From e3d35aa425fe08c4ae5566b5843ec92ee05c841c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 02:49:31 +0000 Subject: [PATCH] update from feedback --- .../plugins/linux/tracing/perf_events.py | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py index 5d629bd21..3e0a40579 100644 --- a/volatility3/framework/plugins/linux/tracing/perf_events.py +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -83,7 +83,7 @@ class PerfEvents(plugins.PluginInterface): event.prog.aux.ksym.name, count=512 ) except AttributeError: - full_name = renderers.NotApplicableValue() + full_name = None program_name = utility.array_to_string(event.prog.aux.name) except exceptions.InvalidAddressException: @@ -95,10 +95,8 @@ class PerfEvents(plugins.PluginInterface): if program_address == 0: continue - program_address = format_hints.Hex(program_address) - else: - program_address = renderers.NotAvailableValue() + program_address = None yield task, event_name, program_name, full_name, program_address @@ -112,14 +110,23 @@ class PerfEvents(plugins.PluginInterface): ) in self.list_perf_events(self.context, self.config["kernel"]): task_name = utility.array_to_string(task.comm) + # We at least need one useful string... + if event_name is None and program_name is None and full_name is None: + continue + + if program_address is not None: + program_address = format_hints.Hex(program_address) + else: + program_address = renderers.NotAvailableValue() + yield ( 0, ( task.pid, task_name, - event_name, - program_name, - full_name, + event_name or renderers.NotAvailableValue(), + program_name or renderers.NotAvailableValue(), + full_name or renderers.NotAvailableValue(), program_address, ), )