emit number(0) for insn like "xor eax, eax"

CHANGELOG.md

@@ -3,15 +3,15 @@
 ## master (unreleased)
 
 ### New Features
-
+- emit number(0) for instructions like "xor eax,eax" #2622 @v1bh475u
+- 
 ### Breaking Changes
 
 ### New Rules (4)
 
 - communication/socket/connect-socket [email protected] [email protected] [email protected]
 - communication/socket/udp/connect-udp-socket [email protected]
 - nursery/enter-debug-mode-in-dotnet @v1bh475u
--
 
 ### Bug Fixes
 - cape: make some fields optional @williballenthin #2631 #2632

capa/features/extractors/viv/insn.py

@@ -594,6 +594,18 @@ def extract_op_number_features(
     insn: envi.Opcode = ih.inner
     f: viv_utils.Function = fh.inner
 
+    if (
+        insn.mnem == "xor"
+        and insn.opers[0].isReg()
+        and insn.opers[1].isReg()
+        and insn.opers[0].reg == insn.opers[1].reg
+    ):
+        # for pattern like:
+        #
+        #     xor eax, eax
+        #
+        yield Number(0), ih.address
+
     # this is for both x32 and x64
     if not isinstance(oper, (envi.archs.i386.disasm.i386ImmOper, envi.archs.i386.disasm.i386ImmMemOper)):
         return

tests/fixtures.py

@@ -1021,6 +1021,7 @@ def parametrize(params, values, **kwargs):
         ("7351f.elf", "function=0x408753,bb=0x408781", capa.features.insn.API("open"), True),
         ("79abd...", "function=0x10002385,bb=0x10002385", capa.features.common.Characteristic("call $+5"), True),
         ("946a9...", "function=0x10001510,bb=0x100015c0", capa.features.common.Characteristic("call $+5"), True),
+        ("9324d...", "function=0x40806C,bb=0x40806C,insn=0x40806C", capa.features.insn.Number(0), True),
     ],
     # order tests by (file, item)
     # so that our LRU cache is most effective.