question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

New feature: Instruction

See original GitHub issue

Summary

Often we want to check for specific instructions and use the basic block scope for this.

Example from check for software breakpoints

  features:
    - and:
      - basic block:
        - and:
          - mnemonic: cmp
          - or:
            - number: 0xCC
            - and:
              - number: 0xCD
              - number: 0x3
      - match: contain loop

I’m not sure if we need complete flexibility, but a way to provide variable operand values would be neat.

Examples:

- instruction: cmp <reg>, 0xCC
- instruction: cmp <mem>, 0xCC
- instruction: cmp <var = anything>, 0xCC

Key Instruction fields:

  • mnemomic
  • operands
    • reg/imm/mem
    • size
    • displacement
  • (prefixes) - optional

Or as a “subscope”?

- instruction:
  - mnemonic: cmp
  - operand1: 0xCC

We could then continue to support the mnemonic feature as an alias for the new instruction feature.

Motivation

An instruction scope would allow for more expressive and concise rules.

Downsides

More complexity for extractors and potential performance hits.

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:6

github_iconTop GitHub Comments

1reaction
williballenthincommented, Sep 10, 2021

This does sound useful.

I think this will negatively affect performance; however, this is not a good reason to reduce the expressivity of capa. It just lends further support to #602 to investigate better matching algorithms.

0reactions
williballenthincommented, Mar 22, 2022

piggy back on syntax discussion in #921

Read more comments on GitHub >

github_iconTop Results From Across the Web

A Guide to Announcing New Features Effectively - UserGuiding
A new feature announcement is the first stage of new feature onboarding, followed by new feature training and new feature feedback.
Read more >
How to Announce New Features to Drive Product Adoption
You can guide your users directly to the new feature and show segmented messaging to help them get adopted. Here's a product tour...
Read more >
5 new feature announcement examples to guide your next ...
Short, simple instructional videos that show how to use the new features for both mobile and desktop users; Helpful images that break up...
Read more >
Driving New Feature Adoption - What Channels to Use and ...
New feature adoption doesn't just happen by itself. Here are the best ways to announce new features & drive adoption for every type...
Read more >
How to Announce New Features to Drive Adoption (+Checklist)
How do you announce new product features? Read more to learn how to create an omni-channel new feature launch strategy to drive adoption....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found