From 817bd5ce7fb26984cfb0ab5860d00c24fd3bc3f8 Mon Sep 17 00:00:00 2001
From: Elad Levi <99.elad.levi@gmail.com>
Date: Mon, 28 Apr 2025 15:07:03 +0000
Subject: [PATCH] additional fixes

---
 .../framework/plugins/windows/etwpatch.py     | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index 79ddf2e1a..1ecedea3f 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -18,8 +18,18 @@ class EtwPatch(interfaces.plugins.PluginInterface):
     _required_framework_version = (2, 26, 0)
 
     etw_functions = {
-        "ntdll.dll": ["EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent"],
-        "advapi32.dll": ["EventWrite"],
+        "ntdll.dll": {
+            pe_symbols.wanted_names_identifier: [
+                "EtwEventWrite",
+                "EtwEventWriteFull",
+                "NtTraceEvent"
+            ],
+        },
+        "advapi32.dll": {
+            pe_symbols.wanted_names_identifier:[
+                "EventWrite"
+            ],
+        },
     }
 
     @classmethod
@@ -96,11 +106,6 @@ class EtwPatch(interfaces.plugins.PluginInterface):
                             )
                     except exceptions.InvalidAddressException:
                         vollog.debug(f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}")
-                        continue
-                    except KeyError:
-                        # Layer may no longer exist
-                        vollog.debug(f"Layer {proc_layer_name} no longer exists for process {proc_id}")
-                        continue
 
     def run(self):
         return renderers.TreeGrid(