diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 01d4c1e2c..473bd7d07 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -82,7 +82,10 @@ class ProcessSpoofing(plugins.PluginInterface): return exe_path if exe_path else None - except (exceptions.InvalidAddressException, AttributeError): + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug( + f"Unable to read executable path for task at {task.vol.offset:#x}: {e}" + ) return None @classmethod @@ -147,7 +150,8 @@ class ProcessSpoofing(plugins.PluginInterface): """ try: return utility.array_to_string(task.comm) - except (exceptions.InvalidAddressException, AttributeError): + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug(f"Unable to read comm for task at {task.vol.offset:#x}: {e}") return None def _extract_process_names( @@ -193,7 +197,7 @@ class ProcessSpoofing(plugins.PluginInterface): 1 for name in [exe_basename, cmdline_basename, comm] if name ) - is_deleted = exe_basename.endswith(self.deleted) + is_deleted = exe_basename and exe_basename.endswith(self.deleted) if is_deleted: notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'") exe_basename = exe_basename[: len(self.deleted) * -1]