sysdiagnose
sysdiagnose copied to clipboard
Feature/add uid to ps everywhere
Add UID Extraction to ps_everywhere Analyzer
Summary
Adds User ID (UID) field to ps_everywhere analyzer output for security analysis and forensic investigations.
Changes
- Extract UID from ps.txt, psthread.txt, spindump-nosymbols.txt, and logarchive (euid)
- Add
_sanitize_uid()helper to filter invalid placeholder values (0xAAAAAAAA, 0xFFFFFFFF) - Update deduplication logic to consider UID - same process with different UIDs tracked separately
- Set
uid: Nonefor sources without UID information
Output
{
"data": {
"source": "ps.txt",
"uid": 0
}
}
Hey @itayfoT, thanks for the PR. Very much appreciated. But would you mind to remove the changes related to orjson in it? You have already opened another one PR #209 on that topic.
Hi @dario-br thank you for your response, removed