Windows SSDT: Simplify build_module_collection signature

This simplifies the `build_module_collection` signature to take a single
`kernel_module_name` parameter instead of `layer_name` and
`symbol_table_name` parameters, both of which would only ever belong to
the kernel anyway. This will prevent future confusion for consumers of
this method.

Co-authored-by: Andrew Case <andrew@dfir.org>

volatility3/framework/plugins/windows/ssdt.py

@@ -19,7 +19,9 @@ class SSDT(plugins.PluginInterface):
     """Lists the system call table."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 1)
+
+    # 2.0.0 - changed the signature of `build_module_collection`
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -38,23 +40,23 @@ class SSDT(plugins.PluginInterface):
     def build_module_collection(
         cls,
         context: interfaces.context.ContextInterface,
-        layer_name: str,
-        symbol_table: str,
+        kernel_module_name: str,
     ) -> contexts.ModuleCollection:
         """Builds a collection of modules.
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            symbol_table: The name of the table containing the kernel symbols
+            kernel_module_name: Name of the module for the kernel
 
         Returns:
             A Module collection of available modules based on `Modules.list_modules`
         """
 
-        mods = modules.Modules.list_modules(context, layer_name, symbol_table)
+        mods = modules.Modules.list_modules(context, kernel_module_name)
         context_modules = []
 
+        kernel = context.modules[kernel_module_name]
+
         for mod in mods:
             try:
                 module_name_with_ext = mod.BaseDllName.get_string()
@@ -64,17 +66,13 @@ class SSDT(plugins.PluginInterface):
 
             module_name = os.path.splitext(module_name_with_ext)[0]
 
-            symbol_table_name = None
-            if module_name in constants.windows.KERNEL_MODULE_NAMES:
-                symbol_table_name = symbol_table
-
             context_module = contexts.SizedModule.create(
                 context=context,
                 module_name=module_name,
-                layer_name=layer_name,
+                layer_name=kernel.layer_name,
                 offset=mod.DllBase,
                 size=mod.SizeOfImage,
-                symbol_table_name=symbol_table_name,
+                symbol_table_name=kernel.symbol_table_name,
             )
 
             context_modules.append(context_module)
@@ -84,9 +82,9 @@ class SSDT(plugins.PluginInterface):
     def _generator(self) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
         kernel = self.context.modules[self.config["kernel"]]
 
-        layer_name = kernel.layer_name
         collection = self.build_module_collection(
-            self.context, layer_name, kernel.symbol_table_name
+            self.context,
+            self.config["kernel"],
         )
 
         ntkrnlmp = kernel