From afe5dba92ae42b6ef663240817b39df603ec38f6 Mon Sep 17 00:00:00 2001
From: Moritz Raabe <moritz.raabe@fireeye.com>
Date: Tue, 30 Jun 2020 22:11:57 +0200
Subject: [PATCH] document signed vs unsigned

---
 README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index b1883c18..af597b04 100644
--- a/README.md
+++ b/README.md
@@ -348,7 +348,8 @@ Examples:
     number: 0x10
     number: 0x40 = PAGE_EXECUTE_READWRITE
 
-TODO: signed vs unsigned.
+Note that capa treats all numbers as unsigned values. A negative number is not a valid feature value.
+To match a negative number you may specify its two's complement representation. For example, `0xFFFFFFF0` (`-2`) in a 32-bit file.
 
 ### string
 A string referenced by the logic of the program.
@@ -402,6 +403,8 @@ Examples:
     offset: 0xC
     offset: 0x14
 
+Note that capa treats all offsets as unsigned values. A negative number is not a valid feature value.
+
 ### mnemonic
 
 An instruction mnemonic found in the given function.