diff --git a/CHANGELOG.md b/CHANGELOG.md index c35033d7..50e6bd7c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,6 +32,7 @@ ### Development +- doc: fix typo in usage.md, add documentation links to README @devs6186 #2274 - ci: deprecate macos-13 runner and use Python v3.13 for testing @mike-hunhoff #2777 ### Raw diffs diff --git a/README.md b/README.md index 57c6c697..8a0fc9e9 100644 --- a/README.md +++ b/README.md @@ -87,6 +87,8 @@ Download stable releases of the standalone capa binaries [here](https://github.c To use capa as a library or integrate with another tool, see [doc/installation.md](https://github.com/mandiant/capa/blob/master/doc/installation.md) for further setup instructions. +**Documentation:** [Usage and tips](doc/usage.md) · [Installation](doc/installation.md) · [Limitations](doc/limitations.md) · [FAQ](doc/faq.md) + # capa Explorer Web The [capa Explorer Web](https://mandiant.github.io/capa/explorer/) enables you to interactively explore capa results in your web browser. Besides the online version you can download a standalone HTML file for local offline usage. diff --git a/doc/usage.md b/doc/usage.md index 949e03e1..77c5e31e 100644 --- a/doc/usage.md +++ b/doc/usage.md @@ -11,7 +11,7 @@ For example, `capa -t william.ballenthin@mandiant.com` runs rules that reference ### only analyze selected functions Use the `--restrict-to-functions` option to extract capabilities from only a selected set of functions. This is useful for analyzing -large functions and figuring out their capabilities and their address of occurance; for example: PEB access, RC4 encryption, etc. +large functions and figuring out their capabilities and their address of occurrence; for example: PEB access, RC4 encryption, etc. To use this, you can copy the virtual addresses from your favorite disassembler and pass them to capa as follows: `capa sample.exe --restrict-to-functions 0x4019C0,0x401CD0`. If you add the `-v` option then capa will extract the interesting parts of a function for you.