Merge pull request #1165 from volatilityfoundation/notes_bleed_through

The notes variable is not reset for each VAD, allowing bleed through …
This commit is contained in:
ikelos
2024-06-15 10:51:46 +01:00
committed by GitHub
@@ -155,12 +155,12 @@ class Malfind(interfaces.plugins.PluginInterface):
for proc in procs:
# by default, "Notes" column will be set to N/A
notes = renderers.NotApplicableValue()
process_name = utility.array_to_string(proc.ImageFileName)
for vad, data in self.list_injections(
self.context, kernel.layer_name, kernel.symbol_table_name, proc
):
notes = renderers.NotApplicableValue()
# Check for unique headers and update "Notes" column if criteria is met
if data[0:2] in refined_criteria:
notes = refined_criteria[data[0:2]]