From 76cceb93cb585e2ca2d16f22fea02b719f924eea Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 19:25:43 -0600 Subject: [PATCH] Code Review: Get rid of 'kvo' in favor of kernel.offset --- volatility3/framework/plugins/windows/modules.py | 6 +----- volatility3/framework/plugins/windows/pslist.py | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 6ec16af1b..e1a0f4cf1 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -322,11 +322,7 @@ class Modules(interfaces.plugins.PluginInterface): """ kernel = context.modules[kernel_module_name] - - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 7909945a1..2fc7612a9 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -228,11 +228,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel = context.modules[kernel_module_name] - # We only use the object factory to demonstrate how to use one - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" )