docs: def FindClonedClients(token=None):
    """A script to find multiple machines reporting the same client_id.
  
    This script looks at the hardware serial numbers that a client reported in
    over time (they get collected with each regular interrogate). We have seen
    that sometimes those serial numbers change - for example when a disk is put
    in a new machine - so reporting multiple serial numbers does not flag a client
    immediately as a cloned machine. In order to be shown here by this script, the
    serial number has to be alternating between two values.
  
    Args:
      token: datastore token.
  
    Returns:
      A list of clients that report alternating hardware ids.
    """
  
    index = client_index.CreateClientIndex(token=token)
  
    clients = index.LookupClients(["."])
  
    hw_infos = _GetHWInfos(clients, token=token)
  
    # We get all clients that have reported more than one hardware serial
    # number over time. This doesn't necessarily indicate a cloned client - the
    # machine might just have new hardware. We need to search for clients that
    # alternate between different IDs.
    clients_with_multiple_serials = [
        client_id for client_id, serials in iteritems(hw_infos)
        if len(serials) > 1
    ]
  
    client_list = aff4.FACTORY.MultiOpen(
        clients_with_multiple_serials, age=aff4.ALL_TIMES, token=token)
  
    cloned_clients = []
    for c in client_list:
      hwis = c.GetValuesForAttribute(c.Schema.HARDWARE_INFO)
  
      # Here we search for the earliest and latest time each ID was reported.
      max_index = {}
      min_index = {}
      ids = set()
  
      for i, hwi in enumerate(hwis):
        s = hwi.serial_number
        max_index[s] = i
        if s not in min_index:
          min_index[s] = i
        ids.add(s)
  
      # Construct ranges [first occurrence, last occurrence] for every ID. If
      # a client just changed from one ID to the other, those ranges of IDs should
      # be disjunct. If they overlap at some point, it indicates that two IDs were
      # reported in the same time frame.
      ranges = []
      for hwid in ids:
        ranges.append((min_index[hwid], max_index[hwid]))
      # Sort ranges by first occurrence time.
      ranges.sort()
  
      for i in range(len(ranges) - 1):
        if ranges[i][1] > ranges[i + 1][0]:
          cloned_clients.append(c)
  
          msg = "Found client with multiple, overlapping serial numbers: %s"
          logging.info(msg, c.urn)
          for hwi in c.GetValuesForAttribute(c.Schema.HARDWARE_INFO):
            logging.info("%s %s", hwi.age, hwi.serial_number)
          break
  
    return cloned_clients