2012
08.02

I recently created a Snort “User Defined Language” in Notepad++ and wanted to share both the schema, what it looks like, and the steps necessary to create it.

To start, if not already done, you should download and install Notepad++ from here. It does not matter which package you choose so long as you remember where it is installed and/or where you placed the install folder.

Next, in order for the parser for Snort to work, we will need to install UDL2 from here. The download consists of two files (Notepad2++.exe and SciLexer2.dll) which need to be put in your Notepad++ install directory. UDL2 allows for the following nice (if not must have) features, amongst others:

  • Operators can now be longer than one character -a limitation in the standard version.
  • There can now be up to 8 delimiters compared to the 3 in the standard version.
  • The same characters can be used as both comments and operators.

Once the above is completed, we open Notepad2++.exe and find four tabs to fill out; “Folder & Default”, “Keyword Lists”, “Comment & Number”, and “Operators & Delimiters”. If you want to create a new UDL you’ll need to dig through the documentation for the applicable language to find the proper keywords. Not too hard, really. In my case I looked here¬†for the Snort (2.9.2) documentation.

With Snort you don’t need to worry about setting an associated file extension, however, for other custom languages you will likely want to be sure that you set one; don’t worry about saving, either, as the application automatically writes changes to the userDefineLang.xml file and will auto-save once the application is closed.

If you want to install the Snort language parser as provided in this post, simply copy the XML and save it to a file called “userDefineLang.xml” and place it in your %APPDATA%\Notepad++ directory (or “npp” folder if you downloaded the .zip package). If there are other custom languages installed you’ll need to merge the XML files, however, if you have more than one installed, you probably like doing things like merging XML files anyway. :)

Now to the goodies. Below is a badly done screenshot (for the lazy) showing a sample Snort rule using the schema:

Here is the actual XML schema itself for your edification:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
<NotepadPlus>
    <UserLang name="Snort" ext="" udlVersion="2.0">
        <Settings>
            <Global caseIgnored="no" allowFoldOfComments="no" forceLineCommentsAtBOL="no" foldCompact="no" />
            <Prefix Keywords1="no" Keywords2="no" Keywords3="no" Keywords4="no" Keywords5="no" Keywords6="no" Keywords7="no" Keywords8="no" />
        </Settings>
        <KeywordLists>
            <Keywords name="Comments" id="0">03 04 00# 01 02</Keywords>
            <Keywords name="Numbers, additional" id="1"></Keywords>
            <Keywords name="Numbers, prefixes" id="2"></Keywords>
            <Keywords name="Numbers, extras with prefixes" id="3"></Keywords>
            <Keywords name="Numbers, suffixes" id="4"></Keywords>
            <Keywords name="Operators1" id="5">- &quot; ( ) , : ; | &lt; &gt;</Keywords>
            <Keywords name="Operators2" id="6"></Keywords>
            <Keywords name="Folders in code1, open" id="7"></Keywords>
            <Keywords name="Folders in code1, middle" id="8"></Keywords>
            <Keywords name="Folders in code1, close" id="9"></Keywords>
            <Keywords name="Folders in code2, open" id="10"></Keywords>
            <Keywords name="Folders in code2, middle" id="11"></Keywords>
            <Keywords name="Folders in code2, close" id="12"></Keywords>
            <Keywords name="Folders in comment, open" id="13"></Keywords>
            <Keywords name="Folders in comment, middle" id="14"></Keywords>
            <Keywords name="Folders in comment, close" id="15"></Keywords>
            <Keywords name="Keywords1" id="16">alert log pass activate dynamic drop reject sdrop tcp ip udp icmp</Keywords>
            <Keywords name="Keywords2" id="17">$AIM_SERVERS $DNS_SERVERS $DNS_SERVERS_AD $EXTERNAL_NET $FILE_DATA_PORTS $GTP_PORTS $HOME_NET $HTTP_PORTS $HTTP_SERVERS $ORACLE_PORTS $SHELLCODE_PORTS $SIP_PORTS $SIP_SERVERS $SMTP_SERVERS $SNMP_SERVERS $SNORT_BPF $SQL_SERVERS $SSH_PORTS $SSH_SERVERS $TELNET_SERVERS</Keywords>
            <Keywords name="Keywords3" id="18">msg reference gid sid rev classtype priority metadeta content uricontent nocase threshold type limit track limit by_src by_dst count seconds distance within depth offset rawbytes http_client_body http_cookie http_raw_cookie http_header http_raw_header http_method http_uri http_raw_uri http_stat_code http_stat_msg http_encode fast_pattern urilen isdataat pcre pkt_data file_data base64_decode base64_data byte_test byte_jump byte_extract ftpbounce asn1 cvs dce_iface dce opnum dce_stub_data sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version ssl_state fragoffset ttl tos id ipopts fragbits dsize flags flow flowbits seq ack window itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size logto session resp react tag activates activated_by replace detection_filter metadata</Keywords>
            <Keywords name="Keywords4" id="19"></Keywords>
            <Keywords name="Keywords5" id="20"></Keywords>
            <Keywords name="Keywords6" id="21"></Keywords>
            <Keywords name="Keywords7" id="22"></Keywords>
            <Keywords name="Keywords8" id="23"></Keywords>
            <Keywords name="Delimiters" id="24">00| 01 02| 03&quot; 04 05&quot; 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23</Keywords>
        </KeywordLists>
        <Styles>
            <WordsStyle name="DEFAULT" styleID="0" fgColor="C0C0C0" bgColor="000000" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="COMMENTS" styleID="1" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="LINE COMMENTS" styleID="2" fgColor="000000" bgColor="80FF80" fontName="" fontStyle="2" nesting="0" />
            <WordsStyle name="NUMBERS" styleID="3" fgColor="00FFFF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS1" styleID="4" fgColor="FF0000" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS2" styleID="5" fgColor="0080FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS3" styleID="6" fgColor="FF8040" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS4" styleID="7" fgColor="00FF80" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS5" styleID="8" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS6" styleID="9" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS7" styleID="10" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS8" styleID="11" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="OPERATORS" styleID="12" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="FOLDER IN CODE1" styleID="13" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN CODE2" styleID="14" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN COMMENT" styleID="15" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS1" styleID="16" fgColor="8000FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS2" styleID="17" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS3" styleID="18" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS4" styleID="19" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS5" styleID="20" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS6" styleID="21" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS7" styleID="22" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS8" styleID="23" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
        </Styles>
    </UserLang>
    <UserLang name="Snort" ext="" udlVersion="2.0">
        <Settings>
            <Global caseIgnored="no" allowFoldOfComments="no" forceLineCommentsAtBOL="no" foldCompact="no" />
            <Prefix Keywords1="no" Keywords2="no" Keywords3="no" Keywords4="no" Keywords5="no" Keywords6="no" Keywords7="no" Keywords8="no" />
        </Settings>
        <KeywordLists>
            <Keywords name="Comments" id="0">03 04 00# 01 02</Keywords>
            <Keywords name="Numbers, additional" id="1"></Keywords>
            <Keywords name="Numbers, prefixes" id="2"></Keywords>
            <Keywords name="Numbers, extras with prefixes" id="3"></Keywords>
            <Keywords name="Numbers, suffixes" id="4"></Keywords>
            <Keywords name="Operators1" id="5">- &quot; ( ) , : ; | &lt; &gt;</Keywords>
            <Keywords name="Operators2" id="6"></Keywords>
            <Keywords name="Folders in code1, open" id="7"></Keywords>
            <Keywords name="Folders in code1, middle" id="8"></Keywords>
            <Keywords name="Folders in code1, close" id="9"></Keywords>
            <Keywords name="Folders in code2, open" id="10"></Keywords>
            <Keywords name="Folders in code2, middle" id="11"></Keywords>
            <Keywords name="Folders in code2, close" id="12"></Keywords>
            <Keywords name="Folders in comment, open" id="13"></Keywords>
            <Keywords name="Folders in comment, middle" id="14"></Keywords>
            <Keywords name="Folders in comment, close" id="15"></Keywords>
            <Keywords name="Keywords1" id="16">alert log pass activate dynamic drop reject sdrop tcp ip udp icmp</Keywords>
            <Keywords name="Keywords2" id="17">$AIM_SERVERS $DNS_SERVERS $DNS_SERVERS_AD $EXTERNAL_NET $FILE_DATA_PORTS $GTP_PORTS $HOME_NET $HTTP_PORTS $HTTP_SERVERS $ORACLE_PORTS $SHELLCODE_PORTS $SIP_PORTS $SIP_SERVERS $SMTP_SERVERS $SNMP_SERVERS $SNORT_BPF $SQL_SERVERS $SSH_PORTS $SSH_SERVERS $TELNET_SERVERS</Keywords>
            <Keywords name="Keywords3" id="18">msg reference gid sid rev classtype priority metadeta content uricontent nocase threshold type limit track limit by_src by_dst count seconds distance within depth offset rawbytes http_client_body http_cookie http_raw_cookie http_header http_raw_header http_method http_uri http_raw_uri http_stat_code http_stat_msg http_encode fast_pattern urilen isdataat pcre pkt_data file_data base64_decode base64_data byte_test byte_jump byte_extract ftpbounce asn1 cvs dce_iface dce opnum dce_stub_data sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version ssl_state fragoffset ttl tos id ipopts fragbits dsize flags flow flowbits seq ack window itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size logto session resp react tag activates activated_by replace detection_filter</Keywords>
            <Keywords name="Keywords4" id="19"></Keywords>
            <Keywords name="Keywords5" id="20"></Keywords>
            <Keywords name="Keywords6" id="21"></Keywords>
            <Keywords name="Keywords7" id="22"></Keywords>
            <Keywords name="Keywords8" id="23"></Keywords>
            <Keywords name="Delimiters" id="24">00| 01 02| 03&quot; 04 05&quot; 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23</Keywords>
        </KeywordLists>
        <Styles>
            <WordsStyle name="DEFAULT" styleID="0" fgColor="C0C0C0" bgColor="000000" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="COMMENTS" styleID="1" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="LINE COMMENTS" styleID="2" fgColor="000000" bgColor="80FF80" fontName="" fontStyle="2" nesting="0" />
            <WordsStyle name="NUMBERS" styleID="3" fgColor="00FFFF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS1" styleID="4" fgColor="FF0000" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS2" styleID="5" fgColor="0080FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS3" styleID="6" fgColor="FF8040" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS4" styleID="7" fgColor="00FF80" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS5" styleID="8" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS6" styleID="9" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS7" styleID="10" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS8" styleID="11" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="OPERATORS" styleID="12" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="FOLDER IN CODE1" styleID="13" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN CODE2" styleID="14" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN COMMENT" styleID="15" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS1" styleID="16" fgColor="8000FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS2" styleID="17" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS3" styleID="18" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS4" styleID="19" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS5" styleID="20" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS6" styleID="21" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS7" styleID="22" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS8" styleID="23" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
        </Styles>
    </UserLang>
    <UserLang name="Snort2" ext="" udlVersion="2.0">
        <Settings>
            <Global caseIgnored="no" allowFoldOfComments="no" forceLineCommentsAtBOL="no" foldCompact="no" />
            <Prefix Keywords1="no" Keywords2="no" Keywords3="no" Keywords4="no" Keywords5="no" Keywords6="no" Keywords7="no" Keywords8="no" />
        </Settings>
        <KeywordLists>
            <Keywords name="Comments" id="0">03 04 00# 01 02</Keywords>
            <Keywords name="Numbers, additional" id="1"></Keywords>
            <Keywords name="Numbers, prefixes" id="2"></Keywords>
            <Keywords name="Numbers, extras with prefixes" id="3"></Keywords>
            <Keywords name="Numbers, suffixes" id="4"></Keywords>
            <Keywords name="Operators1" id="5">- &quot; ( ) , : ; | &lt; &gt;</Keywords>
            <Keywords name="Operators2" id="6"></Keywords>
            <Keywords name="Folders in code1, open" id="7"></Keywords>
            <Keywords name="Folders in code1, middle" id="8"></Keywords>
            <Keywords name="Folders in code1, close" id="9"></Keywords>
            <Keywords name="Folders in code2, open" id="10"></Keywords>
            <Keywords name="Folders in code2, middle" id="11"></Keywords>
            <Keywords name="Folders in code2, close" id="12"></Keywords>
            <Keywords name="Folders in comment, open" id="13"></Keywords>
            <Keywords name="Folders in comment, middle" id="14"></Keywords>
            <Keywords name="Folders in comment, close" id="15"></Keywords>
            <Keywords name="Keywords1" id="16">alert log pass activate dynamic drop reject sdrop tcp ip udp icmp</Keywords>
            <Keywords name="Keywords2" id="17">$AIM_SERVERS $DNS_SERVERS $DNS_SERVERS_AD $EXTERNAL_NET $FILE_DATA_PORTS $GTP_PORTS $HOME_NET $HTTP_PORTS $HTTP_SERVERS $ORACLE_PORTS $SHELLCODE_PORTS $SIP_PORTS $SIP_SERVERS $SMTP_SERVERS $SNMP_SERVERS $SNORT_BPF $SQL_SERVERS $SSH_PORTS $SSH_SERVERS $TELNET_SERVERS</Keywords>
            <Keywords name="Keywords3" id="18">msg reference gid sid rev classtype priority metadeta content uricontent nocase threshold type limit track limit by_src by_dst count seconds distance within depth offset rawbytes http_client_body http_cookie http_raw_cookie http_header http_raw_header http_method http_uri http_raw_uri http_stat_code http_stat_msg http_encode fast_pattern urilen isdataat pcre pkt_data file_data base64_decode base64_data byte_test byte_jump byte_extract ftpbounce asn1 cvs dce_iface dce opnum dce_stub_data sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version ssl_state fragoffset ttl tos id ipopts fragbits dsize flags flow flowbits seq ack window itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size logto session resp react tag activates activated_by replace detection_filter</Keywords>
            <Keywords name="Keywords4" id="19"></Keywords>
            <Keywords name="Keywords5" id="20"></Keywords>
            <Keywords name="Keywords6" id="21"></Keywords>
            <Keywords name="Keywords7" id="22"></Keywords>
            <Keywords name="Keywords8" id="23"></Keywords>
            <Keywords name="Delimiters" id="24">00| 01 02| 03&quot; 04 05&quot; 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23</Keywords>
        </KeywordLists>
        <Styles>
            <WordsStyle name="DEFAULT" styleID="0" fgColor="C0C0C0" bgColor="000000" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="COMMENTS" styleID="1" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="LINE COMMENTS" styleID="2" fgColor="000000" bgColor="80FF80" fontName="" fontStyle="2" nesting="0" />
            <WordsStyle name="NUMBERS" styleID="3" fgColor="00FFFF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS1" styleID="4" fgColor="FF0000" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS2" styleID="5" fgColor="0080FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS3" styleID="6" fgColor="FF8040" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS4" styleID="7" fgColor="00FF80" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="KEYWORDS5" styleID="8" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS6" styleID="9" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS7" styleID="10" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="KEYWORDS8" styleID="11" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="OPERATORS" styleID="12" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="FOLDER IN CODE1" styleID="13" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN CODE2" styleID="14" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="FOLDER IN COMMENT" styleID="15" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS1" styleID="16" fgColor="8000FF" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS2" styleID="17" fgColor="00FF00" bgColor="000000" fontName="" fontStyle="1" nesting="0" />
            <WordsStyle name="DELIMITERS3" styleID="18" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS4" styleID="19" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS5" styleID="20" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS6" styleID="21" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS7" styleID="22" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
            <WordsStyle name="DELIMITERS8" styleID="23" fgColor="000000" bgColor="FFFFFF" fontName="" fontStyle="0" nesting="0" />
        </Styles>
    </UserLang>
</NotepadPlus>

Enjoy!

2 comments so far

Add Your Comment
  1. Nicely done, just one comment, your XML highlights the second part of a cve reference
    ie. reference:cve,2005-0752; 0752 is bolded.

    • Hey Alex, Thanks for the comment and the feedback! I see what you’re saying. I’ve just updated the XML to prevent the highlighting issue you mentioned.