Code Review (style): Use keyword args for clarity

This updates a whole host of method calls to pass keyword arguments
instead of positional arguments.

volatility3/framework/layers/registry.py

@@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer):
         # Win10 17063 introduced the Registry process to map most hives.  Check
         # if it exists and update RegistryHive._base_layer
         for proc in pslist.PsList.list_processes(
-            self.context, self.config["kernel_module_name"]
+            context=self.context, kernel_module_name=self.config["kernel_module_name"]
         ):
             proc_name = proc.ImageFileName.cast(
                 "string", max_length=proc.ImageFileName.vol.count, errors="replace"

volatility3/framework/plugins/linux/bash.py

@@ -46,7 +46,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
     def _generator(self, tasks):
         vmlinux = self.context.modules[self.config["kernel"]]
         is_32bit = not symbols.symbol_table_is_64bit(
-            self.context, vmlinux.symbol_table_name
+            context=self.context, symbol_table_name=vmlinux.symbol_table_name
         )
         if is_32bit:
             pack_format = "I"

volatility3/framework/plugins/linux/malfind.py

@@ -64,7 +64,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         # determine if we're on a 32 or 64 bit kernel
         vmlinux = self.context.modules[self.config["kernel"]]
         is_32bit_arch = not symbols.symbol_table_is_64bit(
-            self.context, vmlinux.symbol_table_name
+            context=self.context, symbol_table_name=vmlinux.symbol_table_name
         )
 
         for task in tasks:

volatility3/framework/plugins/linux/psscan.py

@@ -84,7 +84,9 @@ class PsScan(interfaces.plugins.PluginInterface):
         vmlinux = context.modules[vmlinux_module_name]
 
         # check if this image is 32bit or 64bit
-        is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name)
+        is_32bit = not symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=vmlinux.symbol_table_name
+        )
         if is_32bit:
             pack_format = "I"
         else:

volatility3/framework/plugins/mac/bash.py

@@ -44,7 +44,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
     def _generator(self, tasks):
         darwin = self.context.modules[self.config["kernel"]]
         is_32bit = not symbols.symbol_table_is_64bit(
-            self.context, darwin.symbol_table_name
+            context=self.context, symbol_table_name=darwin.symbol_table_name
         )
         if is_32bit:
             pack_format = "I"

volatility3/framework/plugins/windows/amcache.py

@@ -259,9 +259,11 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located."""
         return next(
             hivelist.HiveList.list_hives(
-                context,
-                interfaces.configuration.path_join(config_path, "hivelist"),
-                kernel_module_name,
+                context=context,
+                base_config_path=interfaces.configuration.path_join(
+                    config_path, "hivelist"
+                ),
+                kernel_module_name=kernel_module_name,
                 filter_string="amcache",
             ),
             None,

volatility3/framework/plugins/windows/cachedump.py

@@ -171,9 +171,9 @@ class Cachedump(interfaces.plugins.PluginInterface):
         syshive = sechive = None
 
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             hive_offsets=None if offset is None else [offset],
         ):
             if hive.get_name().split("\\")[-1].upper() == "SYSTEM":

volatility3/framework/plugins/windows/callbacks.py

@@ -187,7 +187,9 @@ class Callbacks(interfaces.plugins.PluginInterface):
             The name of the constructed symbol table
         """
         native_types = context.symbol_space[nt_symbol_table].natives
-        is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=nt_symbol_table
+        )
         table_mapping = {"nt_symbols": nt_symbol_table}
 
         if is_64bit:
@@ -691,7 +693,8 @@ class Callbacks(interfaces.plugins.PluginInterface):
         )
 
         collection = ssdt.SSDT.build_module_collection(
-            self.context, self.config["kernel"]
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         )
 
         callback_methods = (

volatility3/framework/plugins/windows/cmdline.py

@@ -106,8 +106,8 @@ class CmdLine(interfaces.plugins.PluginInterface):
             [("PID", int), ("Process", str), ("Args", str)],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/cmdscan.py

@@ -286,11 +286,11 @@ class CmdScan(interfaces.plugins.PluginInterface):
 
         if no_registry is False:
             max_history, _ = consoles.Consoles.get_console_settings_from_registry(
-                self.context,
-                self.config_path,
-                self.config["kernel"],
-                max_history,
-                [],
+                context=self.context,
+                config_path=self.config_path,
+                kernel_module_name=self.config["kernel"],
+                max_history=max_history,
+                max_buffers=[],
             )
 
         vollog.debug(f"Possible CommandHistorySize values: {max_history}")
@@ -370,8 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=self._conhost_proc_filter,
                 )
             ),

volatility3/framework/plugins/windows/consoles.py

@@ -149,7 +149,9 @@ class Consoles(interfaces.plugins.PluginInterface):
             The filename of the symbol table to use and the associated class types.
         """
 
-        is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=nt_symbol_table
+        )
 
         if is_64bit:
             arch = "x64"
@@ -824,9 +826,9 @@ class Consoles(interfaces.plugins.PluginInterface):
         )
 
         for hive in hivelist.HiveList.list_hives(
-            context,
-            config_path,
-            kernel_module_name,
+            context=context,
+            base_config_path=config_path,
+            kernel_module_name=kernel_module_name,
             hive_offsets=None,
         ):
             try:
@@ -943,8 +945,8 @@ class Consoles(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=self._conhost_proc_filter,
                 )
             ),

volatility3/framework/plugins/windows/debugregisters.py

@@ -117,7 +117,9 @@ class DebugRegisters(interfaces.plugins.PluginInterface):
 
         proc_modules = None
 
-        procs = pslist.PsList.list_processes(self.context, self.config["kernel"])
+        procs = pslist.PsList.list_processes(
+            context=self.context, kernel_module_name=self.config["kernel"]
+        )
 
         for proc in procs:
             for thread in threads.Threads.list_threads(kernel, proc):

volatility3/framework/plugins/windows/direct_system_calls.py

@@ -354,12 +354,12 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
         kernel = context.modules[kernel_module_name]
 
         is_32bit_arch = not symbols.symbol_table_is_64bit(
-            context, kernel.symbol_table_name
+            context=context, symbol_table_name=kernel.symbol_table_name
         )
 
         for proc in pslist.PsList.list_processes(
-            context,
-            kernel_module_name,
+            context=context,
+            kernel_module_name=kernel_module_name,
             filter_func=filter_func,
         ):
             proc_name = utility.array_to_string(proc.ImageFileName)

volatility3/framework/plugins/windows/dlllist.py

@@ -13,7 +13,7 @@ from volatility3.framework.renderers import conversion, format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows.extensions import pe
 from volatility3.plugins import timeliner
-from volatility3.plugins.windows import info, pslist, psscan, pedump
+from volatility3.plugins.windows import info, pedump, pslist, psscan
 
 vollog = logging.getLogger(__name__)
 
@@ -192,7 +192,9 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
     def generate_timeline(self):
         for row in self._generator(
-            pslist.PsList.list_processes(self.context, self.config["kernel"])
+            pslist.PsList.list_processes(
+                context=self.context, kernel_module_name=self.config["kernel"]
+            )
         ):
             _depth, row_data = row
             if not isinstance(row_data[6], datetime.datetime):
@@ -217,8 +219,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             )
         else:
             procs = pslist.PsList.list_processes(
-                self.context,
-                self.config["kernel"],
+                context=self.context,
+                kernel_module_name=self.config["kernel"],
                 filter_func=filter_func,
             )
 

volatility3/framework/plugins/windows/driverirp.py

@@ -71,11 +71,13 @@ class DriverIrp(interfaces.plugins.PluginInterface):
 
     def _generator(self):
         collection = ssdt.SSDT.build_module_collection(
-            self.context, self.config["kernel"]
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         )
 
         kernel_space_start = modules.Modules.get_kernel_space_start(
-            self.context, self.config["kernel"]
+            context=self.context,
+            module_name=self.config["kernel"],
         )
 
         for driver in driverscan.DriverScan.scan_drivers(

volatility3/framework/plugins/windows/drivermodule.py

@@ -43,7 +43,8 @@ class DriverModule(interfaces.plugins.PluginInterface):
         which allows us to detect the disconnect between a malicious driver and its hidden module.
         """
         collection = ssdt.SSDT.build_module_collection(
-            self.context, self.config["kernel"]
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         )
 
         kernel_space_start = modules.Modules.get_kernel_space_start(

volatility3/framework/plugins/windows/dumpfiles.py

@@ -371,8 +371,8 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                 [self.config.get("pid", None)]
             )
             procs = pslist.PsList.list_processes(
-                self.context,
-                self.config["kernel"],
+                context=self.context,
+                kernel_module_name=self.config["kernel"],
                 filter_func=filter_func,
             )
 

volatility3/framework/plugins/windows/envars.py

@@ -60,9 +60,9 @@ class Envars(interfaces.plugins.PluginInterface):
         values = []
 
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             hive_offsets=None,
         ):
             ## The global variables
@@ -225,8 +225,8 @@ class Envars(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/getservicesids.py

@@ -76,9 +76,9 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
     def _generator(self):
         # Get the system hive
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             filter_string="machine\\system",
             hive_offsets=None,
         ):

volatility3/framework/plugins/windows/getsids.py

@@ -104,9 +104,9 @@ class GetSIDs(interfaces.plugins.PluginInterface):
 
         sids = {}
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             filter_string="config\\software",
             hive_offsets=None,
         ):
@@ -220,8 +220,8 @@ class GetSIDs(interfaces.plugins.PluginInterface):
             [("PID", int), ("Process", str), ("SID", str), ("Name", str)],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/handles.py

@@ -78,7 +78,7 @@ class Handles(interfaces.plugins.PluginInterface):
         except AttributeError:
             # starting with windows 8
             is_64bit = symbols.symbol_table_is_64bit(
-                self.context, kernel.symbol_table_name
+                context=self.context, symbol_table_name=kernel.symbol_table_name
             )
 
             if is_64bit:
@@ -393,8 +393,8 @@ class Handles(interfaces.plugins.PluginInterface):
             )
         else:
             procs = pslist.PsList.list_processes(
-                self.context,
-                self.config["kernel"],
+                context=self.context,
+                kernel_module_name=self.config["kernel"],
                 filter_func=filter_func,
             )
 

volatility3/framework/plugins/windows/hashdump.py

@@ -594,9 +594,9 @@ class Hashdump(interfaces.plugins.PluginInterface):
         syshive = None
         samhive = None
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             hive_offsets=None if offset is None else [offset],
         ):
             if hive.get_name().split("\\")[-1].upper() == "SYSTEM":

volatility3/framework/plugins/windows/hollowprocesses.py

@@ -214,8 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/iat.py

@@ -137,8 +137,8 @@ class IAT(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=pslist.PsList.create_pid_filter(
                         self.config.get("pid", None)
                     ),

volatility3/framework/plugins/windows/info.py

@@ -207,7 +207,14 @@ class Info(plugins.PluginInterface):
         yield (0, ("Symbols", table.config["isf_url"]))
         yield (
             0,
-            ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table))),
+            (
+                "Is64Bit",
+                str(
+                    symbols.symbol_table_is_64bit(
+                        context=self.context, symbol_table_name=symbol_table
+                    )
+                ),
+            ),
         )
         yield (
             0,

volatility3/framework/plugins/windows/joblinks.py

@@ -46,8 +46,8 @@ class JobLinks(interfaces.plugins.PluginInterface):
         memory = self.context.layers[kernel.layer_name]
 
         for proc in pslist.PsList.list_processes(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         ):
             try:
                 if not self.config["physical"]:

volatility3/framework/plugins/windows/ldrmodules.py

@@ -120,8 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/lsadump.py

@@ -211,9 +211,9 @@ class Lsadump(interfaces.plugins.PluginInterface):
         syshive = sechive = None
 
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             hive_offsets=None if offset is None else [offset],
         ):
             if hive.get_name().split("\\")[-1].upper() == "SYSTEM":

volatility3/framework/plugins/windows/malfind.py

@@ -172,7 +172,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         }
 
         is_32bit_arch = not symbols.symbol_table_is_64bit(
-            self.context, kernel.symbol_table_name
+            context=self.context, symbol_table_name=kernel.symbol_table_name
         )
 
         for proc in procs:
@@ -256,8 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/mbrscan.py

@@ -53,7 +53,9 @@ class MBRScan(interfaces.plugins.PluginInterface):
         layer = self.context.layers[physical_layer_name]
         architecture = (
             "intel"
-            if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name)
+            if not symbols.symbol_table_is_64bit(
+                context=self.context, symbol_table_name=kernel.symbol_table_name
+            )
             else "intel64"
         )
 

volatility3/framework/plugins/windows/memmap.py

@@ -108,8 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/modules.py

@@ -92,7 +92,7 @@ class Modules(interfaces.plugins.PluginInterface):
 
             session_layers = list(
                 self.get_session_layers(
-                    self.context,
+                    context=self.context,
                     kernel_module_name=self.config["kernel"],
                 )
             )
@@ -140,7 +140,9 @@ class Modules(interfaces.plugins.PluginInterface):
         module = context.modules[module_name]
 
         # default is used if/when MmSystemRangeStart is paged out
-        if symbols.symbol_table_is_64bit(context, module.symbol_table_name):
+        if symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=module.symbol_table_name
+        ):
             object_type = "unsigned long long"
             default_start = 0xFFFF800000000000
         else:
@@ -188,8 +190,8 @@ class Modules(interfaces.plugins.PluginInterface):
         kernel = context.modules[kernel_module_name]
 
         for proc in pslist.PsList.list_processes(
-            context,
-            kernel_module_name,
+            context=context,
+            kernel_module_name=kernel_module_name,
             filter_func=filter_func,
         ):
             proc_id = "Unknown"

volatility3/framework/plugins/windows/netscan.py

@@ -137,7 +137,9 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         # therefore we determine the version based on the kernel version as testing
         # with several windows versions has showed this to work out correctly.
 
-        is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=nt_symbol_table
+        )
 
         is_18363_or_later = versions.is_win10_18363_or_later(
             context=context, symbol_table=nt_symbol_table

volatility3/framework/plugins/windows/netstat.py

@@ -319,7 +319,9 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         Returns:
             The list of TCP endpoint objects from the `layer_name` layer's `PartitionTable`
         """
-        if symbols.symbol_table_is_64bit(context, net_symbol_table):
+        if symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=net_symbol_table
+        ):
             alignment = 0x10
         else:
             alignment = 8

volatility3/framework/plugins/windows/orphan_kernel_threads.py

@@ -60,8 +60,8 @@ class Threads(thrdscan.ThrdScan):
             A generator of thread objects of orphaned threads
         """
         collection = ssdt.SSDT.build_module_collection(
-            context,
-            kernel_module_name,
+            context=context,
+            kernel_module_name=kernel_module_name,
         )
 
         kernel_space_start = modules.Modules.get_kernel_space_start(

volatility3/framework/plugins/windows/pe_symbols.py

@@ -803,7 +803,9 @@ class PESymbols(interfaces.plugins.PluginInterface):
             filter_modules_check = None
 
         session_layers = list(
-            modules.Modules.get_session_layers(context, kernel_module_name)
+            modules.Modules.get_session_layers(
+                context=context, kernel_module_name=kernel_module_name
+            )
         )
 
         # special handling for the kernel
@@ -917,7 +919,9 @@ class PESymbols(interfaces.plugins.PluginInterface):
         Args:
             Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files
         """
-        procs = pslist.PsList.list_processes(context, kernel_module_name)
+        procs = pslist.PsList.list_processes(
+            context=context, kernel_module_name=kernel_module_name
+        )
 
         for proc in procs:
             try:

volatility3/framework/plugins/windows/pedump.py

@@ -161,7 +161,9 @@ class PEDump(interfaces.plugins.PluginInterface):
         """
         Extracts a PE file from kernel memory at the given base address
         """
-        session_layers = modules.Modules.get_session_layers(context, kernel_module_name)
+        session_layers = modules.Modules.get_session_layers(
+            context=context, kernel_module_name=kernel_module_name
+        )
 
         session_layer_name = modules.Modules.find_session_layer(
             context, session_layers, base
@@ -195,8 +197,7 @@ class PEDump(interfaces.plugins.PluginInterface):
 
         for proc in pslist.PsList.list_processes(
             context=context,
-            layer_name=kernel.layer_name,
-            symbol_table_name=kernel.symbol_table_name,
+            kernel_module_name=kernel.name,
             filter_func=filter_func,
         ):
             pid = proc.UniqueProcessId
@@ -237,11 +238,11 @@ class PEDump(interfaces.plugins.PluginInterface):
 
         if self.config["kernel_module"]:
             pe_files = self.dump_kernel_pe_at_base(
-                self.context,
-                self.config["kernel"],
-                pe_table_name,
-                self.open,
-                self.config["base"],
+                context=self.context,
+                kernel_module_name=self.config["kernel"],
+                pe_table_name=pe_table_name,
+                open_method=self.open,
+                base=self.config["base"],
             )
         else:
             filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))

volatility3/framework/plugins/windows/poolscanner.py

@@ -417,7 +417,9 @@ class PoolScanner(plugins.PluginInterface):
         if not is_windows_10:
             scan_layer = context.layers[scan_layer].config["memory_layer"]
 
-        if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name):
+        if symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=kernel_symbol_table_name
+        ):
             alignment = 0x10
         else:
             alignment = 8
@@ -565,7 +567,9 @@ class PoolScanner(plugins.PluginInterface):
         except exceptions.SymbolError:
             # We have to manually load a symbol table
 
-            if symbols.symbol_table_is_64bit(context, symbol_table):
+            if symbols.symbol_table_is_64bit(
+                context=context, symbol_table_name=symbol_table
+            ):
                 is_win_7 = versions.is_windows_7(context, symbol_table)
                 if is_win_7:
                     pool_header_json_filename = "poolheader-x64-win7"

volatility3/framework/plugins/windows/privileges.py

@@ -119,8 +119,8 @@ class Privs(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/processghosting.py

@@ -94,8 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/pstree.py

@@ -84,7 +84,9 @@ class PsTree(interfaces.plugins.PluginInterface):
         """Generates the Tree of processes."""
         kernel = self.context.modules[self.config["kernel"]]
 
-        for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]):
+        for proc in pslist.PsList.list_processes(
+            context=self.context, kernel_module_name=self.config["kernel"]
+        ):
             if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT):
                 offset = proc.vol.offset
             else:

volatility3/framework/plugins/windows/psxview.py

@@ -182,7 +182,9 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter
         kernel = self.context.modules[self.config["kernel"]]
 
         kdbg_list_processes = list(
-            pslist.PsList.list_processes(self.context, self.config["kernel"])
+            pslist.PsList.list_processes(
+                context=self.context, kernel_module_name=self.config["kernel"]
+            )
         )
 
         # get processes from each source

volatility3/framework/plugins/windows/registry/getcellroutine.py

@@ -37,13 +37,15 @@ class GetCellRoutine(interfaces.plugins.PluginInterface):
 
     def _generator(self):
         collection = ssdt.SSDT.build_module_collection(
-            self.context, self.config["kernel"]
+            context=self.context, kernel_module_name=self.config["kernel"]
         )
 
         # walk each hive and validate that the GetCellRoutine handler
         # is inside of the kernel (ntoskrnl)
         for hive_object in hivelist.HiveList.list_hives(
-            self.context, self.config_path, self.config["kernel"]
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
         ):
             hive = hive_object.hive
 

volatility3/framework/plugins/windows/registry/hivelist.py

@@ -95,9 +95,9 @@ class HiveList(interfaces.plugins.PluginInterface):
                 # Construct the hive
                 hive = next(
                     self.list_hives(
-                        self.context,
-                        self.config_path,
-                        self.config["kernel"],
+                        context=self.context,
+                        base_config_path=self.config_path,
+                        kernel_module_name=self.config["kernel"],
                         hive_offsets=[hive_object.vol.offset],
                     )
                 )
@@ -162,10 +162,10 @@ class HiveList(interfaces.plugins.PluginInterface):
                 hive_offsets = [
                     hive.vol.offset
                     for hive in cls.list_hive_objects(
-                        context,
-                        kernel.layer_name,
-                        kernel.symbol_table_name,
-                        filter_string,
+                        context=context,
+                        layer_name=kernel.layer_name,
+                        symbol_table=kernel.symbol_table_name,
+                        filter_string=filter_string,
                     )
                 ]
             except ImportError:

volatility3/framework/plugins/windows/registry/hivescan.py

@@ -50,7 +50,9 @@ class HiveScan(interfaces.plugins.PluginInterface):
 
         kernel = context.modules[kernel_name]
 
-        is_64bit = symbols.symbol_table_is_64bit(context, kernel.symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=kernel.symbol_table_name
+        )
         is_windows_8_1_or_later = versions.is_windows_8_1_or_later(
             context=context, symbol_table=kernel.symbol_table_name
         )

volatility3/framework/plugins/windows/registry/printkey.py

@@ -245,9 +245,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
         recurse: bool = False,
     ):
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             hive_offsets=hive_offsets,
         ):
             try:

volatility3/framework/plugins/windows/registry/userassist.py

@@ -302,9 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac
 
         # get all the user hive offsets or use the one specified
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
             filter_string="ntuser.dat",
             hive_offsets=hive_offsets,
         ):

volatility3/framework/plugins/windows/scheduled_tasks.py

@@ -1140,9 +1140,11 @@ information about triggers, actions, run times, and creation times."""
         """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located."""
         return next(
             hivelist.HiveList.list_hives(
-                context,
-                interfaces.configuration.path_join(config_path, "hivelist"),
-                kernel_module_name,
+                context=context,
+                base_config_path=interfaces.configuration.path_join(
+                    config_path, "hivelist"
+                ),
+                kernel_module_name=kernel_module_name,
                 filter_string="SOFTWARE",
             ),
             None,

volatility3/framework/plugins/windows/sessions.py

@@ -45,8 +45,8 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
         sessions = {}
 
         for proc in pslist.PsList.list_processes(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
             filter_func=filter_func,
         ):
             session_id = proc.get_session_id()

volatility3/framework/plugins/windows/shimcachemem.py

@@ -93,7 +93,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             The name of the constructed shimcache table
         """
         native_types = context.symbol_space[symbol_table_name].natives
-        is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=symbol_table_name
+        )
         table_mapping = {"nt_symbols": symbol_table_name}
 
         try:
@@ -260,7 +262,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
         mod_page_offset, mod_page_size = mod_page
 
         addr_size = (
-            8 if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) else 4
+            8
+            if symbols.symbol_table_is_64bit(
+                context=context, symbol_table_name=kernel.symbol_table_name
+            )
+            else 4
         )
 
         shim_head = None
@@ -322,7 +328,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
         ).size
         ersrc_alignment = (
             0x20
-            if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name)
+            if symbols.symbol_table_is_64bit(
+                context=context, symbol_table_name=kernel.symbol_table_name
+            )
             else 0x10
             # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10
         )
@@ -420,7 +428,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             data_sec_offset + data_sec_size,
             (
                 8
-                if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name)
+                if symbols.symbol_table_is_64bit(
+                    context=context, symbol_table_name=kernel.symbol_table_name
+                )
                 else 4
             ),
         ):
@@ -448,7 +458,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
         # On Windows 8 x64, the first cache contains the shim cache.
         # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache.
         if (
-            not symbols.symbol_table_is_64bit(context, kernel.symbol_table_name)
+            not symbols.symbol_table_is_64bit(
+                context=context, symbol_table_name=kernel.symbol_table_name
+            )
             and not is_8_1_or_later
         ):
             valid_head = shim_heads[1]

volatility3/framework/plugins/windows/skeleton_key_check.py

@@ -568,7 +568,9 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
         """
         kernel = self.context.modules[self.config["kernel"]]
 
-        if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name):
+        if not symbols.symbol_table_is_64bit(
+            context=self.context, symbol_table_name=kernel.symbol_table_name
+        ):
             vollog.info("This plugin only supports 64bit Windows memory samples")
             return None
 
@@ -670,8 +672,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=self._lsass_proc_filter,
                 )
             ),

volatility3/framework/plugins/windows/ssdt.py

@@ -83,8 +83,8 @@ class SSDT(plugins.PluginInterface):
         kernel = self.context.modules[self.config["kernel"]]
 
         collection = self.build_module_collection(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         )
 
         ntkrnlmp = kernel
@@ -101,7 +101,7 @@ class SSDT(plugins.PluginInterface):
         # on 64-bit systems the indexes are also 32-bits but they're offsets from the
         # base address of the table and can be negative, so we need a signed data type
         is_kernel_64 = symbols.symbol_table_is_64bit(
-            self.context, kernel.symbol_table_name
+            context=self.context, symbol_table_name=kernel.symbol_table_name
         )
         if is_kernel_64:
             array_subtype = "long"

volatility3/framework/plugins/windows/strings.py

@@ -73,8 +73,8 @@ class Strings(interfaces.plugins.PluginInterface):
             line = strings_fp.readline()
 
         revmap = self.generate_mapping(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
             progress_callback=self._progress_callback,
             pid_list=self.config["pid"],
         )
@@ -161,9 +161,11 @@ class Strings(interfaces.plugins.PluginInterface):
 
             # TODO: Include kernel modules
 
-            for process in pslist.PsList.list_processes(context, kernel_module_name):
+            for process in pslist.PsList.list_processes(
+                context=context, kernel_module_name=kernel_module_name
+            ):
                 if not filter(process):
-                    proc_id = "Unknown"
+                    kernel_module_name = proc_id = "Unknown"
                     try:
                         proc_id = process.UniqueProcessId
                         proc_layer_name = process.add_process_layer()

volatility3/framework/plugins/windows/suspended_threads.py

@@ -61,7 +61,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface):
         proc_modules = None
 
         # walk the threads of each process checking for suspended threads
-        for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]):
+        for proc in pslist.PsList.list_processes(
+            context=self.context, kernel_module_name=self.config["kernel"]
+        ):
             for thread in threads.Threads.list_threads(kernel, proc):
                 try:
                     # we only care if the thread is suspended
@@ -92,7 +94,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface):
                 # will not have suspended threads
                 if not proc_modules:
                     proc_modules = pe_symbols.PESymbols.get_process_modules(
-                        self.context, self.config["kernel"], None
+                        context=self.context,
+                        kernel_module_name=self.config["kernel"],
+                        filter_modules=None,
                     )
 
                     path_and_symbol = functools.partial(

volatility3/framework/plugins/windows/suspicious_threads.py

@@ -138,8 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface):
         filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
 
         for proc in pslist.PsList.list_processes(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
             filter_func=filter_func,
         ):
             ranges = self._get_ranges(kernel, all_ranges, proc)

volatility3/framework/plugins/windows/svcdiff.py

@@ -65,7 +65,7 @@ class SvcDiff(svcscan.SvcScan):
         kernel = context.modules[kernel_module_name]
 
         if not symbols.symbol_table_is_64bit(
-            context, kernel.symbol_table_name
+            context=context, symbol_table_name=kernel.symbol_table_name
         ) or not versions.is_win10_15063_or_later(
             context=context, symbol_table=kernel.symbol_table_name
         ):

volatility3/framework/plugins/windows/svclist.py

@@ -70,7 +70,7 @@ class SvcList(svcscan.SvcScan):
         kernel = context.modules[kernel_module_name]
 
         if not symbols.symbol_table_is_64bit(
-            context, kernel.symbol_table_name
+            context=context, symbol_table_name=kernel.symbol_table_name
         ) or not versions.is_win10_15063_or_later(
             context=context, symbol_table=kernel.symbol_table_name
         ):
@@ -80,8 +80,8 @@ class SvcList(svcscan.SvcScan):
             return
 
         for proc in pslist.PsList.list_processes(
-            context,
-            kernel_module_name,
+            context=context,
+            kernel_module_name=kernel_module_name,
             filter_func=filter_func,
         ):
             try:

volatility3/framework/plugins/windows/svcscan.py

@@ -121,7 +121,9 @@ class SvcScan(interfaces.plugins.PluginInterface):
             A symbol table containing the symbols necessary for services
         """
         native_types = context.symbol_space[symbol_table_name].natives
-        is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=symbol_table_name
+        )
 
         try:
             symbol_filename = next(
@@ -148,9 +150,11 @@ class SvcScan(interfaces.plugins.PluginInterface):
     ) -> Optional[objects.StructType]:
 
         for hive in hivelist.HiveList.list_hives(
-            context,
-            interfaces.configuration.path_join(config_path, "hivelist"),
-            kernel_module_name,
+            context=context,
+            base_config_path=interfaces.configuration.path_join(
+                config_path, "hivelist"
+            ),
+            kernel_module_name=kernel_module_name,
             filter_string="machine\\system",
         ):
             # Get ControlSet\Services.
@@ -300,7 +304,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
 
         for task in pslist.PsList.list_processes(
             context,
-            kernel_module_name,
+            kernel_module_name=kernel_module_name,
             filter_func=filter_func,
         ):
             proc_id = "Unknown"

volatility3/framework/plugins/windows/threads.py

@@ -69,8 +69,8 @@ class Threads(thrdscan.ThrdScan):
         filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None))
 
         for proc in pslist.PsList.list_processes(
-            context,
-            kernel_module_name,
+            context=context,
+            kernel_module_name=kernel_module_name,
             filter_func=filter_func,
         ):
             yield from cls.list_threads(module, proc)

volatility3/framework/plugins/windows/timers.py

@@ -124,8 +124,8 @@ class Timers(interfaces.plugins.PluginInterface):
         kernel = self.context.modules[self.config["kernel"]]
 
         collection = ssdt.SSDT.build_module_collection(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
         )
 
         # FIXME - the list_timers API is gross. Fix after GUI merge

volatility3/framework/plugins/windows/unhooked_system_calls.py

@@ -151,10 +151,10 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface):
 
     def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]:
         found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
-            unhooked_system_calls.system_calls,
+            context=self.context,
+            config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
+            symbols=unhooked_system_calls.system_calls,
         )
 
         # code_bytes[dll_name][func_name][func_bytes]

volatility3/framework/plugins/windows/unloadedmodules.py

@@ -52,7 +52,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt
             The name of the constructed unloaded modules table
         """
         native_types = context.symbol_space[symbol_table].natives
-        is_64bit = symbols.symbol_table_is_64bit(context, symbol_table)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=symbol_table
+        )
         table_mapping = {"nt_symbols": symbol_table}
 
         if is_64bit:
@@ -100,7 +102,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt
             offset=unloadedmodules_offset,
             subtype="array",
         )
-        is_64bit = symbols.symbol_table_is_64bit(context, symbol_table)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=symbol_table
+        )
 
         if is_64bit:
             unloaded_count_type = "unsigned long long"

volatility3/framework/plugins/windows/vadinfo.py

@@ -292,8 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/vadregexscan.py

@@ -112,8 +112,8 @@ class VadRegExScan(plugins.PluginInterface):
     def run(self):
         filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
         procs = pslist.PsList.list_processes(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
             filter_func=filter_func,
         )
         return renderers.TreeGrid(

volatility3/framework/plugins/windows/vadwalk.py

@@ -83,8 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface):
             ],
             self._generator(
                 pslist.PsList.list_processes(
-                    self.context,
-                    self.config["kernel"],
+                    context=self.context,
+                    kernel_module_name=self.config["kernel"],
                     filter_func=filter_func,
                 )
             ),

volatility3/framework/plugins/windows/vadyarascan.py

@@ -60,8 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
         sanity_check = 1024 * 1024 * 1024  # 1 GB
 
         for task in pslist.PsList.list_processes(
-            self.context,
-            self.config["kernel"],
+            context=self.context,
+            kernel_module_name=self.config["kernel"],
             filter_func=filter_func,
         ):
             layer_name = task.add_process_layer()

volatility3/framework/plugins/windows/verinfo.py

@@ -253,13 +253,15 @@ class VerInfo(interfaces.plugins.PluginInterface):
                 )
 
     def run(self):
-        procs = pslist.PsList.list_processes(self.context, self.config["kernel"])
+        procs = pslist.PsList.list_processes(
+            context=self.context, kernel_module_name=self.config["kernel"]
+        )
 
         mods = modules.Modules.list_modules(self.context, self.config["kernel"])
 
         # populate the session layers for kernel modules
         session_layers = modules.Modules.get_session_layers(
-            self.context, self.config["kernel"]
+            context=self.context, kernel_module_name=self.config["kernel"]
         )
 
         return renderers.TreeGrid(

volatility3/framework/plugins/windows/windowstations.py

@@ -67,7 +67,9 @@ class WindowStations(interfaces.plugins.PluginInterface):
 
         native_types = intermed.native.x64NativeTable
 
-        if not symbols.symbol_table_is_64bit(context, symbol_table):
+        if not symbols.symbol_table_is_64bit(
+            context=context, symbol_table_name=symbol_table
+        ):
             raise NotImplementedError(
                 "This plugin only supports x64 versions of Windows"
             )
@@ -86,10 +88,10 @@ class WindowStations(interfaces.plugins.PluginInterface):
         vollog.debug(f"Using GUI table {symbol_filename}")
 
         return intermed.IntermediateSymbolTable.create(
-            context,
-            config_path,
-            os.path.join("windows", "gui"),
-            symbol_filename,
+            context=context,
+            config_path=config_path,
+            sub_path=os.path.join("windows", "gui"),
+            filename=symbol_filename,
             class_types=gui.class_types,
             native_types=native_types,
             table_mapping=table_mapping,
@@ -152,11 +154,11 @@ class WindowStations(interfaces.plugins.PluginInterface):
         session_map = cls.get_session_map(context, kernel_module_name, gui_table_name)
 
         for result in poolscanner.PoolScanner.generate_pool_scan_extended(
-            context,
-            kernel.layer_name,
-            kernel.symbol_table_name,
-            gui_table_name,
-            constraints,
+            context=context,
+            kernel_layer_name=kernel.layer_name,
+            kernel_symbol_table_name=kernel.symbol_table_name,
+            object_symbol_table_name=gui_table_name,
+            constraints=constraints,
         ):
             _constraint, mem_object, _header = result
 

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -237,7 +237,9 @@ class module(generic.GenericIntelProcess):
         elf_table_name = self.get_elf_table_name()
         symbol_table_name = self.get_symbol_table_name()
 
-        is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=self._context, symbol_table_name=symbol_table_name
+        )
         sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym"
         sym_type = self._context.symbol_space.get_type(
             elf_table_name + constants.BANG + sym_name
@@ -280,7 +282,9 @@ class module(generic.GenericIntelProcess):
         elf_table_name = self.get_elf_table_name()
         symbol_table_name = self.get_symbol_table_name()
 
-        is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=self._context, symbol_table_name=symbol_table_name
+        )
         sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym"
         sym_type = self._context.symbol_space.get_type(
             elf_table_name + constants.BANG + sym_name

volatility3/framework/symbols/windows/extensions/__init__.py

@@ -53,7 +53,9 @@ class MMVAD_SHORT(objects.StructType):
 
         # the offset is different on 32 and 64 bits
         symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
-        if not symbols.symbol_table_is_64bit(self._context, symbol_table_name):
+        if not symbols.symbol_table_is_64bit(
+            context=self._context, symbol_table_name=symbol_table_name
+        ):
             vad_address -= 4
         else:
             vad_address -= 12
@@ -389,7 +391,9 @@ class EX_FAST_REF(objects.StructType):
 
         # the mask value is different on 32 and 64 bits
         symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
-        if not symbols.symbol_table_is_64bit(self._context, symbol_table_name):
+        if not symbols.symbol_table_is_64bit(
+            context=self._context, symbol_table_name=symbol_table_name
+        ):
             max_fast_ref = 7
         else:
             max_fast_ref = 15
@@ -1406,7 +1410,9 @@ class CONTROL_AREA(objects.StructType):
         )
         mmpte_size = mmpte_type.size
         subsection = self.get_subsection()
-        is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name)
+        is_64bit = symbols.symbol_table_is_64bit(
+            context=self._context, symbol_table_name=symbol_table_name
+        )
         is_pae = self._context.layers[self.vol.layer_name].metadata.get("pae", False)
 
         # the sector_size is used as a multiplier to the StartingSector

volatility3/framework/symbols/windows/extensions/pool.py

@@ -78,7 +78,9 @@ class POOL_HEADER(objects.StructType):
 
         # otherwise we have an executive object in the pool
         else:
-            if symbols.symbol_table_is_64bit(self._context, symbol_table_name):
+            if symbols.symbol_table_is_64bit(
+                context=self._context, symbol_table_name=symbol_table_name
+            ):
                 alignment = 16
             else:
                 alignment = 8

volatility3/plugins/windows/registry/certificates.py

@@ -70,9 +70,9 @@ class Certificates(interfaces.plugins.PluginInterface):
 
     def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]:
         for hive in hivelist.HiveList.list_hives(
-            self.context,
-            self.config_path,
-            self.config["kernel"],
+            context=self.context,
+            base_config_path=self.config_path,
+            kernel_module_name=self.config["kernel"],
         ):
             for top_key in [
                 "Microsoft\\SystemCertificates",