From 65e7b5302c12068cb78b712d8358f4870eab49dd Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 9 Aug 2022 15:18:11 +0900 Subject: [PATCH] Fix: job detail info to zero --- volatility3/framework/plugins/windows/joblinks.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index 1ee64544f..321e6f791 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -58,8 +58,8 @@ class JobLinks(interfaces.plugins.PluginInterface): for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"): yield (1, ( format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId, - entry.InheritedFromUniqueProcessId, entry.get_session_id(), renderers.NotApplicableValue(), entry.get_is_wow64(), - renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), + entry.InheritedFromUniqueProcessId, entry.get_session_id(), 0, entry.get_is_wow64(), + 0, 0, 0, "Yes", entry.get_peb().ProcessParameters.ImagePathName.get_string() ))