From b2da35c05ae6e72a48fe88d93556b3087cfcd965 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 10 Aug 2019 00:23:18 +0100 Subject: [PATCH] Revert "Apply relative offsets to type_name as well as symbol_names for modules." This reverts commit d67fcc9a6a4865992c19de6ef8d182c44882c7b8. --- volatility/framework/contexts/__init__.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 1375e5e36..719837f8c 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -186,16 +186,14 @@ class Module(interfaces.context.ModuleInterface): raise ValueError("Symbol {} has no associated type information".format(symbol.name)) type_arg = symbol.type offset = symbol.address + if not self._absolute_symbol_addresses: + offset += self._offset elif type_name is not None and offset is not None: if constants.BANG in type_name: raise ValueError("Type_name cannot reference another module") type_arg = self.symbol_table_name + constants.BANG + type_name else: raise ValueError("One of symbol_name, or type_name & offset, must be specified to construct a module") - - # If we're using module-relative-addresses, add on the module offset - if not self._absolute_symbol_addresses: - offset += self._offset # Ensure we don't use a layer_name other than the module's, why would anyone do that? if 'layer_name' in kwargs: del kwargs['layer_name']