[Forensics-changes] [yara] 248/368: Corrected some of the grammatical/spelling errors and minor inconsistencies in example code.

Hilko Bengen bengen at moszumanska.debian.org
Sat Jul 1 10:30:44 UTC 2017


This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.5.0
in repository yara.

commit f26803131d4905f2a36bfbfe7a7803996b578b86
Author: Scot Matson <sjpmatson at gmail.com>
Date:   Tue Apr 5 11:09:06 2016 -0700

    Corrected some of the grammatical/spelling errors and minor inconsistencies in example code.
---
 docs/writingrules.rst | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/docs/writingrules.rst b/docs/writingrules.rst
index 3ff5f04..7b5bf01 100644
--- a/docs/writingrules.rst
+++ b/docs/writingrules.rst
@@ -3,7 +3,7 @@ Writing YARA rules
 *******************
 
 YARA rules are easy to write and understand, and they have a syntax that
-resembles the C language. He here is the simplest rule that you can write for
+resembles the C language. Here is the simplest rule that you can write for
 YARA, which does absolutely nothing::
 
     rule dummy
@@ -150,13 +150,13 @@ circumstances you may need to define strings with chunks of variable content and
 length. In those situations you can use jumps instead of wild-cards::
 
     rule JumpExample
-        {
+    {
             strings:
                $hex_string = { F4 23 [4-6] 62 B4 }
 
             condition:
                $hex_string
-        }
+    }
 
 In the example above we have a pair of numbers enclosed in square brackets and
 separated by a hyphen, that's a jump. This jump is indicating that any arbitrary
@@ -272,13 +272,13 @@ Text strings in YARA are case-sensitive by default, however you can turn your
 string into case-insensitive mode by appending the modifier nocase at the end
 of the string definition, in the same line::
 
-    rule CaseInsensitveTextExample
+    rule CaseInsensitiveTextExample
     {
         strings:
             $text_string = "foobar" nocase
 
         condition:
-           $text_string
+            $text_string
     }
 
 With the ``nocase`` modifier the string *foobar* will match *Foobar*, *FOOBAR*,
@@ -293,10 +293,10 @@ per character, something typical in many executable binaries.
 
 
 
-In the above figure de string "Borland" appears encoded as two bytes per
+In the above figure, the string "Borland" appears encoded as two bytes per
 character, therefore the following rule will match::
 
-    rule WideCharTextExample
+    rule WideCharTextExample1
     {
         strings:
             $wide_string = "Borland" wide
@@ -311,7 +311,7 @@ strings containing non-English characters. If you want to search for strings
 in both ASCII and wide form, you can use the ``ascii`` modifier in conjunction
 with ``wide`` , no matter the order in which they appear. ::
 
-    rule WideCharTextExample
+    rule WideCharTextExample2
     {
         strings:
             $wide_and_ascii_string = "Borland" wide ascii
@@ -328,9 +328,9 @@ Searching for full words
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
 Another modifier that can be applied to text strings is ``fullword``. This
-modifier guarantee that the string will match only if it appears in the file
+modifier guarantees that the string will match only if it appears in the file
 delimited by non-alphanumeric characters. For example the string *domain*, if
-defined as ``fullword``, don't matches *www.mydomain.com* but it matches
+defined as ``fullword``, doesn't match *www.mydomain.com* but it matches
 *www.my-domain.com* and *www.domain.com*.
 
 Regular expressions
@@ -354,7 +354,7 @@ Regular expressions can be also followed by ``nocase``, ``ascii``, ``wide``,
 and ``fullword`` modifiers just like in text strings. The semantics of these
 modifiers are the same in both cases.
 
-In previous versions of YARA externals libraries like PCRE and RE2 were used
+In previous versions of YARA, external libraries like PCRE and RE2 were used
 to perform regular expression matching, but starting with version 2.0 YARA uses
 its own regular expression engine. This new engine implements most features
 found in PCRE, except a few of them like capture groups, POSIX character
@@ -394,7 +394,7 @@ The following quantifiers are recognised as well:
    * - ``{n,}``
      - Match at least n times
    * - ``{,m}``
-     - Match 0 to m times
+     - Match at most m times
    * - ``{n,m}``
      - Match n to m times
 
@@ -415,7 +415,7 @@ mark (?):
    * - ``{n,}?``
      - Match at least n times, non-greedy
    * - ``{,m}?``
-     - Match 0 to m times, non-greedy
+     - Match at most m times, non-greedy
    * - ``{n,m}?``
      - Match n to m times, non-greedy
 
@@ -446,7 +446,7 @@ These are the recognised character classes:
    :widths: 3 10
 
    * - ``\w``
-     - Match a *word* character (aphanumeric plus “_”)
+     - Match a *word* character (alphanumeric plus “_”)
    * - ``\W``
      - Match a *non-word* character
    * - ``\s``

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git



More information about the forensics-changes mailing list