mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Update doc/format.md
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
This commit is contained in:
committed by
GitHub
parent
65ab87b292
commit
658b16f47d
+1
-1
@@ -605,7 +605,7 @@ Examples:
|
||||
|
||||
export: InstallA
|
||||
|
||||
And for forwarded exports:
|
||||
To specify a [forwarded export](https://devblogs.microsoft.com/oldnewthing/20060719-24/?p=30473) use the format `<DLL path, lowercase>.<symbol name>`. Note that the path can be either implicit, relative, or absolute:
|
||||
|
||||
export: "c:/windows/system32/version.GetFileVersionInfoA"
|
||||
export: "vresion.GetFileVersionInfoA"
|
||||
|
||||
Reference in New Issue
Block a user