WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: remove exe_file dereference()

Browse Source
This commit is contained in:
SolitudePy
2025-12-29 19:00:30 +02:00
parent 15dc9ec463
commit d55cf9a9d0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/malware/process_spoofing.py
+2 -2
View File
@@ -61,7 +61,7 @@ class ProcessSpoofing(plugins.PluginInterface):
try:
mm = task.mm
if not mm or not mm.is_readable():
# Kernel threads doesn't have mm
# Kernel threads don't have mm struct
return None
exe_file = mm.exe_file
@@ -69,7 +69,7 @@ class ProcessSpoofing(plugins.PluginInterface):
if not exe_file or not exe_file.is_readable():
return None
exe_inode = exe_file.dereference().f_path.dentry.d_inode
exe_inode = exe_file.f_path.dentry.d_inode
exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file)
# If the inode link count is 0, the process image has been deleted