Various fixes

[845977]

Fixes #30, #31, #32, #33 and #34.

Summary

Fixes a set of related correctness bugs in operation matching, side-effect
tracking and the ROP chain search, and adds regression tests for each.

Fixes

• ld/st operations match wrong gadgets when --src/--dst is specified #30 / Various errors in operation.Operand #33 (memory operands) --op ld --src <reg> and --op st --dst <reg>
  matched register-to-register movs (and even immediate loads) instead of
  memory accesses. set_dst/set_src now preserve the op_mem type when a
  concrete register is bound to a [dst]/[src] placeholder, and the generic
  register-to-immediate substitution in is_equal is restricted to register
  operands, so a [src] no longer matches an immediate.
• Various errors in operation.Operand #33 (Operand fixes) set_dst now accepts immediates like set_src
  (--dst 0x10 produces an op_imm operand instead of being rejected), and a
  generic memory address is no longer resolved into an immediate, so
  mov rax, 0xcafe is not treated as a load.
• src not considered as side reg in gadgets like xchg dst, src #31 (xchg side effect) src is no longer excluded from the computed side
  effects, so xchg dst, src correctly reports src as clobbered.
• Wrong capstone mnemonics for mov #32 (Capstone mnemonics) The mov ROPLang uses the valid Capstone
  mnemonics cmovb/cmovae instead of the invalid cmovc/cmovnc.
• Remove explicitly written dst from clobbered registers #34 (explicit dst clears clobber) A register written by a ROP chain step is
  no longer considered clobbered by earlier steps: the search clears the
  destination register's clobber count during recursion and restores it on
  backtrack.

Tests

Adds regression tests covering all five issues in tests/test_operation.py and
tests/test_ropchain.py. Full suite passes locally (102 tests) and in CI on
Python 3.11, 3.12 and 3.13.

[ricardojrdez]

Review — LGTM

I reviewed the five fixes against issues #30-#34 and they are all correct. I added a commit with regression tests (test: add regression tests for #30-#34): they are discriminating (they fail on the previous code and pass with the fixes). Full suite: 102 passed (Python 3.13).

Per-issue verification:

• #31 (gadget.py) — dropping self.src from excluded makes xchg dst, src report src as a side effect. It does not affect mov/loads (there src is not written).
• #32 (mov.yaml) — confirmed with Capstone: it emits cmovae/cmovb, not cmovc/cmovnc. The flag logic is also correct (clc+cmovae and stc+cmovb always move).
• #33 (operation.py) — all three errors: op_mem is preserved in set_dst/set_src; set_dst accepts immediates; and the self.is_reg() guard prevents a generic [src] from being resolved into an immediate.
• #30 (operation.py) — as a consequence of #33, --op ld --src <reg> now matches mov <reg>, [reg] instead of the register-to-register move.
• #34 (ropchain.py) — writing dst explicitly clears its clobber in side_effected and restores it on backtrack (symmetric and correct).

Non-blocking note — st operations (mov [dst], src):
In a store, gad.dst is the address base register ([rax] -> rax), which is not written but consumed as an address. The #34 block treats it the same as a register dst and resets its clobber count, which could mask a previous gadget clobbering that address register. This is not a regression (a store's dst was never protected by the guard), but it would be better not to apply the refresh when dst is a memory base (e.g. distinguish the op_mem case, or rely on regs_write). This can be handled in a follow-up.

Approved.