From 1fa9180fee2fea9beb5490b9dc856b539691c102 Mon Sep 17 00:00:00 2001 From: Josh Soref <2119212+jsoref@users.noreply.github.com> Date: Wed, 4 Jan 2023 00:25:07 -0500 Subject: [PATCH] spelling: beginning Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com> --- scripts/capa2yara.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/capa2yara.py b/scripts/capa2yara.py index d38c970a..f4c9b357 100644 --- a/scripts/capa2yara.py +++ b/scripts/capa2yara.py @@ -283,7 +283,7 @@ def convert_rule(rule, rulename, cround, depth): # change capas /xxx/i to yaras /xxx/ nocase, count will be used later to decide appending 'nocase' regex, count = re.subn(r"/i$", "/", regex) - # remove / in the begining and end + # remove / in the beginning and end regex = regex[1:-1] # all .* in the regexes of capa look like they should be maximum 100 chars so take 1000 to speed up rules and prevent yara warnings on poor performance @@ -296,7 +296,7 @@ def convert_rule(rule, rulename, cround, depth): # /reg(|.exe)/ => /reg(.exe)?/ regex = re.sub(r"\(\|([^\)]+)\)", r"(\1)?", regex) - # change begining of line to null byte, e.g. /^open => /\x00open (not word boundary because we're not looking for the begining of a word in a text but usually a function name if there's ^ in a capa rule) + # change beginning of line to null byte, e.g. /^open => /\x00open (not word boundary because we're not looking for the beginning of a word in a text but usually a function name if there's ^ in a capa rule) regex = re.sub(r"^\^", r"\\x00", regex) # regex = re.sub(r"^\^", r"\\b", regex)