diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index fafca4da1..428a79bc7 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -240,6 +240,8 @@ class ProcessSpoofing(plugins.PluginInterface): is_deleted = exe_path.endswith(" (deleted)") if exe_path else False + # Convert None values to strings for TreeGrid compatibility + exe_path_render = exe_path if exe_path else "N/A" cmdline_render = cmdline_basename if cmdline_basename else "N/A" comm_render = comm if comm else "N/A" @@ -248,7 +250,7 @@ class ProcessSpoofing(plugins.PluginInterface): ( pid, ppid, - exe_path, + exe_path_render, cmdline_render, comm_render, cmdline_spoofed,