From fda3cedabaae0f98600201ec800ed415521e402b Mon Sep 17 00:00:00 2001
From: Eve <eevvee@tuta.io>
Date: Thu, 14 Dec 2023 09:18:01 +0000
Subject: [PATCH] Linux: update kmsg to create objects via context rather than
 module

---
 volatility3/framework/plugins/linux/kmsg.py | 23 +++++++++++----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py
index f3ef12cfe..17dcc61aa 100644
--- a/volatility3/framework/plugins/linux/kmsg.py
+++ b/volatility3/framework/plugins/linux/kmsg.py
@@ -64,10 +64,8 @@ class ABCKmsg(ABC):
     ):
         self._context = context
         self._config = config
-        vmlinux = context.modules[self._config["kernel"]]
-        self.layer_name = vmlinux.layer_name  # type: ignore
-        symbol_table_name = vmlinux.symbol_table_name  # type: ignore
-        self.vmlinux = contexts.Module.create(context, symbol_table_name, self.layer_name, vmlinux.offset)  # type: ignore
+        self.vmlinux = context.modules[self._config["kernel"]]
+        self.layer_name = self.vmlinux.layer_name  # type: ignore
         self.long_unsigned_int_size = self.vmlinux.get_type("long unsigned int").size
 
     @classmethod
@@ -358,21 +356,24 @@ class KmsgFiveTen(ABCKmsg):
 
         desc_ring = ringbuffers.desc_ring
         text_data_ring = ringbuffers.text_data_ring
-
         desc_count = 1 << desc_ring.count_bits
-        desc_arr = self.vmlinux.object(
-            object_type="array",
+
+        array_type = self.vmlinux.symbol_table_name + constants.BANG + "array"
+
+        desc_arr = self._context.object(
+            array_type,
             offset=desc_ring.descs,
             subtype=self.vmlinux.get_type("prb_desc"),
             count=desc_count,
-            absolute=True,
+            layer_name=self.layer_name,
         )
-        info_arr = self.vmlinux.object(
-            object_type="array",
+
+        info_arr = self._context.object(
+            array_type,
             offset=desc_ring.infos,
             subtype=self.vmlinux.get_type("printk_info"),
             count=desc_count,
-            absolute=True,
+            layer_name=self.layer_name,
         )
 
         # See kernel/printk/printk_ringbuffer.h