From 775daddbc3f203e2adb03ad8e68f8ca88f749bc0 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 29 Oct 2024 14:06:01 -0500 Subject: [PATCH] Add uid and gid helpers for cred structures --- .../symbols/linux/extensions/__init__.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 53647b821..596b471c0 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2075,6 +2075,23 @@ class cred(objects.StructType): """ return self._get_cred_int_value("euid") + @property + def uid(self): + """Returns the effective user ID + + Returns: + int: the effective user ID value + """ + return self._get_cred_int_value("uid") + + @property + def gid(self): + """Returns the effective user ID + + Returns: + int: the effective user ID value + """ + return self._get_cred_int_value("gid") class kernel_cap_struct(objects.StructType): # struct kernel_cap_struct exists from 2.1.92 <= kernels < 6.3