diff --git a/volatility/plugins/linux/pslist.py b/volatility/plugins/linux/pslist.py index 6825a54c4..cbddc5436 100644 --- a/volatility/plugins/linux/pslist.py +++ b/volatility/plugins/linux/pslist.py @@ -29,7 +29,7 @@ class PsList(interfaces_plugins.PluginInterface): def list_tasks(self): """Lists all the tasks in the primary layer""" - layer_name = self.config['primary.memory_layer'] + layer_name = self.context.memory[self.config['primary']].config['memory_layer'] _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config["vmlinux"], layer_name) vmlinux = self.context.module(self.config["vmlinux"], self.config["primary"], aslr_shift) diff --git a/volatility/plugins/volshell.py b/volatility/plugins/volshell.py index 92651fe62..cb10125d9 100644 --- a/volatility/plugins/volshell.py +++ b/volatility/plugins/volshell.py @@ -24,7 +24,7 @@ class Volshell(plugins.PluginInterface): context = self.context config = self.config layer_name = self.config['primary'] - kvo = config.get('primary.kernel_virtual_offset', None) + kvo = context.memory[layer_name].config.get('kernel_virtual_offset') members = lambda x: list(sorted(x.vol.members.keys())) # Determine locals diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index f2845cef3..aea77284a 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -29,7 +29,7 @@ class HiveList(plugins.PluginInterface): layer_name = self.config['primary'] # We only use the object factory to demonstrate how to use one - kvo = self.config['primary.kernel_virtual_offset'] + kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index 83223691d..d7b172211 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -43,7 +43,7 @@ class Modules(plugins.PluginInterface): layer_name = self.config['primary'] - kvo = self.config['primary.kernel_virtual_offset'] + kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 45efd77cc..6b9a6ba9b 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -31,7 +31,7 @@ class PsList(plugins.PluginInterface): layer_name = self.config['primary'] # We only use the object factory to demonstrate how to use one - kvo = self.config['primary.kernel_virtual_offset'] + kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address diff --git a/volatility/plugins/windows/volshell.py b/volatility/plugins/windows/volshell.py index 10320ff00..c7f121094 100644 --- a/volatility/plugins/windows/volshell.py +++ b/volatility/plugins/windows/volshell.py @@ -23,8 +23,9 @@ class Volshell(plugins.PluginInterface): """Lists all the processes in the primary layer""" # We only use the object factory to demonstrate how to use one - kvo = self.config['primary.kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt'], layer_name = self.config['primary'], offset = kvo) + layer_name = self.config['primary'] + kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] + ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -52,7 +53,7 @@ class Volshell(plugins.PluginInterface): # Provide some OS-agnostic convenience elements for ease layer_name = self.config['primary'] - kvo = self.config['primary.kernel_virtual_offset'] + kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] nt = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) ps = lambda: list(self.list_processes())