New feature: Instruction

Summary

Often we want to check for specific instructions and use the basic block scope for this.

Example from check for software breakpoints

  features:
    - and:
      - basic block:
        - and:
          - mnemonic: cmp
          - or:
            - number: 0xCC
            - and:
              - number: 0xCD
              - number: 0x3
      - match: contain loop

I’m not sure if we need complete flexibility, but a way to provide variable operand values would be neat.

Examples:

- instruction: cmp <reg>, 0xCC
- instruction: cmp <mem>, 0xCC
- instruction: cmp <var = anything>, 0xCC

Key Instruction fields:

• mnemomic
• operands
  • reg/imm/mem
  • size
  • displacement
• (prefixes) - optional

Or as a “subscope”?

- instruction:
  - mnemonic: cmp
  - operand1: 0xCC

We could then continue to support the mnemonic feature as an alias for the new instruction feature.

Motivation

An instruction scope would allow for more expressive and concise rules.

Downsides

More complexity for extractors and potential performance hits.

[williballenthin]

This does sound useful.

I think this will negatively affect performance; however, this is not a good reason to reduce the expressivity of capa. It just lends further support to #602 to investigate better matching algorithms.

[williballenthin]

piggy back on syntax discussion in #921