Convert the pdb scanner to use the kernel module names constants.

volatility/framework/automagic/pdbscan.py

@@ -10,7 +10,7 @@ import os
 import struct
 import typing
 
-from volatility.framework import exceptions, layers, validity
+from volatility.framework import exceptions, layers, validity, constants
 from volatility.framework.layers import scanners, intel
 from volatility.framework.symbols import intermed, native
 
@@ -80,12 +80,7 @@ def scan(ctx: interfaces.context.ContextInterface,
        appropriate types and PDB values themselves
     """
     min_pfn = 0
-    pdb_names = [
-        b"ntkrnlmp.pdb",
-        b"ntkrnlpa.pdb",
-        b"ntkrpamp.pdb",
-        b"ntoskrnl.pdb",
-    ]
+    pdb_names = [bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES]
 
     for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSignatureScanner(pdb_names),
                                                                                progress_callback = progress_callback,

volatility/framework/constants/__init__.py

@@ -2,11 +2,11 @@
 
 Stores all the constant values that are generally fixed throughout volatility
 This includes default scanning block sizes, etc."""
+import os.path
 import sys
 
-import os.path
-
 import volatility.framework.constants.linux
+import volatility.framework.constants.windows
 
 PLUGINS_PATH = [os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")),
                 os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins"))]