Plugins: convert useful methods to classmethods

volatility3/framework/plugins/linux/malware/process_spoofing.py

@@ -46,13 +46,17 @@ class ProcessSpoofing(plugins.PluginInterface):
             ),
         ]
 
-    def _get_executable_path(
-        self, task: interfaces.objects.ObjectInterface
+    @classmethod
+    def get_executable_path(
+        cls,
+        context: interfaces.context.ContextInterface,
+        task: interfaces.objects.ObjectInterface,
     ) -> Optional[str]:
         """
         Extract the executable path from task_struct.mm.exe_file
 
         Args:
+            context: The context to operate on
             task: task_struct object of the process
 
         Returns:
@@ -70,24 +74,28 @@ class ProcessSpoofing(plugins.PluginInterface):
                 return None
 
             exe_inode = exe_file.f_path.dentry.d_inode
-            exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file)
+            exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file)
 
             # If the inode link count is 0, the process image has been deleted
             if exe_inode.i_nlink == 0:
-                exe_path += self.deleted
+                exe_path += cls.deleted
 
             return exe_path if exe_path else None
 
         except (exceptions.InvalidAddressException, AttributeError):
             return None
 
-    def _get_cmdline_basename(
-        self, task: interfaces.objects.ObjectInterface
+    @classmethod
+    def get_cmdline_basename(
+        cls,
+        context: interfaces.context.ContextInterface,
+        task: interfaces.objects.ObjectInterface,
     ) -> Optional[str]:
         """
         Extract the command line arguments and return the basename of the first argument
 
         Args:
+            context: The context to operate on
             task: task_struct object of the process
 
         Returns:
@@ -102,7 +110,7 @@ class ProcessSpoofing(plugins.PluginInterface):
             if proc_layer_name is None:
                 return None
 
-            proc_layer = self.context.layers[proc_layer_name]
+            proc_layer = context.layers[proc_layer_name]
             start = task.mm.arg_start
             size_to_read = task.mm.arg_end - task.mm.arg_start
 
@@ -126,7 +134,8 @@ class ProcessSpoofing(plugins.PluginInterface):
         except (exceptions.InvalidAddressException, AttributeError):
             return None
 
-    def _get_comm(self, task: interfaces.objects.ObjectInterface) -> Optional[str]:
+    @classmethod
+    def get_comm(cls, task: interfaces.objects.ObjectInterface) -> Optional[str]:
         """
         Extract the comm field from task_struct
 
@@ -153,10 +162,10 @@ class ProcessSpoofing(plugins.PluginInterface):
         Returns:
             Tuple of (exe_path_basename, cmdline_basename, comm)
         """
-        exe_path = self._get_executable_path(task)
-        exe_basename = PurePosixPath(exe_path).name
-        cmdline_basename = self._get_cmdline_basename(task)
-        comm = self._get_comm(task)
+        exe_path = self.get_executable_path(self.context, task)
+        exe_basename = PurePosixPath(exe_path).name if exe_path else None
+        cmdline_basename = self.get_cmdline_basename(self.context, task)
+        comm = self.get_comm(task)
 
         return exe_basename, cmdline_basename, comm