From bc01392e93ffba5b5b0ceee2fad20a92e3564089 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 15 Dec 2019 14:44:07 -0500 Subject: [PATCH] doc: Update byte_test documentation --- doc/userguide/rules/payload-keywords.rst | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index ad4e5814af..ca4f6eeb6c 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -299,7 +299,11 @@ Example of dsize in a rule: byte_test --------- -The ``byte_test`` keyword extracts ```` and performs an operation selected with ```` against the value in ```` at a particular ````. +The ``byte_test`` keyword extracts ```` and performs an operation selected +with ```` against the value in ```` at a particular ````. +The ```` is applied to the extracted bytes (before the operator is applied), +and the final result will be right shifted one bit for each trailing ``0`` in +the ````. Format::