New feature: Instruction
See original GitHub issueSummary
Often we want to check for specific instructions and use the basic block scope for this.
Example from check for software breakpoints
features:
- and:
- basic block:
- and:
- mnemonic: cmp
- or:
- number: 0xCC
- and:
- number: 0xCD
- number: 0x3
- match: contain loop
I’m not sure if we need complete flexibility, but a way to provide variable operand values would be neat.
Examples:
- instruction: cmp <reg>, 0xCC
- instruction: cmp <mem>, 0xCC
- instruction: cmp <var = anything>, 0xCC
Key Instruction
fields:
- mnemomic
- operands
- reg/imm/mem
- size
- displacement
- (prefixes) - optional
Or as a “subscope”?
- instruction:
- mnemonic: cmp
- operand1: 0xCC
We could then continue to support the mnemonic
feature as an alias for the new instruction
feature.
Motivation
An instruction scope would allow for more expressive and concise rules.
Downsides
More complexity for extractors and potential performance hits.
Issue Analytics
- State:
- Created 2 years ago
- Comments:6
Top Results From Across the Web
A Guide to Announcing New Features Effectively - UserGuiding
A new feature announcement is the first stage of new feature onboarding, followed by new feature training and new feature feedback.
Read more >How to Announce New Features to Drive Product Adoption
You can guide your users directly to the new feature and show segmented messaging to help them get adopted. Here's a product tour...
Read more >5 new feature announcement examples to guide your next ...
Short, simple instructional videos that show how to use the new features for both mobile and desktop users; Helpful images that break up...
Read more >Driving New Feature Adoption - What Channels to Use and ...
New feature adoption doesn't just happen by itself. Here are the best ways to announce new features & drive adoption for every type...
Read more >How to Announce New Features to Drive Adoption (+Checklist)
How do you announce new product features? Read more to learn how to create an omni-channel new feature launch strategy to drive adoption....
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
This does sound useful.
I think this will negatively affect performance; however, this is not a good reason to reduce the expressivity of capa. It just lends further support to #602 to investigate better matching algorithms.
piggy back on syntax discussion in #921