linux: get_parent_pid: Fix parent ID to correctly mimic getppid() sys…

…call behavior by using TGID instead of PID
volatilityfoundation · Dec 18, 2024 · d934d44 · d934d44
1 parent 197d245
commit d934d44
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -641,7 +641,7 @@ def get_parent_pid(self) -> int:
         """
 
         if self.real_parent and self.real_parent.is_readable():
-            ppid = self.real_parent.pid
+            ppid = self.real_parent.tgid
         else:
             ppid = 0