Windows SSDT: Updates plugin consumers

Updates all plugins that use the `ssdt` module with correct parameters
and updated version requirement values.

volatility3/framework/plugins/windows/callbacks.py

@@ -39,7 +39,7 @@ class Callbacks(interfaces.plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
                 name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0)
@@ -691,7 +691,7 @@ class Callbacks(interfaces.plugins.PluginInterface):
         )
 
         collection = ssdt.SSDT.build_module_collection(
-            self.context, kernel.layer_name, kernel.symbol_table_name
+            self.context, self.config["kernel"]
         )
 
         callback_methods = (

volatility3/framework/plugins/windows/driverirp.py

@@ -59,7 +59,7 @@ class DriverIrp(interfaces.plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
                 name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0)
@@ -70,10 +70,8 @@ class DriverIrp(interfaces.plugins.PluginInterface):
         ]
 
     def _generator(self):
-        kernel = self.context.modules[self.config["kernel"]]
-
         collection = ssdt.SSDT.build_module_collection(
-            self.context, kernel.layer_name, kernel.symbol_table_name
+            self.context, self.config["kernel"]
         )
 
         kernel_space_start = modules.Modules.get_kernel_space_start(

volatility3/framework/plugins/windows/drivermodule.py

@@ -26,7 +26,7 @@ class DriverModule(interfaces.plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
                 name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0)
@@ -42,10 +42,8 @@ class DriverModule(interfaces.plugins.PluginInterface):
         A common rootkit technique is to register drivers from modules that are hidden,
         which allows us to detect the disconnect between a malicious driver and its hidden module.
         """
-        kernel = self.context.modules[self.config["kernel"]]
-
         collection = ssdt.SSDT.build_module_collection(
-            self.context, kernel.layer_name, kernel.symbol_table_name
+            self.context, self.config["kernel"]
         )
 
         kernel_space_start = modules.Modules.get_kernel_space_start(

volatility3/framework/plugins/windows/orphan_kernel_threads.py

@@ -35,7 +35,7 @@ class Threads(thrdscan.ThrdScan):
                 name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0)
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
                 name="modules", plugin=modules.Modules, version=(2, 1, 0)
@@ -57,13 +57,7 @@ class Threads(thrdscan.ThrdScan):
         Returns:
             A generator of thread objects of orphaned threads
         """
-        module = context.modules[module_name]
-        layer_name = module.layer_name
-        symbol_table_name = module.symbol_table_name
-
-        collection = ssdt.SSDT.build_module_collection(
-            context, layer_name, symbol_table_name
-        )
+        collection = ssdt.SSDT.build_module_collection(context, module_name)
 
         kernel_space_start = modules.Modules.get_kernel_space_start(
             context, module_name

volatility3/framework/plugins/windows/registry/getcellroutine.py

@@ -31,15 +31,13 @@ class GetCellRoutine(interfaces.plugins.PluginInterface):
                 name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
         ]
 
     def _generator(self):
-        kernel = self.context.modules[self.config["kernel"]]
-
         collection = ssdt.SSDT.build_module_collection(
-            self.context, kernel.layer_name, kernel.symbol_table_name
+            self.context, self.config["kernel"]
         )
 
         # walk each hive and validate that the GetCellRoutine handler

volatility3/framework/plugins/windows/timers.py

@@ -35,7 +35,7 @@ class Timers(interfaces.plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.PluginRequirement(
-                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+                name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
                 name="kpcrs", plugin=kpcrs.KPCRs, version=(1, 0, 0)
@@ -122,15 +122,18 @@ class Timers(interfaces.plugins.PluginInterface):
 
     def _generator(self) -> Iterator[Tuple]:
         kernel = self.context.modules[self.config["kernel"]]
-        layer_name = kernel.layer_name
-        symbol_table = kernel.symbol_table_name
 
         collection = ssdt.SSDT.build_module_collection(
-            self.context, kernel.layer_name, kernel.symbol_table_name
+            self.context,
+            self.config["kernel"],
         )
 
+        # FIXME - the list_timers API is gross. Fix after GUI merge
         for timer in self.list_timers(
-            self.context, self.config["kernel"], layer_name, symbol_table
+            self.context,
+            self.config["kernel"],
+            kernel.layer_name,
+            kernel.symbol_table_name,
         ):
             if not timer.valid_type():
                 continue