added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods

volatility/framework/automagic/linux.py

@@ -152,13 +152,15 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
             cls,
             context: interfaces.context.ContextInterface,
             layer_name: str,
-            kernel,  # ikelos - how to type this??
+            kernel_name,  # ikelos - how to type this??
             mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
 
         """
         A helper function that gets the beginning and end address of the kernel module
         """    
 
+        kernel = contexts.Module(context, kernel_name, layer_name, 0)
+
         mask = context.layers[layer_name].address_mask
 
         start_addr = kernel.object_from_symbol("_text")
@@ -167,7 +169,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
         end_addr = kernel.object_from_symbol("_etext")
         end_addr = end_addr.vol.offset & mask
 
-        return [("__kernel__", start_addr, end_addr)] + \
+        return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \
             LinuxUtilities.mask_mods_list(context, layer_name, mods_list)
 
     @classmethod
@@ -184,7 +186,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
         for name, start, end in handlers:
             if start <= target_address <= end:
                 mod_name = name
-                if name == "__kernel__":
+                if name == constants.linux.KERNEL_NAME:
                     symbols = list(
                         context.symbol_space.get_symbols_by_location(target_address))
 

volatility/framework/constants/linux/__init__.py

@@ -6,6 +6,8 @@
 Linux-specific values that aren't found in debug symbols
 """
 
+KERNEL_NAME = "__kernel__"
+
 # arch/x86/include/asm/page_types.h
 PAGE_SHIFT = 12
 """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)"""

volatility/framework/plugins/linux/tty_check.py

@@ -37,7 +37,7 @@ class tty_check(plugins.PluginInterface):
 
         modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux'])
 
-        handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules)
+        handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules)
 
         try:
             tty_drivers = vmlinux.object_from_symbol("tty_drivers")