From 60df83ef159b5671f6881252de86ca800491f5ce Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 16 Jun 2018 14:03:22 +0100
Subject: [PATCH] Convert modules/moddump to classmethod.

---
 volatility/plugins/windows/moddump.py |  9 +++++----
 volatility/plugins/windows/modules.py | 19 +++++++++++--------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/volatility/plugins/windows/moddump.py b/volatility/plugins/windows/moddump.py
index d7b9c9d97..6c3677fec 100644
--- a/volatility/plugins/windows/moddump.py
+++ b/volatility/plugins/windows/moddump.py
@@ -17,8 +17,8 @@ class ModDump(interfaces_plugins.PluginInterface):
 
     @classmethod
     def get_requirements(cls):
-        # Since we're calling the plugin, make sure we have the plugin's requirements
-        return modules.Modules.get_requirements() + pslist.PsList.get_requirements()
+        # Reuse the requirements from the plugins we use
+        return modules.Modules.get_requirements()
 
     def get_session_layers(self):
         """Build a cache of possible virtual layers, in priority starting with
@@ -124,9 +124,10 @@ class ModDump(interfaces_plugins.PluginInterface):
                        result_text))
 
     def run(self):
-        plugin = modules.Modules(self.context, self.config_path)
 
         return renderers.TreeGrid([("Base", format_hints.Hex),
                                    ("Name", str),
                                    ("Result", str)],
-                                  self._generator(plugin.list_modules()))
+                                  self._generator(modules.Modules.list_modules(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'])))
diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py
index 942b5e1c9..670d45b63 100644
--- a/volatility/plugins/windows/modules.py
+++ b/volatility/plugins/windows/modules.py
@@ -1,9 +1,10 @@
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import exceptions
+from volatility.framework import constants
+from volatility.framework import exceptions, interfaces
 from volatility.framework import renderers
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
-from volatility.framework import constants
+
 
 class Modules(plugins.PluginInterface):
     """Lists the loaded kernel modules"""
@@ -16,7 +17,7 @@ class Modules(plugins.PluginInterface):
                 requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")]
 
     def _generator(self):
-        for mod in self.list_modules():
+        for mod in self.list_modules(self.context, self.config['primary'], self.config['nt_symbols']):
 
             try:
                 BaseDllName = mod.BaseDllName.get_string()
@@ -35,13 +36,15 @@ class Modules(plugins.PluginInterface):
                        FullDllName,
                        ))
 
-    def list_modules(self):
+    @classmethod
+    def list_modules(cls,
+                     context: interfaces.context.ContextInterface,
+                     layer_name: str,
+                     nt_symbols: str):
         """Lists all the modules in the primary layer"""
 
-        layer_name = self.config['primary']
-
-        kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
-        ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo)
+        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo)
 
         try:
             # use this type if its available (starting with windows 10)