From 32def71eb5a42d44709a2a1477194c8f2f61215a Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Tue, 22 Jul 2025 21:34:55 +0300
Subject: [PATCH] remove notes

---
 .../plugins/windows/malware/pebmasquerade.py  | 86 ++++---------------
 1 file changed, 16 insertions(+), 70 deletions(-)

diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py
index 8c6c0b4b0..cc3ee73bc 100644
--- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py
+++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py
@@ -225,14 +225,14 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                     "Unable to access PEB for PID %d, skipping process", proc_id
                 )
             notes = []
-
+            peb_imagefilepath_length_check = False
+            peb_cmdline_length_check = False
             (
                 eprocess_imagefilename,
                 eprocess_seaudit_imagefilename,
                 peb_imagefilepath,
                 peb_cmdline,
             ) = self.get_process_names(proc)
-            proc_name_for_row = eprocess_imagefilename
 
             # Extract command line executable path for rendering
             peb_cmdline_path_render = renderers.NotAvailableValue()
@@ -248,63 +248,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                         str(e),
                     )
 
-            # Populate notes for enrichment
-            if isinstance(eprocess_imagefilename, str) and isinstance(
-                peb_imagefilepath, str
-            ):
-                try:
-                    peb_imagefilepath_basename = PureWindowsPath(peb_imagefilepath).name
-                    peb_imagefilepath_truncated = peb_imagefilepath_basename[:14]
-
-                    # Compare EPROCESS.ImageFileName with PEB.ImageFilePath truncated to 15 characters
-                    if (
-                        eprocess_imagefilename.lower()
-                        != peb_imagefilepath_truncated.lower()
-                    ):
-                        notes.append(
-                            f"'Potential PEB.ImageFilePath Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_imagefilepath_truncated}'"
-                        )
-                except Exception as e:
-                    notes.append(f"ImageFilePath Comparison error: {str(e)[:30]}")
-
-            if isinstance(eprocess_imagefilename, str) and isinstance(peb_cmdline, str):
-                try:
-                    # Compare EPROCESS.ImageFileName with PEB.CommandLine executable path truncated to 15 characters
-                    peb_cmdline_path = PebMasquerade._get_cmdline_image(peb_cmdline)
-                    if isinstance(peb_cmdline_path, PureWindowsPath):
-                        peb_cmdline_path = peb_cmdline_path.name
-                    peb_cmdline_basename_truncated = peb_cmdline_path[:14]
-                    if (
-                        eprocess_imagefilename.lower()
-                        != peb_cmdline_basename_truncated.lower()
-                    ):
-                        notes.append(
-                            f"'Potential PEB.CommandLine Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_cmdline_basename_truncated}'"
-                        )
-                except Exception as e:
-                    notes.append(f"CommandLine comparison error: {str(e)}")
-
-            if isinstance(eprocess_seaudit_imagefilename, str) and isinstance(
-                peb_imagefilepath, str
-            ):
-                try:
-                    (
-                        are_equal,
-                        eprocess_seaudit_normalized,
-                        peb_imagefilepath_normalized,
-                    ) = PebMasquerade._are_paths_equal(
-                        device_path=eprocess_seaudit_imagefilename,
-                        drive_path=peb_imagefilepath,
-                    )
-                    if not are_equal:
-                        notes.append(
-                            f"'Potential PEB.ImageFilePath Spoofing (via _EPROCESS.SeAuditProcessCreationInfo): EPROCESS={eprocess_seaudit_normalized};PEB={peb_imagefilepath_normalized}'"
-                        )
-                except Exception as e:
-                    notes.append(
-                        f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}"
-                    )
-
             if isinstance(peb_imagefilepath, str) and peb:
                 try:
 
@@ -319,12 +262,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                     if (peb_imagefilepath_length != len(peb_imagefilepath)) or (
                         peb_imagefilepath_maxlength != len(peb_imagefilepath)
                     ):
-                        notes.append(
-                            f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'"
-                        )
+                        peb_imagefilepath_length_check = True
                 except Exception as e:
-                    notes.append(
-                        f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}"
+                    vollog.warning(
+                        "PEB.ImagePathName Length comparison error for PID %d: %s",
+                        proc_id,
+                        str(e),
                     )
 
             if isinstance(peb_cmdline, str) and peb:
@@ -338,23 +281,26 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                     if (peb_cmdline_length != len(peb_cmdline)) or (
                         peb_cmdline_maxlength != len(peb_cmdline)
                     ):
+                        peb_cmdline_length_check = True
                         notes.append(
                             f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'"
                         )
                 except Exception as e:
-                    notes.append(
-                        f"PEB.CommandLine Length comparison error: {str(e)[:30]}"
+                    vollog.warning(
+                        "PEB.CommandLine Length comparison error for PID %d: %s",
+                        proc_id,
+                        str(e),
                     )
             yield (
                 0,
                 (
                     proc_id,
-                    proc_name_for_row,
                     eprocess_imagefilename,
                     eprocess_seaudit_imagefilename,
                     peb_imagefilepath,
                     peb_cmdline_path_render,
-                    "[" + ", ".join(notes) + "]" if notes else "OK",
+                    peb_cmdline_length_check,
+                    peb_imagefilepath_length_check,
                 ),
             )
 
@@ -365,12 +311,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
         return renderers.TreeGrid(
             [
                 ("PID", int),
-                ("ProcessName", str),
                 ("EPROCESS_ImageFileName", str),
                 ("EPROCESS_SeAudit_ImageFileName", str),
                 ("PEB_ImageFilePath", str),
                 ("PEB_CommandLine_Path", str),
-                ("Notes", str),
+                ("PEB_ImageFilePath_Spoofed", bool),
+                ("PEB_CommandLine_Spoofed", bool),
             ],
             self._generator(pids, context, kernel_module_name),
         )