From fa552aa3b09120310394c778f2ba3c55e90bae94 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 12 Sep 2018 22:45:34 +0100
Subject: [PATCH] Add in the native_layer_name concept to ObjectInformation.

---
 volatility/framework/interfaces/objects.py | 8 +++++---
 volatility/framework/objects/__init__.py   | 8 +++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py
index b4ed95a6f..1ff160d6f 100644
--- a/volatility/framework/interfaces/objects.py
+++ b/volatility/framework/interfaces/objects.py
@@ -53,14 +53,15 @@ class ObjectInformation(ReadOnlyMapping):
     in a single place.  These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification.
     """
 
-    def __init__(self, layer_name, offset, member_name = None, parent = None):
+    def __init__(self, layer_name, offset, member_name = None, parent = None, native_layer_name = None):
         self._check_type(offset, int)
         if parent:
             self._check_type(parent, ObjectInterface)
         super().__init__({'layer_name': layer_name,
                           'offset': offset,
                           'member_name': member_name,
-                          'parent': parent})
+                          'parent': parent,
+                          'native_layer_name': native_layer_name or layer_name})
 
 
 class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta):
@@ -138,7 +139,8 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta):
         object_info = ObjectInformation(layer_name = self.vol.layer_name,
                                         offset = self.vol.offset,
                                         member_name = self.vol.member_name,
-                                        parent = self.vol.parent)
+                                        parent = self.vol.parent,
+                                        native_layer_name = self.vol.native_layer_name)
         return object_template(context = self._context,
                                object_info = object_info)
 
diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py
index 68f6a64d9..ec6fa7c6b 100644
--- a/volatility/framework/objects/__init__.py
+++ b/volatility/framework/objects/__init__.py
@@ -248,7 +248,7 @@ class Pointer(Integer):
            Layer_name is identifies the appropriate layer within the context that the pointer points to.
            If layer_name is None, it defaults to the same layer that the pointer is currently instantiated in.
         """
-        layer_name = layer_name or self.vol.layer_name
+        layer_name = layer_name or self.vol.native_layer_name
         mask = self._context.memory[layer_name].address_mask
         offset = self & mask
         return self.vol.subtype(context = self._context,
@@ -519,7 +519,8 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence):
         for index in series:
             object_info = ObjectInformation(layer_name = self.vol.layer_name,
                                             offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
-                                            parent = self)
+                                            parent = self,
+                                            native_layer_name = self.vol.native_layer_name)
             result += [self.vol.subtype(context = self._context, object_info = object_info)]
         if not return_list:
             return result[0]
@@ -631,7 +632,8 @@ class Struct(interfaces.objects.ObjectInterface):
                                                                                offset = mask & (
                                                                                        self.vol.offset + relative_offset),
                                                                                member_name = attr,
-                                                                               parent = self))
+                                                                               parent = self,
+                                                                               native_layer_name = self.vol.native_layer_name))
             self._concrete_members[attr] = member
             return member
         raise AttributeError("Struct has no attribute: {}.{}".format(self.vol.type_name, attr))