Windows PEDump: Update PsList dep and change method signature

This updates PEDump to use the latest version of PsList, updates the
dependency version number, changes one of it's own method signatures to
facilitate the pslist change, and does a major bump of its own version
number.

Co-authored-by: Andrew Case <andrew@dfir.org>

volatility3/framework/plugins/windows/pedump.py

@@ -3,7 +3,7 @@
 #
 import logging
 import ntpath
-from typing import List, Type, Optional
+from typing import List, Type, Optional, Iterator, Tuple
 
 from volatility3.framework import constants, exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
@@ -18,7 +18,9 @@ class PEDump(interfaces.plugins.PluginInterface):
     """Allows extracting PE Files from a specific address in a specific address space"""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 0)
+
+    # 2.0.0 - changed the signature of `dump_kernel_pe_at_base`
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -30,7 +32,10 @@ class PEDump(interfaces.plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.VersionRequirement(
-                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+                name="pslist", component=pslist.PsList, version=(3, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="modules", component=modules.Modules, version=(3, 0, 0)
             ),
             requirements.ListRequirement(
                 name="pid",
@@ -145,10 +150,18 @@ class PEDump(interfaces.plugins.PluginInterface):
         )
 
     @classmethod
-    def dump_kernel_pe_at_base(cls, context, kernel, pe_table_name, open_method, base):
-        session_layers = modules.Modules.get_session_layers(
-            context, kernel.layer_name, kernel.symbol_table_name
-        )
+    def dump_kernel_pe_at_base(
+        cls,
+        context: interfaces.context.ContextInterface,
+        kernel_module_name: str,
+        pe_table_name: str,
+        open_method: Type[interfaces.plugins.FileHandlerInterface],
+        base: int,
+    ) -> Iterator[Tuple[int, str, str]]:
+        """
+        Extracts a PE file from kernel memory at the given base address
+        """
+        session_layers = modules.Modules.get_session_layers(context, kernel_module_name)
 
         session_layer_name = modules.Modules.find_session_layer(
             context, session_layers, base
@@ -183,7 +196,7 @@ class PEDump(interfaces.plugins.PluginInterface):
         for proc in pslist.PsList.list_processes(
             context=context,
             layer_name=kernel.layer_name,
-            symbol_table=kernel.symbol_table_name,
+            symbol_table_name=kernel.symbol_table_name,
             filter_func=filter_func,
         ):
             pid = proc.UniqueProcessId
@@ -224,7 +237,11 @@ class PEDump(interfaces.plugins.PluginInterface):
 
         if self.config["kernel_module"]:
             pe_files = self.dump_kernel_pe_at_base(
-                self.context, kernel, pe_table_name, self.open, self.config["base"]
+                self.context,
+                self.config["kernel"],
+                pe_table_name,
+                self.open,
+                self.config["base"],
             )
         else:
             filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))