From 2394585b6711a8c204bf9762fdff3782e46cd982 Mon Sep 17 00:00:00 2001 From: Shea Craig Date: Fri, 18 Sep 2015 15:54:38 -0400 Subject: [PATCH] Update README. --- README.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ea53271..124a7ae 100644 --- a/README.md +++ b/README.md @@ -36,6 +36,7 @@ In most cases, each adware "product" should be defined in its own file, although The top-level tag should be ``, followed by metadata tags describing the document. ### Metadata Tags - ``: Version number of the ADF. This value should be incremented as changes are made over the lifetime of the definition. +- ``: SavingThrow version 1.1.0 introduced the `` subelements `` and `` and the ability to do multiples of each. This obviously won't work in older versions of SavingThrow. Therefore, ADF files can specify a minimum version of SavingThrow required to use all of the included features. SavingThrow will log a warning, but try to run the ADF anyway, if the version is too old. - ``: The author of this ADF. - ``: If the ADF is based on another ADF, provide original source URL's to aid others in researching. - XML Comments for other top-level notes can go here as well. @@ -48,9 +49,17 @@ If at all possible, include a source for downloading the adware so interested or The simplest adware element is ``. `` defines a single file path to look for. The path can include standard shell globbing characters (`*?[a-z]`, etc) and text substitution as described below. No tilde expansions are performed. -Files with ambiguous, misleading, dynamically renamed, or obfuscated filenames or paths can be identified with a `` element. Each `` element must include a `` and a `` element, and may optionally include a `ReplacementKey`. +Files with ambiguous, misleading, dynamically renamed, or obfuscated filenames or paths can be identified with a `` element. Each `` element can include as many ``, ``, ``, and `` tags as needed to define problem files, and may optionally include a `ReplacementKey`. + +The rules are that if you include one or more ``, and one more more ``, each regex will be tested against every file found at ``. Matches will be added to a list. + +Then, for each ``, open each file from the above matches list, plus any ``s explictly specified (including globbing characters as per the standard `` tag), and perform a regular expression search of the contents of that file. Matches are added to the final candidate list. + +Individual details on these tags are below: +``: Regular expression used against each file specified as a ``. Matches are added to a candidate list. +``: A directory on the computer to search with ``s. May use globbing characters. ``: As per the standard `` tag above; also allows standard globbing characters. This file will be opened and searched using the... -``: A regular expression that matches some text in this ``. May include *one* group, indicated by `( )`'s, which will become the value of `` in the text replacement dictionary. +``: A regular expression that matches some text in the ``s and matched ``s. May include *one* group, indicated by `( )`'s, which will become the value of `` in the text replacement dictionary. ``: If provided, will add or update the text replacement dictionary with the `` value as the key, and uses the first group result from the above regex search as a value. An example of how this is used can be seen in the default ADF: