capa/capa/features/insn.py

# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License
#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.
import abc
from typing import Dict, Tuple, Union, Optional

import capa.helpers
from capa.features.common import VALID_FEATURE_ACCESS, Feature


def hex(n: int) -> str:
    """render the given number using upper case hex, like: 0x123ABC"""
    if n < 0:
        return f"-0x{(-n):X}"
    else:
        return f"0x{(n):X}"


class API(Feature):
    def __init__(self, signature: str, description=None):
        if signature.isidentifier():
            # api call is in the legacy format
            super().__init__(signature, description=description)
            self.args = {}
            self.ret = False
        else:
            # api call is in the strace format and therefore has to be parsed
            name, self.args, self.ret = self.parse_signature(signature)
            super().__init__(name, description=description)

        # store the original signature for hashing purposes
        self.signature = signature

    def __hash__(self):
        return hash(self.signature)

    def __eq__(self, other):
        if not isinstance(other, API):
            return False

        assert isinstance(other, API)
        if {} in (self.args, other.args) or False in (self.ret, other.ret):
            # Legacy API feature
            return super().__eq__(other)

        # API call with arguments
        return super().__eq__(other) and self.args == other.args and self.ret == other.ret

    def parse_signature(self, signature: str) -> Tuple[str, Optional[Dict[str, str]], Optional[str]]:
        # todo: optimize this method and improve the code quality
        import re

        args = ret = False

        match = re.findall(r"(.+\(.*\)) ?=? ?([^=]*)", signature)
        if not match:
            return "", None, None
        if len(match[0]) == 2:
            ret = match[0][1]

        match = re.findall(r"(.*)\((.*)\)", match[0][0])
        if len(match[0]) == 2:
            args = (match[0][1] + ", ").split(", ")
            map(lambda x: {f"arg{x[0]}": x[1]}, enumerate(args))
            args = [{} | arg for arg in args][0]

        return match[0][0], args, ret


class _AccessFeature(Feature, abc.ABC):
    # superclass: don't use directly
    def __init__(self, value: str, access: Optional[str] = None, description: Optional[str] = None):
        super().__init__(value, description=description)
        if access is not None:
            if access not in VALID_FEATURE_ACCESS:
                raise ValueError(f"{self.name} access type {access} not valid")
        self.access = access

    def __hash__(self):
        return hash((self.name, self.value, self.access))

    def __eq__(self, other):
        return super().__eq__(other) and self.access == other.access

    def get_name_str(self) -> str:
        if self.access is not None:
            return f"{self.name}/{self.access}"
        return self.name


class Property(_AccessFeature):
    def __init__(self, value: str, access: Optional[str] = None, description=None):
        super().__init__(value, access=access, description=description)


class Number(Feature):
    def __init__(self, value: Union[int, float], description=None):
        """
        args:
          value (int or float): positive or negative integer, or floating point number.

        the range of the value is:
          - if positive, the range of u64
          - if negative, the range of i64
          - if floating, the range and precision of double
        """
        super().__init__(value, description=description)

    def get_value_str(self):
        if isinstance(self.value, int):
            return capa.helpers.hex(self.value)
        elif isinstance(self.value, float):
            return str(self.value)
        else:
            raise ValueError(f"invalid value type {type(self.value)}")


# max recognized structure size (and therefore, offset size)
MAX_STRUCTURE_SIZE = 0x10000


class Offset(Feature):
    def __init__(self, value: int, description=None):
        """
        args:
          value (int): the offset, which can be positive or negative.

        the range of the value is:
          - if positive, the range of u64
          - if negative, the range of i64
        """
        super().__init__(value, description=description)

    def get_value_str(self):
        assert isinstance(self.value, int)
        return hex(self.value)


class Mnemonic(Feature):
    def __init__(self, value: str, description=None):
        super().__init__(value, description=description)


# max number of operands to consider for a given instruction.
# since we only support Intel and .NET, we can assume this is 3
# which covers cases up to e.g. "vinserti128 ymm0,ymm0,ymm5,1"
MAX_OPERAND_COUNT = 4
MAX_OPERAND_INDEX = MAX_OPERAND_COUNT - 1


class _Operand(Feature, abc.ABC):
    # superclass: don't use directly
    # subclasses should set self.name and provide the value string formatter
    def __init__(self, index: int, value: Union[int, float], description=None):
        super().__init__(value, description=description)
        self.index = index

    def __hash__(self):
        return hash((self.name, self.value))

    def __eq__(self, other):
        return super().__eq__(other) and self.index == other.index


class OperandNumber(_Operand):
    # cached names so we don't do extra string formatting every ctor
    NAMES = [f"operand[{i}].number" for i in range(MAX_OPERAND_COUNT)]

    # operand[i].number: 0x12
    def __init__(self, index: int, value: Union[int, float], description=None):
        """
        args:
          value (int or float): positive or negative integer, or floating point number.

        the range of the value is:
          - if positive, the range of u64
          - if negative, the range of i64
          - if floating, the range and precision of double
        """
        super().__init__(index, value, description=description)
        self.name = self.NAMES[index]

    def get_value_str(self) -> str:
        if isinstance(self.value, int):
            return capa.helpers.hex(self.value)
        elif isinstance(self.value, float):
            return str(self.value)
        else:
            raise ValueError("invalid value type")


class OperandOffset(_Operand):
    # cached names so we don't do extra string formatting every ctor
    NAMES = [f"operand[{i}].offset" for i in range(MAX_OPERAND_COUNT)]

    # operand[i].offset: 0x12
    def __init__(self, index: int, value: int, description=None):
        """
        args:
          value (int): the offset, which can be positive or negative.

        the range of the value is:
          - if positive, the range of u64
          - if negative, the range of i64
        """
        super().__init__(index, value, description=description)
        self.name = self.NAMES[index]

    def get_value_str(self) -> str:
        assert isinstance(self.value, int)
        return hex(self.value)