From eb08fb9e969877ef230db1d2d1a0c7d9fd229e7e Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 4 Aug 2018 12:34:18 +0100
Subject: [PATCH] Convert the pdb scanner to use the kernel module names
 constants.

---
 volatility/framework/automagic/pdbscan.py  | 9 ++-------
 volatility/framework/constants/__init__.py | 4 ++--
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py
index 5516d6968..9a71023a8 100644
--- a/volatility/framework/automagic/pdbscan.py
+++ b/volatility/framework/automagic/pdbscan.py
@@ -10,7 +10,7 @@ import os
 import struct
 import typing
 
-from volatility.framework import exceptions, layers, validity
+from volatility.framework import exceptions, layers, validity, constants
 from volatility.framework.layers import scanners, intel
 from volatility.framework.symbols import intermed, native
 
@@ -80,12 +80,7 @@ def scan(ctx: interfaces.context.ContextInterface,
        appropriate types and PDB values themselves
     """
     min_pfn = 0
-    pdb_names = [
-        b"ntkrnlmp.pdb",
-        b"ntkrnlpa.pdb",
-        b"ntkrpamp.pdb",
-        b"ntoskrnl.pdb",
-    ]
+    pdb_names = [bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES]
 
     for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSignatureScanner(pdb_names),
                                                                                progress_callback = progress_callback,
diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py
index eebf7be6d..ad4209cc5 100644
--- a/volatility/framework/constants/__init__.py
+++ b/volatility/framework/constants/__init__.py
@@ -2,11 +2,11 @@
 
 Stores all the constant values that are generally fixed throughout volatility
 This includes default scanning block sizes, etc."""
+import os.path
 import sys
 
-import os.path
-
 import volatility.framework.constants.linux
+import volatility.framework.constants.windows
 
 PLUGINS_PATH = [os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")),
                 os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins"))]