From f3dea3619cc2521c9616a530222a47bff74f738b Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 5 Mar 2023 23:14:09 +0000
Subject: [PATCH 1/2] Windows: Memoize part of the pool handling code

---
 volatility3/framework/contexts/__init__.py    |  7 ++++-
 .../symbols/windows/extensions/pool.py        | 29 +++++++++++--------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py
index 226a303dd..ecce5041c 100644
--- a/volatility3/framework/contexts/__init__.py
+++ b/volatility3/framework/contexts/__init__.py
@@ -381,6 +381,7 @@ class ModuleCollection(interfaces.context.ModuleContainer):
     def __init__(
         self, modules: Optional[List[interfaces.context.ModuleInterface]] = None
     ) -> None:
+        self._prefix_count = {}
         super().__init__(modules)
 
     def deduplicate(self) -> "ModuleCollection":
@@ -400,9 +401,13 @@ class ModuleCollection(interfaces.context.ModuleContainer):
 
     def free_module_name(self, prefix: str = "module") -> str:
         """Returns an unused module name"""
-        count = 1
+        if prefix not in self._prefix_count:
+            self._prefix_count[prefix] = 1
+            return prefix
+        count = self._prefix_count[prefix]
         while prefix + str(count) in self:
             count += 1
+        self._prefix_count[prefix] = count
         return prefix + str(count)
 
     @property
diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py
index ac7f36a99..052ae4dd6 100644
--- a/volatility3/framework/symbols/windows/extensions/pool.py
+++ b/volatility3/framework/symbols/windows/extensions/pool.py
@@ -396,13 +396,9 @@ class OBJECT_HEADER(objects.StructType):
             )
 
         symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
-
-        try:
-            header_offset = self.NameInfoOffset
-        except AttributeError:
-            # http://codemachine.com/article_objectheader.html (Windows 7 and later)
-            name_info_bit = 0x2
-
+        if symbol_table_name in self._context.modules:
+            ntkrnlmp = self._context.modules[symbol_table_name]
+        else:
             layer = self._context.layers[self.vol.native_layer_name]
             kvo = layer.config.get("kernel_virtual_offset", None)
 
@@ -411,16 +407,25 @@ class OBJECT_HEADER(objects.StructType):
                     f"Could not find kernel_virtual_offset for layer: {self.vol.layer_name}"
                 )
 
+            # We know this symbol table name can't exist because we checked for it earlier
             ntkrnlmp = self._context.module(
                 symbol_table_name, layer_name=self.vol.layer_name, offset=kvo
             )
+            self._context.add_module(ntkrnlmp)
+
+        try:
+            header_offset = self.NameInfoOffset
+        except AttributeError:
+            # http://codemachine.com/article_objectheader.html (Windows 7 and later)
+            name_info_bit = 0x2
+
             address = ntkrnlmp.get_symbol("ObpInfoMaskToOffset").address
             calculated_index = self.InfoMask & (name_info_bit | (name_info_bit - 1))
 
-            header_offset = self._context.object(
-                symbol_table_name + constants.BANG + "unsigned char",
+            header_offset = ntkrnlmp.object(
+                "unsigned char",
                 layer_name=self.vol.native_layer_name,
-                offset=kvo + address + calculated_index,
+                offset=address + calculated_index,
             )
 
         if header_offset == 0:
@@ -430,8 +435,8 @@ class OBJECT_HEADER(objects.StructType):
                 )
             )
 
-        header = self._context.object(
-            symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO",
+        header = ntkrnlmp.object(
+            "_OBJECT_HEADER_NAME_INFO",
             layer_name=self.vol.layer_name,
             offset=self.vol.offset - header_offset,
             native_layer_name=self.vol.native_layer_name,

From 21e34ec605d001a7f272907a13fe30210eeab278 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 5 Mar 2023 23:25:42 +0000
Subject: [PATCH 2/2] Windows: Fix up double adding the symbol from
 context.module

---
 volatility3/framework/symbols/windows/extensions/pool.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py
index 052ae4dd6..b761ddad8 100644
--- a/volatility3/framework/symbols/windows/extensions/pool.py
+++ b/volatility3/framework/symbols/windows/extensions/pool.py
@@ -396,6 +396,7 @@ class OBJECT_HEADER(objects.StructType):
             )
 
         symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
+
         if symbol_table_name in self._context.modules:
             ntkrnlmp = self._context.modules[symbol_table_name]
         else:
@@ -411,7 +412,6 @@ class OBJECT_HEADER(objects.StructType):
             ntkrnlmp = self._context.module(
                 symbol_table_name, layer_name=self.vol.layer_name, offset=kvo
             )
-            self._context.add_module(ntkrnlmp)
 
         try:
             header_offset = self.NameInfoOffset
@@ -440,5 +440,6 @@ class OBJECT_HEADER(objects.StructType):
             layer_name=self.vol.layer_name,
             offset=self.vol.offset - header_offset,
             native_layer_name=self.vol.native_layer_name,
+            absolute=True,
         )
         return header