mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-22 22:32:22 +02:00
20 lines
820 B
Python
20 lines
820 B
Python
def tester(searcher):
|
|
import argparse
|
|
|
|
parser = argparse.ArgumentParser(usage = "Searches through a haystack for a set of needles")
|
|
parser.add_argument("-n", "--needles", help = "The filename of the file containing newline separated needles",
|
|
required = True)
|
|
parser.add_argument("haystack", help = "The filename of the binary haystack file to search")
|
|
args = parser.parse_args()
|
|
|
|
with open(args.needles, "rb") as needles_fp:
|
|
needles = needles_fp.read().split(b"\n")
|
|
with open(args.haystack, "rb") as haystack_fp:
|
|
haystack = haystack_fp.read()
|
|
for needle in needles:
|
|
if len(needle):
|
|
searcher.add_pattern(needle)
|
|
searcher.preprocess()
|
|
for result in searcher.search(haystack):
|
|
print("0x{:x} - {}".format(*result))
|