diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py index 5d629bd21..3e0a40579 100644 --- a/volatility3/framework/plugins/linux/tracing/perf_events.py +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -83,7 +83,7 @@ class PerfEvents(plugins.PluginInterface): event.prog.aux.ksym.name, count=512 ) except AttributeError: - full_name = renderers.NotApplicableValue() + full_name = None program_name = utility.array_to_string(event.prog.aux.name) except exceptions.InvalidAddressException: @@ -95,10 +95,8 @@ class PerfEvents(plugins.PluginInterface): if program_address == 0: continue - program_address = format_hints.Hex(program_address) - else: - program_address = renderers.NotAvailableValue() + program_address = None yield task, event_name, program_name, full_name, program_address @@ -112,14 +110,23 @@ class PerfEvents(plugins.PluginInterface): ) in self.list_perf_events(self.context, self.config["kernel"]): task_name = utility.array_to_string(task.comm) + # We at least need one useful string... + if event_name is None and program_name is None and full_name is None: + continue + + if program_address is not None: + program_address = format_hints.Hex(program_address) + else: + program_address = renderers.NotAvailableValue() + yield ( 0, ( task.pid, task_name, - event_name, - program_name, - full_name, + event_name or renderers.NotAvailableValue(), + program_name or renderers.NotAvailableValue(), + full_name or renderers.NotAvailableValue(), program_address, ), )