support negative offset features

[williballenthin]

currently we have a lint that rejects rules that contain negative numbers, specifically constants and offsets. i think this is primarily because its can be difficult to determine how immediate operands should be interpreted as signed or unsigned values. therefore, this restriction makes sense for constants/numbers; however, the way that we extract offsets (from memory reference operands) does support negative values. so, should we relax the lint and only enforce it on numbers/constants, but not offsets?

related: mandiant/capa-rules#52

@mike-hunhoff @mr-tz

[williballenthin]

mandiant/capa-rules#52 (comment)

Short answer: no we do not officially support negative numbers

Because: By default both the viv and IDA APIs default to two's complement for representing numbers so capa can't match -1 because it only sees the two's complement form 0xFFFFFFFF.

However: It appears that the viv API does not default to two's complement for representing offsets which allows 0x-30 to match.

Unfortunately the IDA API does default to two's complement for representing offsets therefore, and I haven't tested this yet but I assume, this rule will match in viv but not in IDA.

I would probably consider this a bug as we need to establish a consistent representation of numbers, offsets, etc. across capa and the extractors.

Offsets in viv:

('Offset', -4)
('Offset', -20)
('Offset', -20)
('Offset', 0)
('Offset', -20)
('Offset', -4)
('Offset', 16)
('Offset', 0)
('Offset', 20)
('Offset', -4)

Offsets in IDA:

Python>insn = sark.code.instruction.Instruction(here())
Python>insn.operands[1].offset
0xfffffef8
Python>insn = sark.code.instruction.Instruction(here())
Python>insn.operands[1].offset
0x18

Originally posted by @mike-hunhoff in mandiant/capa-rules#52 (comment)

[williballenthin]

according to https://cse.unl.edu/~goddard/Courses/CSCE351/IntelArchitecture/IntelDataType.pdf

looks like we can assume offsets are guaranteed to be signed, so we could enforce that feature extractors auto-convert twos complement to signed values