diff --git a/volatility/framework/layers/scanners/__init__.py b/volatility/framework/layers/scanners/__init__.py index 94d97cb7c..c8f39c6d7 100644 --- a/volatility/framework/layers/scanners/__init__.py +++ b/volatility/framework/layers/scanners/__init__.py @@ -2,7 +2,6 @@ import re from volatility.framework.interfaces import layers from volatility.framework.layers.scanners import wumanber -from volatility.framework.layers.scanners.suffix_tree import SuffixTree class BytesScanner(layers.ScannerInterface): @@ -46,20 +45,12 @@ class MultiStringScanner(layers.ScannerInterface): super().__init__() self._check_type(patterns, list) self._patterns = wumanber.WuManber() - try: - for pattern in patterns: - self._check_type(pattern, bytes) - self._patterns.add_pattern(pattern) - self._patterns.preprocess() - except Exception as e: - print(repr(e)) + for pattern in patterns: + self._check_type(pattern, bytes) + self._patterns.add_pattern(pattern) + self._patterns.preprocess() def __call__(self, data, data_offset): """Runs through the data looking for the needles""" - try: - for pattern, offset in self._patterns.search(data): - yield offset + data_offset, pattern - except Exception as e: - import pdb - pdb.post_mortem() - print("EXCEPTION", repr(e)) + for offset, pattern in self._patterns.search(data): + yield offset + data_offset, pattern diff --git a/volatility/framework/layers/scanners/wumanber.py b/volatility/framework/layers/scanners/wumanber.py index b8a097c8a..53fc6ea59 100644 --- a/volatility/framework/layers/scanners/wumanber.py +++ b/volatility/framework/layers/scanners/wumanber.py @@ -5,7 +5,7 @@ class WuManber(object): self.minimum_pattern_length = None self._block_size = block_size - self._maximum_hash = 1 << 16 # This depends on the hash function used + self._maximum_hash = (1 << 14) # This depends on the hash function used self._patterns = [] self._shift = None # This gets generated by preprocess @@ -39,6 +39,10 @@ class WuManber(object): self._hashes[hashval].add(pattern) def _hash_function(self, value_bytes): + """Hash function to bucket _block_size number of bytes into sets + + If this hash_function changes, the maximum number of responses must be set in self._maximum_hash + """ return (value_bytes[0] << 5) + (value_bytes[1] << 3) + value_bytes[2] def search(self, haystack):