features: emit number(0) for xor-zeroing idioms like xor eax, eax

[devs6186]

Summary

Fixes #2622.

XOR instructions where both operands are the same register (e.g. xor eax, eax, xorpd xmm0, xmm0, pxor mm0, mm0, ARM eor r0, r0, r0) zero the destination register. This is an extremely common MSVC/compiler pattern before API calls that pass zero-valued arguments.

Previously the nzxor extractors silently returned early for these instructions, so no feature was emitted at all. Rules relying on number: 0 to detect zeroed arguments passed to APIs had no way to match when the zeroing came from a xor-idiom.

Changes:

• capa/features/extractors/viv/insn.py — extract_insn_nzxor_characteristic_features: emit Number(0) when insn.opers[0] == insn.opers[1] instead of returning silently.
• capa/features/extractors/binexport2/arch/intel/insn.py — same pattern: emit Number(0) when operands[0] == operands[1].
• capa/features/extractors/binexport2/arch/arm/insn.py — ARM eor rd, rn, rn zero idiom: emit Number(0) when operands[1] == operands[2].

In all three cases the instruction still does not emit nzxor (it is a zeroing operation, not a non-zeroing XOR), preserving existing behavior.

Test coverage:

Two new entries in tests/fixtures.py cover the mimikatz sample at instruction 0x401066 (xor ebx, ebx):

• Number(0x0) is present at that instruction — True
• Characteristic("nzxor") is not present at that instruction — False

These run against the vivisect backend directly (via FEATURE_PRESENCE_TESTS) and also via test_binexport_features_pe_x86 against the mimikatz Ghidra BinExport2 file.

Test plan

• isort, black, ruff all pass on changed files
• pytest tests/test_rules.py tests/test_match.py tests/test_engine.py tests/test_optimizer.py — 84 passed
• New fixture entries for Number(0) at xor-zero instruction and nzxor=False at same instruction

[gemini-code-assist]

Code Review

This pull request implements the emission of Number(0) for xor-zeroing idioms across Vivisect and BinExport2 backends for ARM and Intel architectures, and adds relevant test cases. A review comment points out that the CHANGELOG.md incorrectly includes entries for issues #2109 and #2126, which are not addressed in this PR.

[gemini-code-assist]

These changelog entries refer to issues #2109 and #2126, which do not appear to be addressed in the current pull request. Please remove them if they were included by mistake, or clarify if they are intended to be part of this change set.

[devs6186]

@mike-hunhoff @williballenthin

I picked this PR first because #2622 was still open and the earlier attempt was closed as stale. I kept this update focused: removed unrelated changelog lines, kept only the xor-zero -> number(0) behavior, and added small backend tests so the change is easy to verify.

[williballenthin]

the tests cases are so low quality i am worried about the overall quality of this PR. @devs6186 please be more careful in the future

[williballenthin]

this is complete slop. nowhere do we use monkey patches like this in our test suite.

please spend some time thinking about how to compose some meaningful tests that demonstrate the intended behavior

[devs6186]

the tests cases are so low quality i am worried about the overall quality of this PR. @devs6186 please be more careful in the future

hey thank you for the feedback, let me have another go and come back to you with some concrete. thank you for pointing out low quality contribution.

[devs6186]

hi @williballenthin
Thanks for the detailed review — you were right that this was weak. Let me walk through what changed.

All six backends now handled.

The original PR only touched three. IDA and Ghidra both had helpers (is_operand_equal, is_zxor) that
short-circuited before any feature was emitted — I just needed to yield Number(0) before those early
returns. Binary Ninja was trickier: BN's LLIL lifter canonicalizes xor reg, reg as LLIL_SET_REG(reg,
LLIL_CONST(0)) instead of preserving it as LLIL_XOR, so the existing walker never fires for zeroing
idioms. Fixed by checking the mnemonic and the lifted shape before the walker runs.

The monkeypatch test file is gone.

test_nzxor_zeroing.py used types.SimpleNamespace and monkeypatch.setattr to fake instruction objects.
That's not how capa tests work — it would have been testing the mock, not the extractor. Deleted
entirely.

Fixture entries use microsocks instead of mimikatz.

Found xor ebp, ebp at 0x2002564 in microsocks.elf_ (31KB, already in test data). Verified against the
vivisect extractor directly — Number(0) comes back True, nzxor comes back False. Two new entries in
FIXTURE_PRESENCE_TESTS, same pattern as everything else in that table, no separate test file needed.

CHANGELOG cleaned up.

Removed the stray #2109 and #2126 entries that had leaked in from other branches. Single entry now,
correctly scoped to #2622.

Let me know if anything still looks off.