include reference to function that contains a given bb in json doc

[mr-tz]

For basic block matches, we could tweak the output to include the function in which the BB is foun.d

$ capa -t "anti-VM i" ./tests/data/testbed/PMA/Chapter_17L/Lab17-03.exe_ -vv
execute anti-VM instructions
namespace  anti-analysis/anti-vm/vm-detection
author     moritz.raabe@fireeye.com
scope      basic block
att&ck     Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc        Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing
examples   Practical Malware Analysis Lab 17-03.exe_:0x401A80
basic block @ 0x401A80  <---------- add reference to function here.
  or:
    mnemonic: in @ 0x401AC8

[williballenthin]

interesting point - when we have a BB match, should we report the address of the BB or the function? currently, we report the address of the BB.

the BB address is more specific, and better corresponds to how capa is doing the matching.
the function address is more likely what a human will inspect and/or correlate with another tool.

if nothing else, we should probably update the json document to include both.

[mr-tz]

Nevermind, the output is correct (I thought BB address and offset are wrong). Including the function association in the JSON and potentially the output here makes sense to me though!

[williballenthin]

not sure if we can hit this by 1.0/thursday, but its a non-breaking change to the JSON doc, so we can do this as we have time.

[williballenthin]

this isn't super trivial, because we need to find a way to thread the association between bb and func all around. could maybe stuff it into the Match instance. probably would do that here: https://github.com/fireeye/capa/blob/b0092a784bb3e7ad07d9750f2593bded2e7bc088/capa/main.py#L67-L70

res.function = oint(f)
res.basic_block = oint(bb)