From e8087dd68d77391ca6a201abb9a64a558e104a13 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 31 Dec 2025 20:23:05 +0200 Subject: [PATCH] Plugins: process_spoofing put reference in docstring --- .../plugins/linux/malware/process_spoofing.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 0d64861b2..493a1de9a 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -17,9 +17,11 @@ from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) -# https://github.com/SolitudePy/linux-mal class ProcessSpoofing(plugins.PluginInterface): - """Detects process spoofing by comparing executable path to cmdline & comm fields""" + """Detects process spoofing by comparing executable path to cmdline & comm fields. + + Examples of such behavior can be found here: https://github.com/SolitudePy/linux-mal + """ _required_framework_version = (2, 27, 0) _version = (1, 1, 0) @@ -101,7 +103,12 @@ class ProcessSpoofing(plugins.PluginInterface): task: interfaces.objects.ObjectInterface, ) -> Optional[str]: """ - Extract the command line arguments and return the basename of the first argument + Extract the command line arguments and return the basename of the first argument. + + Notes: + The read length is capped at ``MAX_ARG_STRLEN`` (32 * 4096) per the + kernel limit defined in ``include/uapi/linux/binfmts.h`` (see + linux.git commit f6031913338f1dad5bd8cb7286ff4e53644b6940). Args: context: The context to operate on