mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-11 22:49:58 +00:00
Merge pull request #568 from raviteja7/raviteja7-patch-1
Update writingrules.rst
This commit is contained in:
@@ -70,7 +70,7 @@ Rules are generally composed of two sections: strings definition and condition.
|
||||
The strings definition section can be omitted if the rule doesn't rely on any
|
||||
string, but the condition section is always required. The strings definition
|
||||
section is where the strings that will be part of the rule are defined. Each
|
||||
string has an identifier consisting in a $ character followed by a sequence of
|
||||
string has an identifier consisting of a $ character followed by a sequence of
|
||||
alphanumeric characters and underscores, these identifiers can be used in the
|
||||
condition section to refer to the corresponding string. Strings can be defined
|
||||
in text or hexadecimal form, as shown in the following example::
|
||||
@@ -94,7 +94,7 @@ The condition section is where the logic of the rule resides. This section must
|
||||
contain a boolean expression telling under which circumstances a file or process
|
||||
satisfies the rule or not. Generally, the condition will refer to previously
|
||||
defined strings by using their identifiers. In this context the string
|
||||
identifier acts as a boolean variable which evaluate to true of the string was
|
||||
identifier acts as a boolean variable which evaluate to true if the string was
|
||||
found in the file or process memory, or false if otherwise.
|
||||
|
||||
Comments
|
||||
|
||||
Reference in New Issue
Block a user