smda: extracting negative Number features

[mike-hunhoff]

The smda backend appears to be extracting negative numbers e.g. -1 versus 0xFFFFFFFF as expected. This is causing rule matches to fail.

Sample feature extraction:

$ python scripts\show-features.py tests\data\493167e85e45363d09495d0841c30648.sys_ --function 0x404b00

smda:

...
insn: 0x00404bb6: number(0x-1)
insn: 0x00404bb6: number/x32(0x-1)
insn: 0x00404bb6: mnemonic(push)
...

viv:

...
insn: 0x00404bb6: number(0xFFFFFFFF)
insn: 0x00404bb6: number/x32(0xFFFFFFFF)
insn: 0x00404bb6: mnemonic(push)
...

[mr-tz]

Good catch.

ida:

insn: 0x00404bb6: number(0xFFFFFFFF)
insn: 0x00404bb6: number/x32(0xFFFFFFFF)
insn: 0x00404bb6: mnemonic(push)

Note that capa treats all numbers as unsigned values. A negative number is not a valid feature value. To match a negative number you may specify its two's complement representation. For example, 0xFFFFFFF0 (-2) in a 32-bit file.
https://github.com/fireeye/capa-rules/blob/master/doc/format.md#number

We need to add test fixtures that account for this.