WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 20:29:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: make get_executable_path more accurate in process_spoofing

Browse Source
This commit is contained in:
SolitudePy
2025-12-29 19:00:30 +02:00
parent 41f964cfe1
commit d384f62721
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/malware/process_spoofing.py
+4 -4
View File
@@ -59,7 +59,7 @@ class ProcessSpoofing(plugins.PluginInterface):
task: task_struct object of the process
Returns:
Tuple of (basename, is_deleted) or (None, False) if not available
Tuple of (full_path, is_deleted) or (None, False) if not available
"""
is_deleted = False
@@ -105,8 +105,7 @@ class ProcessSpoofing(plugins.PluginInterface):
)
# Continue without deletion info - we still have the path
basename = PurePosixPath(exe_path).name
return basename, is_deleted
return exe_path, is_deleted
@classmethod
def get_cmdline_basename(
@@ -185,7 +184,8 @@ class ProcessSpoofing(plugins.PluginInterface):
Returns:
Tuple of (exe_basename, cmdline_basename, comm, is_deleted)
"""
exe_basename, is_deleted = self.get_executable_path(self.context, task)
exe_path, is_deleted = self.get_executable_path(self.context, task)
exe_basename = PurePosixPath(exe_path).name if exe_path else None
cmdline_basename = self.get_cmdline_basename(self.context, task)
comm = self.get_comm(task)