diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index e5a206af2..1ee64544f 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -55,24 +55,13 @@ class JobLinks(interfaces.plugins.PluginInterface): "(Original Process)" )) - vollog.log(LOGLEVEL_VVVV, proc.JobLinks) - vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Flink)) - vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Blink)) - vollog.log(LOGLEVEL_VVVV, job.JobLinks) - vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Flink)) - vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Blink)) - vollog.log(LOGLEVEL_VVVV, job.ProcessListHead) - vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Flink)) - vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Blink)) - vollog.log(LOGLEVEL_VVVV, "") - for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"): yield (1, ( format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId, entry.InheritedFromUniqueProcessId, entry.get_session_id(), renderers.NotApplicableValue(), entry.get_is_wow64(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), - renderers.NotApplicableValue(), - "(Original Process)" + "Yes", + entry.get_peb().ProcessParameters.ImagePathName.get_string() )) except (exceptions.InvalidAddressException):