diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index e1a0f4cf1..1ec965737 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -326,22 +326,19 @@ class Modules(interfaces.plugins.PluginInterface): raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module( - kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo - ) try: # use this type if its available (starting with windows 10) - ldr_entry_type = ntkrnlmp.get_type("_KLDR_DATA_TABLE_ENTRY") + ldr_entry_type = kernel.get_type("_KLDR_DATA_TABLE_ENTRY") except exceptions.SymbolError: - ldr_entry_type = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY") + ldr_entry_type = kernel.get_type("_LDR_DATA_TABLE_ENTRY") type_name = ldr_entry_type.type_name.split(constants.BANG)[1] - list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address - list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=list_head) + list_head = kernel.get_symbol("PsLoadedModuleList").address + list_entry = kernel.object(object_type="_LIST_ENTRY", offset=list_head) reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks") - module = ntkrnlmp.object( + module = kernel.object( object_type=type_name, offset=list_entry.vol.offset - reloff, absolute=True ) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 2fc7612a9..1cb2c6356 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -232,12 +232,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module( - kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo - ) - ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address - list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) + ps_aph_offset = kernel.get_symbol("PsActiveProcessHead").address + list_entry = kernel.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) # This is example code to demonstrate how to use symbol_space directly, rather than through a module: # @@ -250,10 +247,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file - reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset( + reloff = kernel.get_type("_EPROCESS").relative_child_offset( "ActiveProcessLinks" ) - eproc = ntkrnlmp.object( + eproc = kernel.object( object_type="_EPROCESS", offset=list_entry.vol.offset - reloff, absolute=True,