Plugins: pebmasquerade remove unused code

volatility3/framework/plugins/windows/malware/pebmasquerade.py

@@ -1,6 +1,4 @@
 import logging
-import re
-from pathlib import PureWindowsPath
 from typing import List, Union, Tuple
 
 from volatility3.framework import interfaces, renderers, exceptions
@@ -38,74 +36,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
             ),
         ]
 
-    @classmethod
-    def _get_cmdline_image(cls, cmdline: str) -> Union[str, PureWindowsPath]:
-        """Extract the executable path from a command line string.
-
-        Args:
-            cmdline (str): The command line string to parse.
-
-        Returns:
-            Union[str, PureWindowsPath]: The executable path as a string or PureWindowsPath.
-        """
-        if not cmdline:
-            return None
-
-        # Regex to extract first .exe ending string (handles quotes, paths, no quotes)
-        match = re.search(r'(?i)(["\']?)([^"\']*?\.exe)\1(?=\s|$)', cmdline)
-        if match:
-            exe_path = match.group(2)
-            return PureWindowsPath(exe_path)
-
-        # If no .exe found, extract the first token (handles quotes)
-        # Matches either "quoted string" or unquoted word
-        first_token_match = re.match(r'\s*(?:"([^"]+)"|\'([^\']+)\'|(\S+))', cmdline)
-        if first_token_match:
-            # Extract whichever group matched
-            executable = (
-                first_token_match.group(1)
-                or first_token_match.group(2)
-                or first_token_match.group(3)
-            )
-            return PureWindowsPath(executable).name + ".exe"
-
-        return ""
-
-    @classmethod
-    def _are_paths_equal(
-        cls, device_path: str, drive_path: str
-    ) -> Tuple[bool, str, str]:
-        """Compare two paths to see if they are equal, ignoring drive/device root and case.
-
-        Args:
-            device_path (str): The device path (e.g. "\\Device\\HarddiskVolume1\\path")
-            drive_path (str): The drive path (e.g. "C:\\path")
-
-        Returns:
-            tuple: (are_equal, device_path_without_drive, drive_path_without_drive)
-                - are_equal (bool): True if paths are equal, False otherwise
-                - device_path_without_drive (str): Device path without drive letter
-                - drive_path_without_drive (str): Drive path without drive letter
-        """
-        pure_device_path = PureWindowsPath(device_path)
-        pure_drive_path = PureWindowsPath(drive_path)
-        device_parts = list(pure_device_path.parts)
-        drive_parts = list(pure_drive_path.parts)
-
-        if pure_drive_path.is_absolute():
-            new_drive_path = "/".join(drive_parts[1:]).lower()
-            new_device_path = "/".join(device_parts[3:]).lower()
-        else:
-            new_drive_path = "/".join(drive_parts[2:]).lower()
-            new_device_path = "/".join(device_parts[4:]).lower()
-
-        return (
-            new_drive_path == new_device_path,
-            new_device_path,
-            new_drive_path,
-        )
-
-    def get_process_names(self, proc: interfaces.objects.ObjectInterface) -> Tuple[
+    @staticmethod
+    def get_process_names(proc: interfaces.objects.ObjectInterface) -> Tuple[
         Union[str, renderers.NotAvailableValue],
         Union[str, renderers.NotAvailableValue],
         Union[str, renderers.NotAvailableValue],
@@ -224,7 +156,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                 vollog.debug(
                     "Unable to access PEB for PID %d, skipping process", proc_id
                 )
-            notes = []
             peb_imagefilepath_length_check = False
             peb_cmdline_length_check = False
             (
@@ -232,21 +163,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                 eprocess_seaudit_imagefilename,
                 peb_imagefilepath,
                 peb_cmdline,
-            ) = self.get_process_names(proc)
-
-            # Extract command line executable path for rendering
-            peb_cmdline_path_render = renderers.NotAvailableValue()
-            if isinstance(peb_cmdline, str):
-                try:
-                    peb_cmdline_path_render = str(
-                        PebMasquerade._get_cmdline_image(peb_cmdline)
-                    )
-                except Exception as e:
-                    vollog.debug(
-                        "Error extracting command line path for PID %d: %s",
-                        proc_id,
-                        str(e),
-                    )
+            ) = PebMasquerade.get_process_names(proc)
 
             if isinstance(peb_imagefilepath, str) and peb:
                 try:
@@ -282,9 +199,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                         peb_cmdline_maxlength != len(peb_cmdline)
                     ):
                         peb_cmdline_length_check = True
-                        notes.append(
-                            f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'"
-                        )
                 except Exception as e:
                     vollog.warning(
                         "PEB.CommandLine Length comparison error for PID %d: %s",
@@ -298,7 +212,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                     eprocess_imagefilename,
                     eprocess_seaudit_imagefilename,
                     peb_imagefilepath,
-                    peb_cmdline_path_render,
                     peb_cmdline_length_check,
                     peb_imagefilepath_length_check,
                 ),
@@ -314,7 +227,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                 ("EPROCESS_ImageFileName", str),
                 ("EPROCESS_SeAudit_ImageFileName", str),
                 ("PEB_ImageFilePath", str),
-                ("PEB_CommandLine_Path", str),
                 ("PEB_ImageFilePath_Spoofed", bool),
                 ("PEB_CommandLine_Spoofed", bool),
             ],