additional fixes

volatility3/framework/plugins/windows/etwpatch.py

@@ -18,8 +18,18 @@ class EtwPatch(interfaces.plugins.PluginInterface):
     _required_framework_version = (2, 26, 0)
 
     etw_functions = {
-        "ntdll.dll": ["EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent"],
-        "advapi32.dll": ["EventWrite"],
+        "ntdll.dll": {
+            pe_symbols.wanted_names_identifier: [
+                "EtwEventWrite",
+                "EtwEventWriteFull",
+                "NtTraceEvent"
+            ],
+        },
+        "advapi32.dll": {
+            pe_symbols.wanted_names_identifier:[
+                "EventWrite"
+            ],
+        },
     }
 
     @classmethod
@@ -96,11 +106,6 @@ class EtwPatch(interfaces.plugins.PluginInterface):
                             )
                     except exceptions.InvalidAddressException:
                         vollog.debug(f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}")
-                        continue
-                    except KeyError:
-                        # Layer may no longer exist
-                        vollog.debug(f"Layer {proc_layer_name} no longer exists for process {proc_id}")
-                        continue
 
     def run(self):
         return renderers.TreeGrid(