diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 6ec16af1b..e1a0f4cf1 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -322,11 +322,7 @@ class Modules(interfaces.plugins.PluginInterface): """ kernel = context.modules[kernel_module_name] - - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 7909945a1..2fc7612a9 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -228,11 +228,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel = context.modules[kernel_module_name] - # We only use the object factory to demonstrate how to use one - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" )