From 663cf3eff8c5f73ea4be6f6db1750babf21505da Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 25 Jan 2018 11:27:59 +0000
Subject: [PATCH] Just tidy up the multistring searchers slightly.

---
 .../framework/layers/scanners/multiregexp.py  |  6 ++++++
 .../layers/scanners/multistring_testrig.py    | 19 ++++++++++++++++++
 .../framework/layers/scanners/wumanber.py     | 20 ++-----------------
 3 files changed, 27 insertions(+), 18 deletions(-)
 create mode 100644 volatility/framework/layers/scanners/multistring_testrig.py

diff --git a/volatility/framework/layers/scanners/multiregexp.py b/volatility/framework/layers/scanners/multiregexp.py
index 07206cae2..c44e5ddd7 100644
--- a/volatility/framework/layers/scanners/multiregexp.py
+++ b/volatility/framework/layers/scanners/multiregexp.py
@@ -21,3 +21,9 @@ class MultiRegexp(object):
             raise TypeError("Search haystack must be a byte string")
         for match in re.finditer(self._regex, haystack):
             yield (match.start(0), match.group())
+
+
+if __name__ == '__main__':
+    import multistring_testrig
+
+    multistring_testrig.tester(MultiRegexp())
diff --git a/volatility/framework/layers/scanners/multistring_testrig.py b/volatility/framework/layers/scanners/multistring_testrig.py
new file mode 100644
index 000000000..600ccfae6
--- /dev/null
+++ b/volatility/framework/layers/scanners/multistring_testrig.py
@@ -0,0 +1,19 @@
+def tester(searcher):
+    import argparse
+
+    parser = argparse.ArgumentParser(usage = "Searches through a haystack for a set of needles")
+    parser.add_argument("-n", "--needles", help = "The filename of the file containing newline separated needles",
+                        required = True)
+    parser.add_argument("haystack", help = "The filename of the binary haystack file to search")
+    args = parser.parse_args()
+
+    with open(args.needles, "rb") as needles_fp:
+        needles = needles_fp.read().split(b"\n")
+    with open(args.haystack, "rb") as haystack_fp:
+        haystack = haystack_fp.read()
+    for needle in needles:
+        if len(needle):
+            searcher.add_pattern(needle)
+    searcher.preprocess()
+    for result in searcher.search(haystack):
+        print("0x{:x} - {}".format(*result))
diff --git a/volatility/framework/layers/scanners/wumanber.py b/volatility/framework/layers/scanners/wumanber.py
index 5415f710f..fe5587a0f 100644
--- a/volatility/framework/layers/scanners/wumanber.py
+++ b/volatility/framework/layers/scanners/wumanber.py
@@ -72,22 +72,6 @@ class WuManber(object):
 
 
 if __name__ == '__main__':
-    import argparse
+    import multistring_testrig
 
-    parser = argparse.ArgumentParser(usage = "Searches through a haystack for a set of needles")
-    parser.add_argument("-n", "--needles", help = "The filename of the file containing newline separated needles",
-                        required = True)
-    parser.add_argument("haystack", help = "The filename of the binary haystack file to search")
-    args = parser.parse_args()
-
-    with open(args.needles, "rb") as needles_fp:
-        needles = needles_fp.read().split(b"\n")
-    with open(args.haystack, "rb") as haystack_fp:
-        haystack = haystack_fp.read()
-    wm = WuManber()
-    for needle in needles:
-        if len(needle):
-            wm.add_pattern(needle)
-    wm.preprocess()
-    for result in wm.search(haystack):
-        print("0x{:x} - {}".format(*result))
+    multistring_testrig.tester(WuManber())