From 2478c1398eb5b0afebc78d237a710d6d2aa760f1 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 31 Dec 2025 20:06:50 +0200
Subject: [PATCH] Plugins: get first argument using utility.address_to_string
 in process_spoofing

---
 .../plugins/linux/malware/process_spoofing.py | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py
index 941f1495e..64f3274e9 100644
--- a/volatility3/framework/plugins/linux/malware/process_spoofing.py
+++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py
@@ -7,6 +7,7 @@ from pathlib import PurePosixPath
 from typing import Optional, Tuple, Iterator
 
 from volatility3.framework import exceptions, interfaces, renderers
+from volatility3.framework.constants import linux as linux_constants
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -117,30 +118,35 @@ class ProcessSpoofing(plugins.PluginInterface):
         if proc_layer_name is None:
             return None
 
-        proc_layer = context.layers[proc_layer_name]
         start = task.mm.arg_start
         size_to_read = task.mm.arg_end - task.mm.arg_start
 
-        if not (0 < size_to_read <= 4096):
+        if size_to_read <= 0:
             return None
 
+        read_length = min(size_to_read, linux_constants.MAX_ARG_STRLEN)
+
         try:
-            argv = proc_layer.read(start, size_to_read)
+            cmdline = utility.address_to_string(
+                context=context,
+                layer_name=proc_layer_name,
+                address=start,
+                count=read_length,
+                errors="replace",
+                encoding="utf-8"
+            )
         except exceptions.InvalidAddressException as e:
             vollog.debug(
                 f"Unable to read cmdline for task at {task.vol.offset:#x}: {e}"
             )
             return None
 
-        # Parse the arguments - they are null byte terminated
-        args_str = argv.decode(encoding="utf8", errors="replace")
-        args_list = args_str.split("\x00")
-        if args_list and args_list[0]:
-            basename = PurePosixPath(args_list[0]).name
-            return basename
-        else:
+        if not cmdline:
             return None
 
+        basename = PurePosixPath(cmdline).name
+        return basename if basename else None
+
     @classmethod
     def get_comm(cls, task: interfaces.objects.ObjectInterface) -> Optional[str]:
         """