WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: process_spoofing put reference in docstring

Browse Source
This commit is contained in:
SolitudePy
2025-12-31 20:23:05 +02:00
parent 088a64379c
commit e8087dd68d
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/malware/process_spoofing.py
+10 -3
View File
@@ -17,9 +17,11 @@ from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
# https://github.com/SolitudePy/linux-mal
class ProcessSpoofing(plugins.PluginInterface):
"""Detects process spoofing by comparing executable path to cmdline & comm fields"""
"""Detects process spoofing by comparing executable path to cmdline & comm fields.
Examples of such behavior can be found here: https://github.com/SolitudePy/linux-mal
"""
_required_framework_version = (2, 27, 0)
_version = (1, 1, 0)
@@ -101,7 +103,12 @@ class ProcessSpoofing(plugins.PluginInterface):
task: interfaces.objects.ObjectInterface,
) -> Optional[str]:
"""
Extract the command line arguments and return the basename of the first argument
Extract the command line arguments and return the basename of the first argument.
Notes:
The read length is capped at ``MAX_ARG_STRLEN`` (32 * 4096) per the
kernel limit defined in ``include/uapi/linux/binfmts.h`` (see
linux.git commit f6031913338f1dad5bd8cb7286ff4e53644b6940).
Args:
context: The context to operate on