WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: process_spoofing log exceptions as debug

Browse Source
This commit is contained in:
SolitudePy
2025-12-29 19:00:30 +02:00
parent 939034cd33
commit 8349479643
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/malware/process_spoofing.py
+7 -3
View File
@@ -82,7 +82,10 @@ class ProcessSpoofing(plugins.PluginInterface):
return exe_path if exe_path else None
except (exceptions.InvalidAddressException, AttributeError):
except (exceptions.InvalidAddressException, AttributeError) as e:
vollog.debug(
f"Unable to read executable path for task at {task.vol.offset:#x}: {e}"
)
return None
@classmethod
@@ -147,7 +150,8 @@ class ProcessSpoofing(plugins.PluginInterface):
"""
try:
return utility.array_to_string(task.comm)
except (exceptions.InvalidAddressException, AttributeError):
except (exceptions.InvalidAddressException, AttributeError) as e:
vollog.debug(f"Unable to read comm for task at {task.vol.offset:#x}: {e}")
return None
def _extract_process_names(
@@ -193,7 +197,7 @@ class ProcessSpoofing(plugins.PluginInterface):
1 for name in [exe_basename, cmdline_basename, comm] if name
)
is_deleted = exe_basename.endswith(self.deleted)
is_deleted = exe_basename and exe_basename.endswith(self.deleted)
if is_deleted:
notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'")
exe_basename = exe_basename[: len(self.deleted) * -1]