Plugins: utilize linuxutilities.path_for_file (deleted) logic solely

volatility3/framework/plugins/linux/malware/process_spoofing.py

@@ -71,7 +71,7 @@ class ProcessSpoofing(plugins.PluginInterface):
 
         if not mm or not mm.is_readable():
             # Kernel threads don't have mm struct
-            return None, is_deleted
+            return None
 
         try:
             exe_file = mm.exe_file
@@ -79,33 +79,20 @@ class ProcessSpoofing(plugins.PluginInterface):
             vollog.debug(
                 f"Unable to access exe_file for task at {task.vol.offset:#x}: {e}"
             )
-            return None, is_deleted
+            return None
 
         if not exe_file or not exe_file.is_readable():
-            return None, is_deleted
+            return None
 
         try:
-            exe_inode = exe_file.f_path.dentry.d_inode
             exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file)
         except (exceptions.InvalidAddressException, AttributeError) as e:
             vollog.debug(
                 f"Unable to read exe_file path for task at {task.vol.offset:#x}: {e}"
             )
-            return None, is_deleted
+            return None
 
-        if not exe_path:
-            return None, is_deleted
-
-        try:
-            # Check if the inode link count is 0 (process image has been deleted)
-            is_deleted = exe_inode.i_nlink == 0
-        except (exceptions.InvalidAddressException, AttributeError) as e:
-            vollog.debug(
-                f"Unable to check inode link count for task at {task.vol.offset:#x}: {e}"
-            )
-            # Continue without deletion info - we still have the path
-
-        return exe_path, is_deleted
+        return exe_path
 
     @classmethod
     def get_cmdline_basename(
@@ -184,12 +171,12 @@ class ProcessSpoofing(plugins.PluginInterface):
         Returns:
             Tuple of (exe_basename, cmdline_basename, comm, is_deleted)
         """
-        exe_path, is_deleted = self.get_executable_path(self.context, task)
+        exe_path = self.get_executable_path(self.context, task)
         exe_basename = PurePosixPath(exe_path).name if exe_path else None
         cmdline_basename = self.get_cmdline_basename(self.context, task)
         comm = self.get_comm(task)
 
-        return exe_basename, cmdline_basename, comm, is_deleted
+        return exe_path, exe_basename, cmdline_basename, comm
 
     def _detect_spoofing(
         self,
@@ -242,7 +229,7 @@ class ProcessSpoofing(plugins.PluginInterface):
                 pid = task.pid
                 ppid = task.get_parent_pid()
 
-                exe_basename, cmdline_basename, comm, is_deleted = (
+                exe_path, exe_basename, cmdline_basename, comm = (
                     self._extract_process_names(task)
                 )
 
@@ -250,10 +237,7 @@ class ProcessSpoofing(plugins.PluginInterface):
                     exe_basename, cmdline_basename, comm
                 )
 
-                # Prepare display values
-                exe_render = exe_basename if exe_basename else "N/A"
-                if is_deleted and exe_basename:
-                    exe_render += " (deleted)"
+                is_deleted = exe_path.endswith(" (deleted)") if exe_path else False
 
                 cmdline_render = cmdline_basename if cmdline_basename else "N/A"
                 comm_render = comm if comm else "N/A"
@@ -263,7 +247,7 @@ class ProcessSpoofing(plugins.PluginInterface):
                     (
                         pid,
                         ppid,
-                        exe_render,
+                        exe_path,
                         cmdline_render,
                         comm_render,
                         cmdline_spoofed,
@@ -285,7 +269,7 @@ class ProcessSpoofing(plugins.PluginInterface):
             [
                 ("PID", int),
                 ("PPID", int),
-                ("Exe_Basename", str),
+                ("Exe_Path", str),
                 ("Cmdline_Basename", str),
                 ("Comm", str),
                 ("Cmdline_Spoofed", bool),