From c3ddc094cbcccda4fd70fdbd4375e2249d470b73 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 1 Oct 2025 11:27:46 +0300
Subject: [PATCH] Plugins: process spoofing handle none values and set more
 classmethods

---
 .../framework/plugins/linux/malware/process_spoofing.py       | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py
index fafca4da1..428a79bc7 100644
--- a/volatility3/framework/plugins/linux/malware/process_spoofing.py
+++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py
@@ -240,6 +240,8 @@ class ProcessSpoofing(plugins.PluginInterface):
 
                 is_deleted = exe_path.endswith(" (deleted)") if exe_path else False
 
+                # Convert None values to strings for TreeGrid compatibility
+                exe_path_render = exe_path if exe_path else "N/A"
                 cmdline_render = cmdline_basename if cmdline_basename else "N/A"
                 comm_render = comm if comm else "N/A"
 
@@ -248,7 +250,7 @@ class ProcessSpoofing(plugins.PluginInterface):
                     (
                         pid,
                         ppid,
-                        exe_path,
+                        exe_path_render,
                         cmdline_render,
                         comm_render,
                         cmdline_spoofed,