Improve clipboard rules

[mr-tz]

closes #293

Lastly, we might consider consolidating the replace-clipboard-data and write-clipboard-data rules. The replace rule includes user32.EmptyClipboard but I wonder if user32.SetClipboardData would overwrite data existing data that wasn't emptied. The EmptyClipboard API could be optional in the write-clipboard-data rule.

[mwilliams31]

@mr-tz any merit to the following aspect of #293? I'm curious what your take on the suggestion is.

Both formats are represented in the existing rule examples. Using these formats, the rule could become a basic block component of a larger function rule. The new rule could also incorporate the loop characteristic to target the read operation.

[mr-tz]

The read clipboard rule includes, we could add a basic block scope to tie them closer together. And add match: contain loop.

        - and:
          - api: user32.GetClipboardData
          - optional:
            - number: 0x1 = CF_TEXT
            - number: 0x7 = CF_OEMTEXT
            - number: 0xD = CF_UNICODETEXT

For the write I think we're fine without the specific types.

How does that sound?

[mwilliams31]

Ahh, I didn't realize those formats were added in a previous commit. I'll defer to you on the basic block and loop modifications. Thanks for taking a closer look at these rules!

[mr-tz]

Thanks @mwilliams31, all updated per you suggestions.