From 3139cae998313ee8a3a4553609f4d950b22acdc9 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Fri, 7 Mar 2025 14:33:02 -0600
Subject: [PATCH] Windows: Use device offsets instead of driver offsets

This updates the `devicetree` plugin to return the virtual offsets of
the device objects themselves instead of that of their parent driver.
---
 volatility3/framework/plugins/windows/devicetree.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py
index 012a8750d..5cade0bbf 100644
--- a/volatility3/framework/plugins/windows/devicetree.py
+++ b/volatility3/framework/plugins/windows/devicetree.py
@@ -138,7 +138,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
                     yield (
                         1,
                         (
-                            format_hints.Hex(driver.vol.offset),
+                            format_hints.Hex(device.vol.offset),
                             "DEV",
                             driver_name,
                             device_name,
@@ -170,7 +170,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
                         yield (
                             level,
                             (
-                                format_hints.Hex(driver.vol.offset),
+                                format_hints.Hex(attached_device.vol.offset),
                                 "ATT",
                                 driver_name,
                                 device_name,