Update writingrules.rst

This commit is contained in:
raviteja7
2016-11-22 15:30:40 -05:00
committed by GitHub
parent 10a64a197a
commit a6ee593708
+2 -2
View File
@@ -70,7 +70,7 @@ Rules are generally composed of two sections: strings definition and condition.
The strings definition section can be omitted if the rule doesn't rely on any
string, but the condition section is always required. The strings definition
section is where the strings that will be part of the rule are defined. Each
string has an identifier consisting in a $ character followed by a sequence of
string has an identifier consisting of a $ character followed by a sequence of
alphanumeric characters and underscores, these identifiers can be used in the
condition section to refer to the corresponding string. Strings can be defined
in text or hexadecimal form, as shown in the following example::
@@ -94,7 +94,7 @@ The condition section is where the logic of the rule resides. This section must
contain a boolean expression telling under which circumstances a file or process
satisfies the rule or not. Generally, the condition will refer to previously
defined strings by using their identifiers. In this context the string
identifier acts as a boolean variable which evaluate to true of the string was
identifier acts as a boolean variable which evaluate to true if the string was
found in the file or process memory, or false if otherwise.
Comments