From e882571908ce6b1ffc0f95dc8a60b81cb79cf7b2 Mon Sep 17 00:00:00 2001 From: Elliot Chernofsky Date: Tue, 21 Mar 2023 14:36:45 -0400 Subject: [PATCH] updated format doc to clarify acceptable comments in capa-rules --- doc/format.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/doc/format.md b/doc/format.md index 2e64c3f6..19f82c95 100644 --- a/doc/format.md +++ b/doc/format.md @@ -817,3 +817,29 @@ For example: - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage - offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase ``` + +## comments + +Capa rules support both inline/end-of-line and block comments + +For example: + +```yaml +features: + # The constant words spell "expand 32-byte k" in ASCII (i.e. the 4 words are "expa", "nd 3", "2-by", and "te k") + - or: + - description: part of key setup + - string: "expand 32-byte k = sigma" + - string: "expand 16-byte k = tau" + - string: "expand 32-byte kexpand 16-byte k" # if sigma and tau are in contiguous memory, may result in concatenated string + - and: + - string: "expa" + - string: "nd 3" + - string: "2-by" + - string: "te k" + - and: + - number: 0x61707865 = "apxe" + - number: 0x3320646E = "3 dn" + - number: 0x79622D32 = "yb-2" + - number: 0x6B206574 = "k et" +``` \ No newline at end of file