From bb3b0ada5c2dbd590414e02cb9a0972f45d36c6e Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Fri, 7 Mar 2025 03:42:32 +0000
Subject: [PATCH] Fix how the task name is reported in getsids error path

---
 volatility3/framework/plugins/windows/getsids.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py
index 710b98bb6..12b16bebc 100644
--- a/volatility3/framework/plugins/windows/getsids.py
+++ b/volatility3/framework/plugins/windows/getsids.py
@@ -176,12 +176,14 @@ class GetSIDs(interfaces.plugins.PluginInterface):
             except exceptions.InvalidAddressException:
                 token = False
 
+            task_name = objects.utility.array_to_string(task.ImageFileName)
+
             if not token or not isinstance(token, interfaces.objects.ObjectInterface):
                 yield (
                     0,
                     [
                         int(task.UniqueProcessId),
-                        str(task.ImageFileName),
+                        task_name,
                         "Token unreadable",
                         "",
                     ],
@@ -207,7 +209,7 @@ class GetSIDs(interfaces.plugins.PluginInterface):
                     0,
                     (
                         task.UniqueProcessId,
-                        objects.utility.array_to_string(task.ImageFileName),
+                        task_name,
                         sid_string,
                         sid_name,
                     ),