gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-01-08 03:11:05 -08:00
Code Issues Packages Projects Releases Wiki Activity

document signed vs unsigned

Browse Source
This commit is contained in:
Moritz Raabe
2020-06-30 22:11:57 +02:00
parent 0a5947290b
commit afe5dba92a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@@ -348,7 +348,8 @@ Examples:
number: 0x10
number: 0x40 = PAGE_EXECUTE_READWRITE
TODO: signed vs unsigned.
Note that capa treats all numbers as unsigned values. A negative number is not a valid feature value.
To match a negative number you may specify its two's complement representation. For example, `0xFFFFFFF0` (`-2`) in a 32-bit file.
### string
A string referenced by the logic of the program.
@@ -402,6 +403,8 @@ Examples:
offset: 0xC
offset: 0x14
Note that capa treats all offsets as unsigned values. A negative number is not a valid feature value.
### mnemonic
An instruction mnemonic found in the given function.