From c341449506a4cf2091d88dac747bf0d39c1cf1ee Mon Sep 17 00:00:00 2001
From: Moritz <mr-tz@users.noreply.github.com>
Date: Mon, 13 Feb 2023 10:50:07 +0100
Subject: [PATCH] add rule: convert IP address (#697)

* add rule

---------

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
---
 .../ip/convert-ip-address-from-string.yml       | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 communication/ip/convert-ip-address-from-string.yml

diff --git a/communication/ip/convert-ip-address-from-string.yml b/communication/ip/convert-ip-address-from-string.yml
new file mode 100644
index 00000000..0a00e2fe
--- /dev/null
+++ b/communication/ip/convert-ip-address-from-string.yml
@@ -0,0 +1,17 @@
+# generated using capa explorer for IDA Pro
+rule:
+  meta:
+    name: convert IP address from string
+    namespace: communication/ip
+    authors:
+      - "@mr-tz"
+    scope: basic block
+    examples:
+      - 0796F1C1EA0A142FC1EB7109A44C86CB:0x405D20
+  features:
+    - and:
+      - api: inet_pton
+      - optional:
+        - or:
+          - number: 2 = AF_INET
+          - number: 23 = AF_INET6