Plugins: truncate deleted to check spoofing in process_spoofing

volatility3/framework/plugins/linux/malware/process_spoofing.py

@@ -169,10 +169,12 @@ class ProcessSpoofing(plugins.PluginInterface):
             task: task_struct object of the process
 
         Returns:
-            Tuple of (exe_basename, cmdline_basename, comm, is_deleted)
+            Tuple of (exe_path, exe_basename, cmdline_basename, comm)
         """
         exe_path = self.get_executable_path(self.context, task)
         exe_basename = PurePosixPath(exe_path).name if exe_path else None
+        if exe_basename.endswith(" (deleted)"):
+            exe_basename = exe_basename[:-len(" (deleted)")]
         cmdline_basename = self.get_cmdline_basename(self.context, task)
         comm = self.get_comm(task)
 
@@ -210,6 +212,7 @@ class ProcessSpoofing(plugins.PluginInterface):
         # Check for comm spoofing (comm is truncated to 15 characters)
         comm_spoofed = False
         if exe_basename and comm:
+            print(exe_basename, comm)
             comm_spoofed = exe_basename[:15] != comm
 
         return cmdline_spoofed, comm_spoofed