diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 2e1e47b39..e4bd219e2 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -209,12 +209,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): peb_cmdline, ) - def _generator(self, pids): + def _generator(self, pids, context, kernel_module_name): pid_filter = pslist.PsList.create_pid_filter(pids) for proc in pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], + context=context, + kernel_module_name=kernel_module_name, filter_func=pid_filter, ): proc_id = proc.UniqueProcessId @@ -360,6 +360,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): def run(self): pids = self.config.get("pid", None) + context = self.context + kernel_module_name = self.config["kernel"] return renderers.TreeGrid( [ ("PID", int), @@ -370,5 +372,5 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ("PEB_CommandLine_Path", str), ("Notes", str), ], - self._generator(pids), + self._generator(pids, context, kernel_module_name), )