Skip to content

Commit

Permalink
documentation changes
Browse files Browse the repository at this point in the history
  • Loading branch information
mike-hunhoff committed Jun 24, 2020
1 parent 9842ae6 commit b505197
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 12 deletions.
12 changes: 6 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ Here's an example rule used by capa:

Rules are yaml files that follow a certain schema.

The top level element is a dictionary named `rule` with two required children dictionaries:
The top-level element is a dictionary named `rule` with two required children dictionaries:
`meta` and `features`.


Expand All @@ -168,7 +168,7 @@ Here are the common fields:
- `rule-category` is required when a rule describes a behavior (as opposed to matching a role or disposition).
The rule category specifies an objective, behavior, and technique matched by this rule,
using a format like `$objective/$behavior/$technique`.
An objective is a high level goal of a program, such as "communication".
An objective is a high-level goal of a program, such as "communication".
A behavior is something that a program may do, such as "communication via socket".
A technique is a way of implementing some behavior, such as "send-data".

Expand All @@ -177,7 +177,7 @@ A technique is a way of implementing some behavior, such as "send-data".
- `maec/analysis-conclusion` is required when the rule describes a disposition, such as `benign` or `malicious`.

- `scope` indicates to which feature set this rule applies.
It can takes the following values:
It can take the following values:
- **`basic block`:** limits matches to a basic block.
It is used to achieve locality in rules (for example for parameters of a function).
- **`function`:** identify functions.
Expand Down Expand Up @@ -253,7 +253,7 @@ though possibly a local function (like `malloc`) extracted via FLIRT.

The parameter is a string describing the function name, specified like `module.functionname` or `functionname`.

Windows API functions that take string arguments come in two API versions. For example `CreateProcessA` takes ANSI strings and `CreateProcessW` takes Unicode strings. capa extracts these API features both with and without the suffix character `A` or `W`. That means you can write a rule to match on both APIs using the base name. If you want to match a specific API version, you can include the suffix.
Windows API functions that take string arguments come in two API versions. For example, `CreateProcessA` takes ANSI strings and `CreateProcessW` takes Unicode strings. capa extracts these API features both with and without the suffix character `A` or `W`. That means you can write a rule to match on both APIs using the base name. If you want to match a specific API version, you can include the suffix.

Example:

Expand Down Expand Up @@ -350,7 +350,7 @@ Characteristics are features that are extracted by the analysis engine.
They are one-off features that seem interesting to the authors.

For example, the `characteristic(nzxor)` feature describes non-zeroing XOR instructions.
captdet does not support instruction pattern matching,
capa does not support instruction pattern matching,
so a select set of interesting instructions are pulled out as characteristics.

| characteristic | scope | description |
Expand Down Expand Up @@ -449,7 +449,7 @@ You can specify a rule match expression like so:
- match: process creation

Rules are uniquely identified by their `rule.meta.name` property;
this is the value that should appear on the right hand side of the `match` expression.
this is the value that should appear on the right-hand side of the `match` expression.

capa will refuse to run if a rule dependency is not present during matching.

Expand Down
10 changes: 5 additions & 5 deletions doc/installation.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Installation
You can install capa in a few different ways. First, if you simply want to use capa, just download the [standalone binary](https://github.com/fireeye/capa/releases). If you want to use capa as a Python library, you can install the package directly from Github using `pip`. If you'd like to contribute patches or features to capa, you can work with a local copy of the source code.
You can install capa in a few different ways. First, if you simply want to use capa, just download the [standalone binary](https://github.com/fireeye/capa/releases). If you want to use capa as a Python library, you can install the package directly from GitHub using `pip`. If you'd like to contribute patches or features to capa, you can work with a local copy of the source code.

## Method 1: Standalone installation
If you simply want to use capa, use the standalone binaries we host on Github: https://github.com/fireeye/capa/releases. These binary executable files contain all the source code, Python interpreter, and associated resources needed to make capa run. This means you can run it without any installation! Just invoke the file using your terminal shell to see the help documentation.
If you simply want to use capa, use the standalone binaries we host on GitHub: https://github.com/fireeye/capa/releases. These binary executable files contain all the source code, Python interpreter, and associated resources needed to make capa run. This means you can run it without any installation! Just invoke the file using your terminal shell to see the help documentation.

We used PyInstaller to create these packages.

Expand All @@ -14,14 +14,14 @@ First, install the requirements.
`$ pip install https://github.com/williballenthin/vivisect/zipball/master`

### 2. Install capa module
Second, use `pip` to install the capa module to your local Python environment. This fetches the library code to your computer, but does not keep editable source files around for you to hack on. If you'd like to edit the source files, see below.
Second, use `pip` to install the capa module to your local Python environment. This fetches the library code to your computer but does not keep editable source files around for you to hack on. If you'd like to edit the source files, see below.
`$ pip install https://github.com/fireeye/capa/archive/master.zip`

### 3. Use capa
You can now import the `capa` module from a Python script or use the IDA Pro plugins from the `capa/ida` directory. For more information please see the [usage](usage.md) documentation.

## Method 3: Inspecting the capa source code
If you'd like to review and modify the capa source code, you'll need to check it out from Github and install it locally. By following these instructions, you'll maintain a local directory of source code that you can modify and run easily.
If you'd like to review and modify the capa source code, you'll need to check it out from GitHub and install it locally. By following these instructions, you'll maintain a local directory of source code that you can modify and run easily.

### 1. Install requirements
First, install the requirements.
Expand Down Expand Up @@ -53,4 +53,4 @@ If you plan to contribute to capa, you may want to setup the hooks.
Run `scripts/setup-hooks.sh` to set the following hooks up:
- The `post-commit` hook runs the linter after every `git commit`, letting you know if there are code style or rule linter offenses you need to fix.
- The `pre-push` hook runs the linter and the tests and block the `git push` if they do not succeed.
This way you realise if everything is alright without the need of sending a PR.
This way you realize if everything is alright without the need of sending a PR.
2 changes: 1 addition & 1 deletion doc/usage.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ capa runs from within IDA Pro. Run `capa/main.py` via File - Script file... (ALT

When running in IDA, capa uses IDA's disassembly and file analysis as its backend. These results may vary from the standalone version that uses vivisect.

In IDA, capa supports Python 2 and Python 3. If you encounter issues with your specific setup please open a new [Issue](https://github.com/fireeye/capa/issues).
In IDA, capa supports Python 2 and Python 3. If you encounter issues with your specific setup, please open a new [Issue](https://github.com/fireeye/capa/issues).

## IDA Pro plugins
capa comes with two IDA Pro plugins located in the `capa/ida` directory.
Expand Down

0 comments on commit b505197

Please sign in to comment.