From 7bce20212202fc2ff28cca56071c6d555256bb0e Mon Sep 17 00:00:00 2001 From: William Ballenthin Date: Tue, 15 Jun 2021 12:31:56 -0600 Subject: [PATCH] doc: explain CAPA_SAVE_WORKSPACE --- doc/usage.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/usage.md b/doc/usage.md index 75a71b4f..74b163f4 100644 --- a/doc/usage.md +++ b/doc/usage.md @@ -11,3 +11,9 @@ For example, `capa -t william.ballenthin@mandiant.com` runs rules that reference ### IDA Pro plugin: capa explorer Please check out the [capa explorer documentation](/capa/ida/plugin/README.md). + +### save time by reusing .viv files +Set the environment variable `CAPA_SAVE_WORKSPACE` to instruct the underlying analysis engine to +cache its intermediate results to the file system. For example, vivisect will create `.viv` files. +Subsequently, capa may run faster when reprocessing the same input file. +This is particularly useful during rule development as you repeatedly test a rule against a known sample. \ No newline at end of file