From 231033428df243efe16a60cd2daafef02c4ccfc7 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Fri, 6 Jun 2025 18:26:47 +0300
Subject: [PATCH] replace to utility function

---
 volatility3/framework/plugins/windows/pebmasquerade.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py
index c1bfca67f..78676bc0d 100644
--- a/volatility3/framework/plugins/windows/pebmasquerade.py
+++ b/volatility3/framework/plugins/windows/pebmasquerade.py
@@ -5,6 +5,7 @@ from typing import List, Union, Tuple
 
 from volatility3.framework import interfaces, renderers, exceptions
 from volatility3.framework.configuration import requirements
+from volatility3.framework.objects import utility
 from volatility3.plugins.windows import pslist
 
 vollog = logging.getLogger(__name__)
@@ -122,11 +123,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
         peb_cmdline = renderers.NotAvailableValue()
 
         try:
-            eprocess_imagefilename = proc.ImageFileName.cast(
-                "string",
-                max_length=proc.ImageFileName.vol.count,
-                errors="replace",
-            )
+            eprocess_imagefilename = utility.array_to_string(proc.ImageFileName)
         except (AttributeError, exceptions.InvalidAddressException):
             vollog.debug(
                 "Unable to read EPROCESS.ImageFileName for PID %d", proc.UniqueProcessId