From 497eaea512774711a2bb33e1040b54a4681981d2 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 9 Feb 2022 20:07:13 +0000
Subject: [PATCH] Core: Slight speed-up for all single struct.unpack calls

---
 volatility3/framework/symbols/windows/extensions/pool.py | 4 ++--
 .../framework/symbols/windows/extensions/registry.py     | 9 ++++++---
 volatility3/framework/symbols/windows/pdbutil.py         | 4 ++--
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py
index f75c6c417..d50d6e47a 100644
--- a/volatility3/framework/symbols/windows/extensions/pool.py
+++ b/volatility3/framework/symbols/windows/extensions/pool.py
@@ -128,8 +128,8 @@ class POOL_HEADER(objects.StructType):
                         #  ---------------
                         if addr - optional_headers_length < 0:
                             continue
-                        padding_length = struct.unpack(
-                            "<I", infomask_data[addr - optional_headers_length:addr - optional_headers_length + 4])[0]
+                        padding_length, = struct.unpack(
+                            "<I", infomask_data[addr - optional_headers_length:addr - optional_headers_length + 4])
                         padding_length -= lengths_of_optional_headers[padding_available or 0]
 
                     # Certain versions of windows have PADDING_INFO lengths that are too long
diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py
index cbd9052cd..f30bb5eb0 100644
--- a/volatility3/framework/symbols/windows/extensions/registry.py
+++ b/volatility3/framework/symbols/windows/extensions/registry.py
@@ -264,15 +264,18 @@ class CM_KEY_VALUE(objects.StructType):
         if self_type == RegValueTypes.REG_DWORD:
             if len(data) != struct.calcsize("<L"):
                 raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
-            return struct.unpack("<L", data)[0]
+            res, = struct.unpack("<L", data)
+            return res
         if self_type == RegValueTypes.REG_DWORD_BIG_ENDIAN:
             if len(data) != struct.calcsize(">L"):
                 raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
-            return struct.unpack(">L", data)[0]
+            res, =  struct.unpack(">L", data)
+            return res
         if self_type == RegValueTypes.REG_QWORD:
             if len(data) != struct.calcsize("<Q"):
                 raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
-            return struct.unpack("<Q", data)[0]
+            res, = struct.unpack("<Q", data)
+            return res
         if self_type in [
                 RegValueTypes.REG_SZ, RegValueTypes.REG_EXPAND_SZ, RegValueTypes.REG_LINK, RegValueTypes.REG_MULTI_SZ,
                 RegValueTypes.REG_BINARY, RegValueTypes.REG_FULL_RESOURCE_DESCRIPTOR, RegValueTypes.REG_RESOURCE_LIST,
diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py
index cc7b22e03..35bc62d18 100644
--- a/volatility3/framework/symbols/windows/pdbutil.py
+++ b/volatility3/framework/symbols/windows/pdbutil.py
@@ -132,14 +132,14 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
         if mz_sig != b"MZ":
             return None
         
-        nt_header_start = struct.unpack("<I", layer.read(offset + 0x3C, 4))[0]
+        nt_header_start, = struct.unpack("<I", layer.read(offset + 0x3C, 4))
         pe_sig = layer.read(offset + nt_header_start, 2)
         
         # Check it is actually the Nt Headers
         if pe_sig != b"PE":
             return None
         
-        optional_header_size = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))[0]
+        optional_header_size, = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))
         # Just enough to tell us the max size
         pe_header = layer.read(offset, nt_header_start + 0x16 + optional_header_size)
         pe_data = pefile.PE(data = pe_header)