
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
In our tests we found euid as value 2863311530
for instance (but we have quite a lot of these) :
----- Catalog Procinfo Section -----
[000]
proc id : 1@1
pid : 1
euid : 2863311530
persona_id : 0
index : 20
flags : 0
main uuid : 0BF131EC-6CDC-3AD5-8079-C443F2D847E4
dsc uuid : 4782AA70-FDE8-3994-86E3-B88B1AC323F6
uuidinfos : 0
subsystems : 2
< id : 65532, subsystem : 2439, category : 394>
< id : 65534, subsystem : 2520, category : 394>
I think it's just a "filler" that represent the absence of value, in a field where 0 is actually root
So it should be red as unset => Option::None
It's a work for later, but perhaps we should change the euid field type to Option<u32> and detect this value as None
What do you think ?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the parser entry point for the euid field and any existing tests or fixtures, then verify whether 2863311530 (0xAAAA_AAAA) is the absence sentinel while 0 represents root. Done when the sentinel is consistently represented as Option::None and coverage or documentation records the distinction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100