From cd2f40bc34bdf1bc6e3ad463781263a5bfc5f165 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 22 Jul 2021 22:42:06 +0100
Subject: [PATCH] Mac: Update all plugins to ModuleRequirement

---
 volatility3/framework/plugins/mac/bash.py     | 16 +++--
 .../framework/plugins/mac/check_syscall.py    | 21 +++----
 .../framework/plugins/mac/check_sysctl.py     | 20 +++---
 .../framework/plugins/mac/check_trap_table.py | 20 +++---
 volatility3/framework/plugins/mac/ifconfig.py | 11 ++--
 .../framework/plugins/mac/kauth_listeners.py  | 26 ++++----
 .../framework/plugins/mac/kauth_scopes.py     | 38 ++++++------
 volatility3/framework/plugins/mac/kevents.py  | 21 +++----
 .../framework/plugins/mac/list_files.py       | 22 +++----
 volatility3/framework/plugins/mac/lsmod.py    | 20 +++---
 volatility3/framework/plugins/mac/lsof.py     | 14 ++---
 volatility3/framework/plugins/mac/malfind.py  | 16 ++---
 volatility3/framework/plugins/mac/mount.py    | 18 +++---
 volatility3/framework/plugins/mac/netstat.py  | 19 +++---
 .../framework/plugins/mac/proc_maps.py        | 13 ++--
 volatility3/framework/plugins/mac/psaux.py    | 11 ++--
 volatility3/framework/plugins/mac/pslist.py   | 62 +++++++------------
 volatility3/framework/plugins/mac/pstree.py   | 12 ++--
 .../framework/plugins/mac/socket_filters.py   | 18 +++---
 volatility3/framework/plugins/mac/timers.py   | 27 ++++----
 .../framework/plugins/mac/trustedbsd.py       | 25 ++++----
 .../framework/plugins/mac/vfsevents.py        | 13 ++--
 22 files changed, 202 insertions(+), 261 deletions(-)

diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py
index c769d405a..e2e39e20d 100644
--- a/volatility3/framework/plugins/mac/bash.py
+++ b/volatility3/framework/plugins/mac/bash.py
@@ -20,16 +20,13 @@ from volatility3.plugins.mac import pslist
 class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Recovers bash command history from memory."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
                                          element_type = int,
@@ -37,7 +34,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
         ]
 
     def _generator(self, tasks):
-        is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"])
+        is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin.symbol_table_name"])
         if is_32bit:
             pack_format = "I"
             bash_json_file = "bash32"
@@ -96,7 +93,6 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
                                    ("Command", str)],
                                   self._generator(
                                       list_tasks(self.context,
-                                                 self.config['primary'],
                                                  self.config['darwin'],
                                                  filter_func = filter_func)))
 
@@ -105,7 +101,9 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
         list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
 
         for row in self._generator(
-                list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)):
+                list_tasks(self.context,
+                           self.config['darwin'],
+                           filter_func = filter_func)):
             _depth, row_data = row
             description = f"{row_data[0]} ({row_data[1]}): \"{row_data[3]}\""
             yield (description, timeliner.TimeLinerType.CREATED, row_data[2])
diff --git a/volatility3/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py
index 4f367001e..4d96c1733 100644
--- a/volatility3/framework/plugins/mac/check_syscall.py
+++ b/volatility3/framework/plugins/mac/check_syscall.py
@@ -5,7 +5,7 @@ import logging
 from typing import List
 
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.renderers import format_hints
@@ -18,25 +18,23 @@ vollog = logging.getLogger(__name__)
 class Check_syscall(plugins.PluginInterface):
     """Check system call table for hooks."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     def _generator(self):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         nsysent = kernel.object_from_symbol(symbol_name = "nsysent")
         table = kernel.object_from_symbol(symbol_name = "sysent")
@@ -55,7 +53,8 @@ class Check_syscall(plugins.PluginInterface):
             if not call_addr or call_addr == 0:
                 continue
 
-            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
+            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers,
+                                                                              call_addr, self.config['darwin'])
 
             yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name,
                        symbol_name))
diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py
index 4ea1d8af0..0f755d37d 100644
--- a/volatility3/framework/plugins/mac/check_sysctl.py
+++ b/volatility3/framework/plugins/mac/check_sysctl.py
@@ -6,7 +6,7 @@ from typing import List
 
 import volatility3
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -20,17 +20,14 @@ vollog = logging.getLogger(__name__)
 class Check_sysctl(plugins.PluginInterface):
     """Check sysctl handlers for hooks."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     def _parse_global_variable_sysctls(self, kernel, name):
@@ -115,11 +112,11 @@ class Check_sysctl(plugins.PluginInterface):
                 break
 
     def _generator(self):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children")
 
@@ -129,7 +126,8 @@ class Check_sysctl(plugins.PluginInterface):
             except exceptions.InvalidAddressException:
                 continue
 
-            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr)
+            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr,
+                                                                              self.config['darwin'])
 
             yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name,
                        symbol_name))
diff --git a/volatility3/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py
index 0584d9ff7..3adb3b5e0 100644
--- a/volatility3/framework/plugins/mac/check_trap_table.py
+++ b/volatility3/framework/plugins/mac/check_trap_table.py
@@ -6,7 +6,7 @@ import logging
 from typing import List
 
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.renderers import format_hints
@@ -19,25 +19,22 @@ vollog = logging.getLogger(__name__)
 class Check_trap_table(plugins.PluginInterface):
     """Check mach trap table for hooks."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
         ]
 
     def _generator(self):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         table = kernel.object_from_symbol(symbol_name = "mach_trap_table")
 
@@ -50,7 +47,8 @@ class Check_trap_table(plugins.PluginInterface):
             if not call_addr or call_addr == 0:
                 continue
 
-            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
+            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr,
+                                                                              self.config['darwin'])
 
             yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name,
                        symbol_name))
diff --git a/volatility3/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py
index 4aeaf1564..e70ffd3a2 100644
--- a/volatility3/framework/plugins/mac/ifconfig.py
+++ b/volatility3/framework/plugins/mac/ifconfig.py
@@ -1,7 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-from volatility3.framework import exceptions, renderers, contexts
+from volatility3.framework import exceptions, renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -11,20 +11,17 @@ from volatility3.framework.symbols import mac
 class Ifconfig(plugins.PluginInterface):
     """Lists loaded kernel modules"""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0))
         ]
 
     def _generator(self):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
         try:
             list_head = kernel.object_from_symbol(symbol_name = "ifnet_head")
diff --git a/volatility3/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py
index 930239db9..803664350 100644
--- a/volatility3/framework/plugins/mac/kauth_listeners.py
+++ b/volatility3/framework/plugins/mac/kauth_listeners.py
@@ -2,7 +2,7 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-from volatility3.framework import renderers, interfaces, contexts
+from volatility3.framework import renderers, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
@@ -13,34 +13,31 @@ from volatility3.plugins.mac import lsmod, kauth_scopes
 class Kauth_listeners(interfaces.plugins.PluginInterface):
     """ Lists kauth listeners and their status """
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)),
             requirements.PluginRequirement(name = 'kauth_scopes',
                                            plugin = kauth_scopes.Kauth_scopes,
-                                           version = (1, 0, 0))
+                                           version = (2, 0, 0))
         ]
 
     def _generator(self):
         """
         Enumerates the listeners for each kauth scope
         """
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
-        for scope in kauth_scopes.Kauth_scopes.list_kauth_scopes(self.context, self.config['primary'],
-                                                                 self.config['darwin']):
+        for scope in kauth_scopes.Kauth_scopes.list_kauth_scopes(self.context, self.config['darwin']):
 
             scope_name = utility.pointer_to_string(scope.ks_identifier, 128)
 
@@ -49,7 +46,8 @@ class Kauth_listeners(interfaces.plugins.PluginInterface):
                 if callback == 0:
                     continue
 
-                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback)
+                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback,
+                                                                                  self.config['darwin'])
 
                 yield (0, (scope_name, format_hints.Hex(listener.kll_idata), format_hints.Hex(callback), module_name,
                            symbol_name))
diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py
index a5f57d9a1..7f5a20d8f 100644
--- a/volatility3/framework/plugins/mac/kauth_scopes.py
+++ b/volatility3/framework/plugins/mac/kauth_scopes.py
@@ -1,39 +1,38 @@
 # This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-
+import logging
 from typing import Iterable, Callable, Tuple
 
-from volatility3.framework import renderers, interfaces, contexts
+from volatility3.framework import renderers, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import mac
 from volatility3.plugins.mac import lsmod
 
+vollog = logging.getLogger(__name__)
+
 
 class Kauth_scopes(interfaces.plugins.PluginInterface):
     """ Lists kauth scopes and their status """
 
-    _version = (1, 0, 0)
-    _required_framework_version = (1, 0, 0)
+    _version = (2, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     @classmethod
     def list_kauth_scopes(cls,
                           context: interfaces.context.ContextInterface,
-                          layer_name: str,
-                          darwin_symbols: str,
+                          kernel_module_name: str,
                           filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[Tuple[interfaces.objects.ObjectInterface,
                            interfaces.objects.ObjectInterface,
@@ -42,28 +41,29 @@ class Kauth_scopes(interfaces.plugins.PluginInterface):
         Enumerates the registered kauth scopes and yields each object
         Uses smear-safe enumeration API
         """
-
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         scopes = kernel.object_from_symbol("kauth_scopes")
 
         for scope in mac.MacUtilities.walk_tailq(scopes, "ks_link"):
-            yield scope
+            if not filter_func(scope):
+                yield scope
 
     def _generator(self):
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
-        for scope in self.list_kauth_scopes(self.context, self.config['primary'], self.config['darwin']):
+        for scope in self.list_kauth_scopes(self.context, self.config['darwin']):
 
             callback = scope.ks_callback
             if callback == 0:
                 continue
 
-            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback)
+            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback,
+                                                                              self.config['darwin'])
 
             identifier = utility.pointer_to_string(scope.ks_identifier, 128)
 
diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py
index a6d905102..47087ce38 100644
--- a/volatility3/framework/plugins/mac/kevents.py
+++ b/volatility3/framework/plugins/mac/kevents.py
@@ -4,7 +4,7 @@
 
 from typing import Iterable, Callable, Tuple
 
-from volatility3.framework import renderers, interfaces, exceptions, contexts
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols import mac
@@ -14,7 +14,8 @@ from volatility3.plugins.mac import pslist
 class Kevents(interfaces.plugins.PluginInterface):
     """ Lists event handlers registered by processes """
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
+    _version = (1, 0, 0)
 
     event_types = {
         1: "EVFILT_READ",
@@ -47,11 +48,9 @@ class Kevents(interfaces.plugins.PluginInterface):
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 2, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
@@ -120,8 +119,7 @@ class Kevents(interfaces.plugins.PluginInterface):
     @classmethod
     def list_kernel_events(cls,
                            context: interfaces.context.ContextInterface,
-                           layer_name: str,
-                           darwin_symbols: str,
+                           kernel_module_name: str,
                            filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[Tuple[interfaces.objects.ObjectInterface,
                            interfaces.objects.ObjectInterface,
@@ -135,11 +133,11 @@ class Kevents(interfaces.plugins.PluginInterface):
                 2) The process ID of the process that registered the filter
                 3) The object of the associated kernel event filter
         """
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0])
 
-        for task in list_tasks(context, layer_name, darwin_symbols, filter_func):
+        for task in list_tasks(context, kernel_module_name, filter_func):
             task_name = utility.array_to_string(task.p_comm)
             pid = task.p_pid
 
@@ -150,7 +148,6 @@ class Kevents(interfaces.plugins.PluginInterface):
         filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
 
         for task_name, pid, kn in self.list_kernel_events(self.context,
-                                                          self.config['primary'],
                                                           self.config['darwin'],
                                                           filter_func = filter_func):
 
diff --git a/volatility3/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py
index 557e735ed..edc37c2a0 100644
--- a/volatility3/framework/plugins/mac/list_files.py
+++ b/volatility3/framework/plugins/mac/list_files.py
@@ -18,16 +18,14 @@ vollog = logging.getLogger(__name__)
 class List_Files(plugins.PluginInterface):
     """Lists all open file descriptors for all processes."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Kernel Address Space',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
-            requirements.PluginRequirement(name = 'mount', plugin = mount.Mount, version = (1, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'mount', plugin = mount.Mount, version = (2, 0, 0)),
         ]
 
     @classmethod
@@ -114,14 +112,13 @@ class List_Files(plugins.PluginInterface):
     @classmethod
     def _walk_mounts(cls,
                      context: interfaces.context.ContextInterface,
-                     layer_name: str,
-                     darwin_symbols: str) -> \
+                     kernel_module_name: str) -> \
             Iterable[interfaces.objects.ObjectInterface]:
 
         loop_vnodes = {}
 
         # iterate each vnode source from each mount
-        list_mounts = mount.Mount.list_mounts(context, layer_name, darwin_symbols)
+        list_mounts = mount.Mount.list_mounts(context, kernel_module_name)
         for mnt in list_mounts:
             cls._walk_vnodelist(mnt.mnt_vnodelist, loop_vnodes)
             cls._walk_vnodelist(mnt.mnt_workerqueue, loop_vnodes)
@@ -157,11 +154,10 @@ class List_Files(plugins.PluginInterface):
     @classmethod
     def list_files(cls,
                    context: interfaces.context.ContextInterface,
-                   layer_name: str,
-                   darwin_symbols: str) -> \
+                   kernel_module_name: str) -> \
             Iterable[interfaces.objects.ObjectInterface]:
 
-        vnodes = cls._walk_mounts(context, layer_name, darwin_symbols)
+        vnodes = cls._walk_mounts(context, kernel_module_name)
 
         for voff, (vnode_name, parent_offset, vnode) in vnodes.items():
             full_path = cls._build_path(vnodes, vnode_name, parent_offset)
@@ -169,7 +165,7 @@ class List_Files(plugins.PluginInterface):
             yield vnode, full_path
 
     def _generator(self):
-        for vnode, full_path in self.list_files(self.context, self.config['primary'], self.config['darwin']):
+        for vnode, full_path in self.list_files(self.context, self.config['darwin']):
 
             yield (0, (format_hints.Hex(vnode), full_path))
 
diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py
index 7227c3289..18c9a37f7 100644
--- a/volatility3/framework/plugins/mac/lsmod.py
+++ b/volatility3/framework/plugins/mac/lsmod.py
@@ -5,7 +5,7 @@
 found in Mac's lsmod command."""
 from typing import Set
 
-from volatility3.framework import renderers, interfaces, contexts, exceptions
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -15,21 +15,19 @@ from volatility3.framework.renderers import format_hints
 class Lsmod(plugins.PluginInterface):
     """Lists loaded kernel modules."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
-    _version = (1, 0, 0)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel")
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
         ]
 
     @classmethod
-    def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str):
+    def list_modules(cls, context: interfaces.context.ContextInterface, darwin_module_name: str):
         """Lists all the modules in the primary layer.
 
         Args:
@@ -40,8 +38,8 @@ class Lsmod(plugins.PluginInterface):
         Returns:
             A list of modules from the `layer_name` layer
         """
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
-        kernel_layer = context.layers[layer_name]
+        kernel = context.modules[darwin_module_name]
+        kernel_layer = context.layers[kernel.layer_name]
 
         kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod")
 
@@ -78,7 +76,7 @@ class Lsmod(plugins.PluginInterface):
                 return
 
     def _generator(self):
-        for module in self.list_modules(self.context, self.config['primary'], self.config['darwin']):
+        for module in self.list_modules(self.context, self.config['darwin']):
 
             mod_name = utility.array_to_string(module.name)
             mod_size = module.size
diff --git a/volatility3/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py
index f4fb725a0..a7f2250cd 100644
--- a/volatility3/framework/plugins/mac/lsof.py
+++ b/volatility3/framework/plugins/mac/lsof.py
@@ -16,17 +16,15 @@ vollog = logging.getLogger(__name__)
 class Lsof(plugins.PluginInterface):
     """Lists all open file descriptors for all processes."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Kernel Address Space',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
                                          element_type = int,
@@ -37,7 +35,8 @@ class Lsof(plugins.PluginInterface):
         for task in tasks:
             pid = task.p_pid
 
-            for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'],
+            for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config[
+                'darwin.symbol_table_name'],
                                                                                   task):
                 if filepath and len(filepath) > 0:
                     yield (0, (pid, fd, filepath))
@@ -49,6 +48,5 @@ class Lsof(plugins.PluginInterface):
         return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)],
                                   self._generator(
                                       list_tasks(self.context,
-                                                 self.config['primary'],
                                                  self.config['darwin'],
                                                  filter_func = filter_func)))
diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py
index 20b46528b..98d876c90 100644
--- a/volatility3/framework/plugins/mac/malfind.py
+++ b/volatility3/framework/plugins/mac/malfind.py
@@ -2,7 +2,6 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-from volatility3.framework import constants
 from volatility3.framework import interfaces
 from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
@@ -14,16 +13,14 @@ from volatility3.plugins.mac import pslist
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
                                          element_type = int,
@@ -41,13 +38,13 @@ class Malfind(interfaces.plugins.PluginInterface):
         proc_layer = self.context.layers[proc_layer_name]
 
         for vma in task.get_map_iter():
-            if not vma.is_suspicious(self.context, self.config['darwin']):
+            if not vma.is_suspicious(self.context, self.context.modules[self.config['darwin']].symbol_table_name):
                 data = proc_layer.read(vma.links.start, 64, pad = True)
                 yield vma, data
 
     def _generator(self, tasks):
         # determine if we're on a 32 or 64 bit kernel
-        if self.context.symbol_space.get_type(self.config["darwin"] + constants.BANG + "pointer").size == 4:
+        if self.context.modules[self.config['darwin']].get_type("pointer").size == 4:
             is_32bit_arch = True
         else:
             is_32bit_arch = False
@@ -75,6 +72,5 @@ class Malfind(interfaces.plugins.PluginInterface):
                                    ("Disasm", interfaces.renderers.Disassembly)],
                                   self._generator(
                                       list_tasks(self.context,
-                                                 self.config['primary'],
                                                  self.config['darwin'],
                                                  filter_func = filter_func)))
diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py
index 3500e5ff1..8eceb040c 100644
--- a/volatility3/framework/plugins/mac/mount.py
+++ b/volatility3/framework/plugins/mac/mount.py
@@ -3,7 +3,7 @@
 #
 """A module containing a collection of plugins that produce data typically
 found in Mac's mount command."""
-from volatility3.framework import renderers, interfaces, contexts
+from volatility3.framework import renderers, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -14,22 +14,20 @@ class Mount(plugins.PluginInterface):
     """A module containing a collection of plugins that produce data typically
     foundin Mac's mount command"""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
-    _version = (1, 0, 0)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
         ]
 
     @classmethod
-    def list_mounts(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str):
+    def list_mounts(cls, context: interfaces.context.ContextInterface, kernel_module_name: str):
         """Lists all the mount structures in the primary layer.
 
         Args:
@@ -40,7 +38,7 @@ class Mount(plugins.PluginInterface):
         Returns:
             A list of mount structures from the `layer_name` layer
         """
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         list_head = kernel.object_from_symbol(symbol_name = "mountlist")
 
@@ -48,7 +46,7 @@ class Mount(plugins.PluginInterface):
             yield mount
 
     def _generator(self):
-        for mount in self.list_mounts(self.context, self.config['primary'], self.config['darwin']):
+        for mount in self.list_mounts(self.context, self.config['darwin']):
             vfs = mount.mnt_vfsstat
             device_name = utility.array_to_string(vfs.f_mntonname)
             mount_point = utility.array_to_string(vfs.f_mntfromname)
diff --git a/volatility3/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py
index 3b6bba900..67c9cb217 100644
--- a/volatility3/framework/plugins/mac/netstat.py
+++ b/volatility3/framework/plugins/mac/netstat.py
@@ -19,16 +19,14 @@ vollog = logging.getLogger(__name__)
 class Netstat(plugins.PluginInterface):
     """Lists all network connections for all processes."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Kernel Address Space',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
@@ -39,8 +37,7 @@ class Netstat(plugins.PluginInterface):
     @classmethod
     def list_sockets(cls,
                      context: interfaces.context.ContextInterface,
-                     layer_name: str,
-                     darwin_symbols: str,
+                     kernel_module_name: str,
                      filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[Tuple[interfaces.objects.ObjectInterface,
                            interfaces.objects.ObjectInterface,
@@ -56,12 +53,13 @@ class Netstat(plugins.PluginInterface):
         """
         # This is hardcoded, since a change in the default method would change the expected results
         list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0])
-        for task in list_tasks(context, layer_name, darwin_symbols, filter_func):
+        for task in list_tasks(context, kernel_module_name, filter_func):
 
             task_name = utility.array_to_string(task.p_comm)
             pid = task.p_pid
 
-            for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(context, darwin_symbols, task):
+            for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(context, context.modules[
+                kernel_module_name].symbol_table_name, task):
                 try:
                     ftype = filp.f_fglob.get_fg_type()
                 except exceptions.InvalidAddressException:
@@ -81,7 +79,6 @@ class Netstat(plugins.PluginInterface):
         filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
 
         for task_name, pid, socket in self.list_sockets(self.context,
-                                                        self.config['primary'],
                                                         self.config['darwin'],
                                                         filter_func = filter_func):
 
diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py
index 2ff80c47e..e9912797c 100644
--- a/volatility3/framework/plugins/mac/proc_maps.py
+++ b/volatility3/framework/plugins/mac/proc_maps.py
@@ -12,16 +12,14 @@ from volatility3.plugins.mac import pslist
 class Maps(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
                                          element_type = int,
@@ -34,7 +32,7 @@ class Maps(interfaces.plugins.PluginInterface):
             process_pid = task.p_pid
 
             for vma in task.get_map_iter():
-                path = vma.get_path(self.context, self.config['darwin'])
+                path = vma.get_path(self.context, self.context.modules[self.config['darwin']].symbol_table_name)
                 if path == "":
                     path = vma.get_special_path()
 
@@ -49,6 +47,5 @@ class Maps(interfaces.plugins.PluginInterface):
                                    ("End", format_hints.Hex), ("Protection", str), ("Map Name", str)],
                                   self._generator(
                                       list_tasks(self.context,
-                                                 self.config['primary'],
                                                  self.config['darwin'],
                                                  filter_func = filter_func)))
diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py
index 14d765ef8..73d4b16c5 100644
--- a/volatility3/framework/plugins/mac/psaux.py
+++ b/volatility3/framework/plugins/mac/psaux.py
@@ -14,16 +14,14 @@ from volatility3.plugins.mac import pslist
 class Psaux(plugins.PluginInterface):
     """Recovers program command line arguments."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          description = 'Filter on specific process IDs',
                                          element_type = int,
@@ -98,6 +96,5 @@ class Psaux(plugins.PluginInterface):
         return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
                                   self._generator(
                                       list_tasks(self.context,
-                                                 self.config['primary'],
                                                  self.config['darwin'],
                                                  filter_func = filter_func)))
diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py
index 1ebd89c97..fb2617be1 100644
--- a/volatility3/framework/plugins/mac/pslist.py
+++ b/volatility3/framework/plugins/mac/pslist.py
@@ -5,7 +5,7 @@
 import logging
 from typing import Callable, Iterable, List, Dict
 
-from volatility3.framework import renderers, interfaces, contexts, exceptions
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols import mac
@@ -16,17 +16,14 @@ vollog = logging.getLogger(__name__)
 class PsList(interfaces.plugins.PluginInterface):
     """Lists the processes present in a particular mac memory image."""
 
-    _required_framework_version = (1, 0, 0)
-    _version = (2, 0, 0)
+    _required_framework_version = (1, 2, 0)
+    _version = (3, 0, 0)
     pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table']
 
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
             requirements.ChoiceRequirement(name = 'pslist_method',
                                            description = 'Method to determine for processes',
@@ -41,8 +38,8 @@ class PsList(interfaces.plugins.PluginInterface):
 
     @classmethod
     def get_list_tasks(
-        cls, method: str
-    ) -> Callable[[interfaces.context.ContextInterface, str, str, Callable[[int], bool]],
+            cls, method: str
+    ) -> Callable[[interfaces.context.ContextInterface, str, Callable[[int], bool]],
                   Iterable[interfaces.objects.ObjectInterface]]:
         """Returns the list_tasks method based on the selector
 
@@ -91,7 +88,6 @@ class PsList(interfaces.plugins.PluginInterface):
         list_tasks = self.get_list_tasks(self.config.get('pslist_method', self.pslist_methods[0]))
 
         for task in list_tasks(self.context,
-                               self.config['primary'],
                                self.config['darwin'],
                                filter_func = self.create_pid_filter(self.config.get('pid', None))):
             pid = task.p_pid
@@ -102,25 +98,23 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def list_tasks_allproc(cls,
                            context: interfaces.context.ContextInterface,
-                           layer_name: str,
-                           darwin_symbols: str,
+                           kernel_module_name: str,
                            filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the processes in the primary layer based on the allproc method
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            darwin_symbols: The name of the table containing the kernel symbols
+            kernel_module_name: The name of the the kernel module on which to operate
             filter_func: A function which takes a process object and returns True if the process should be ignored/filtered
 
         Returns:
             The list of process objects from the processes linked list after filtering
         """
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
-        kernel_layer = context.layers[layer_name]
+        kernel_layer = context.layers[kernel.layer_name]
 
         proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first
 
@@ -143,25 +137,22 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def list_tasks_tasks(cls,
                          context: interfaces.context.ContextInterface,
-                         layer_name: str,
-                         darwin_symbols: str,
+                         kernel_module_name: str,
                          filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer based on the tasks queue
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            darwin_symbols: The name of the table containing the kernel symbols
+            kernel_module_name: The name of the the kernel module on which to operate
             filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
 
         Returns:
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
+        kernel = context.modules[kernel_module_name]
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
-
-        kernel_layer = context.layers[layer_name]
+        kernel_layer = context.layers[kernel.layer_name]
 
         queue_entry = kernel.object_from_symbol(symbol_name = "tasks")
 
@@ -184,22 +175,20 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def list_tasks_sessions(cls,
                             context: interfaces.context.ContextInterface,
-                            layer_name: str,
-                            darwin_symbols: str,
+                            kernel_module_name: str,
                             filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer using sessions
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            darwin_symbols: The name of the table containing the kernel symbols
+            kernel_module_name: The name of the the kernel module on which to operate
             filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
 
         Returns:
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         table_size = kernel.object_from_symbol(symbol_name = "sesshash")
 
@@ -218,23 +207,20 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def list_tasks_process_group(cls,
                                  context: interfaces.context.ContextInterface,
-                                 layer_name: str,
-                                 darwin_symbols: str,
+                                 kernel_module_name: str,
                                  filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer using process groups
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            darwin_symbols: The name of the table containing the kernel symbols
+            kernel_module_name: The name of the the kernel module on which to operate
             filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
 
         Returns:
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
-
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         table_size = kernel.object_from_symbol(symbol_name = "pgrphash")
 
@@ -254,23 +240,21 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def list_tasks_pid_hash_table(cls,
                                   context: interfaces.context.ContextInterface,
-                                  layer_name: str,
-                                  darwin_symbols: str,
+                                  kernel_module_name: str,
                                   filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer using the pid hash table
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            darwin_symbols: The name of the table containing the kernel symbols
+            kernel_module_name: The name of the the kernel module on which to operate
             filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
 
         Returns:
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = context.modules[kernel_module_name]
 
         table_size = kernel.object_from_symbol(symbol_name = "pidhash")
 
diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py
index ea70a5d4c..a9846d0db 100644
--- a/volatility3/framework/plugins/mac/pstree.py
+++ b/volatility3/framework/plugins/mac/pstree.py
@@ -13,7 +13,7 @@ class PsTree(plugins.PluginInterface):
     """Plugin for listing processes in a tree based on their parent process
     ID."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -24,11 +24,9 @@ class PsTree(plugins.PluginInterface):
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0))
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0))
         ]
 
     def _find_level(self, pid):
@@ -50,7 +48,7 @@ class PsTree(plugins.PluginInterface):
         """Generates the tree list of processes"""
         list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
 
-        for proc in list_tasks(self.context, self.config['primary'], self.config['darwin']):
+        for proc in list_tasks(self.context, self.config['darwin']):
             self._processes[proc.p_pid] = proc
 
         # Build the child/level maps
diff --git a/volatility3/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py
index 40fc6ffe0..be21bc7d1 100644
--- a/volatility3/framework/plugins/mac/socket_filters.py
+++ b/volatility3/framework/plugins/mac/socket_filters.py
@@ -5,7 +5,7 @@ import logging
 from typing import List
 
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -19,25 +19,23 @@ vollog = logging.getLogger(__name__)
 class Socket_filters(plugins.PluginInterface):
     """Enumerates kernel socket filters."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
             requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     def _generator(self):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         members_to_check = [
             "sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", "sf_getsockname", "sf_data_in",
diff --git a/volatility3/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py
index 912388ffb..5ce973d5c 100644
--- a/volatility3/framework/plugins/mac/timers.py
+++ b/volatility3/framework/plugins/mac/timers.py
@@ -5,7 +5,7 @@ import logging
 from typing import List
 
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.renderers import format_hints
@@ -18,36 +18,36 @@ vollog = logging.getLogger(__name__)
 class Timers(plugins.PluginInterface):
     """Check for malicious kernel timers."""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 3, 0)),
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     def _generator(self):
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         real_ncpus = kernel.object_from_symbol(symbol_name = "real_ncpus")
 
         cpu_data_ptrs_ptr = kernel.get_symbol("cpu_data_ptr").address
 
+        # Returns the a pointer to the absolute address
         cpu_data_ptrs_addr = kernel.object(object_type = "pointer",
                                            offset = cpu_data_ptrs_ptr,
                                            subtype = kernel.get_type('long unsigned int'))
 
         cpu_data_ptrs = kernel.object(object_type = "array",
                                       offset = cpu_data_ptrs_addr,
+                                      absolute = True,
                                       subtype = kernel.get_type('cpu_data'),
                                       count = real_ncpus)
 
@@ -68,9 +68,10 @@ class Timers(plugins.PluginInterface):
                 else:
                     entry_time = -1
 
-                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler)
+                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler,
+                                                                                  self.config['darwin'])
 
-                yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \
+                yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1),
                            timer.deadline, entry_time, module_name, symbol_name))
 
     def run(self):
diff --git a/volatility3/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py
index b03663625..615e5ea64 100644
--- a/volatility3/framework/plugins/mac/trustedbsd.py
+++ b/volatility3/framework/plugins/mac/trustedbsd.py
@@ -6,7 +6,7 @@ import logging
 from typing import List, Iterator, Any
 
 from volatility3.framework import exceptions, interfaces
-from volatility3.framework import renderers, contexts
+from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -20,29 +20,28 @@ vollog = logging.getLogger(__name__)
 class Trustedbsd(plugins.PluginInterface):
     """Checks for malicious trustedbsd modules"""
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
-            requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
+            requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 3, 0)),
+            requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
         ]
 
     def _generator(self, mods: Iterator[Any]):
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
 
         policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list")
 
         entries = kernel.object(object_type = "array",
                                 offset = policy_list.entries.dereference().vol.offset,
                                 subtype = kernel.get_type('mac_policy_list_element'),
+                                absolute = True,
                                 count = policy_list.staticmax + 1)
 
         for i, ent in enumerate(entries):
@@ -65,7 +64,8 @@ class Trustedbsd(plugins.PluginInterface):
                 if call_addr is None or call_addr == 0:
                     continue
 
-                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
+                module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr,
+                                                                                  self.config['darwin'])
 
                 yield (0, (check, ent_name, format_hints.Hex(call_addr), module_name, symbol_name))
 
@@ -73,5 +73,4 @@ class Trustedbsd(plugins.PluginInterface):
         return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex),
                                    ("Handler Module", str), ("Handler Symbol", str)],
                                   self._generator(
-                                      lsmod.Lsmod.list_modules(self.context, self.config['primary'],
-                                                               self.config['darwin'])))
+                                      lsmod.Lsmod.list_modules(self.context, self.config['darwin'])))
diff --git a/volatility3/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py
index 97b23168c..71915bcad 100644
--- a/volatility3/framework/plugins/mac/vfsevents.py
+++ b/volatility3/framework/plugins/mac/vfsevents.py
@@ -2,7 +2,7 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-from volatility3.framework import renderers, interfaces, exceptions, contexts
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 
@@ -10,7 +10,7 @@ from volatility3.framework.objects import utility
 class VFSevents(interfaces.plugins.PluginInterface):
     """ Lists processes that are filtering file system events """
 
-    _required_framework_version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     event_types = [
         "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED",
@@ -20,10 +20,8 @@ class VFSevents(interfaces.plugins.PluginInterface):
     @classmethod
     def get_requirements(cls):
         return [
-            requirements.TranslationLayerRequirement(name = 'primary',
-                                                     description = 'Memory layer for the kernel',
-                                                     architectures = ["Intel32", "Intel64"]),
-            requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
+            requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
+                                           architectures = ["Intel32", "Intel64"]),
         ]
 
     def _generator(self):
@@ -32,7 +30,7 @@ class VFSevents(interfaces.plugins.PluginInterface):
         Also lists which event(s) a process is registered for
         """
 
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = self.context.modules[self.config['darwin']]
 
         watcher_table = kernel.object_from_symbol("watcher_table")
 
@@ -48,6 +46,7 @@ class VFSevents(interfaces.plugins.PluginInterface):
             try:
                 event_array = kernel.object(object_type = "array",
                                             offset = watcher.event_list,
+                                            absolute = True,
                                             count = 13,
                                             subtype = kernel.get_type("unsigned char"))