From ef1bb4725972ab3a2aab659d97020efd1553c74a Mon Sep 17 00:00:00 2001 From: Wesley Shields Date: Wed, 8 May 2024 09:24:01 -0400 Subject: [PATCH] Add docs for multiline string literals. --- docs/writingrules.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/writingrules.rst b/docs/writingrules.rst index 6547508560..6af14a6788 100644 --- a/docs/writingrules.rst +++ b/docs/writingrules.rst @@ -1610,6 +1610,12 @@ identifier/value pairs like in the following example: my_identifier_1 = "Some string data" my_identifier_2 = 24 my_identifier_3 = true + my_identifier_4 = """ + I am a multiline string literal. + I will be stored in your rule directly as is. If you have + escape sequences like \x41 those will be converted to their + raw byte value. When done, just add the closing quotes. + """ strings: $my_text_string = "text here" @@ -1626,6 +1632,8 @@ Note that identifier/value pairs defined in the metadata section cannot be used in the condition section, their only purpose is to store additional information about the rule. +NOTE: Multiline string literals are supported starting in YARA 4.6.0. + .. _using-modules: Using modules