substring/regex support for API

[mbevilacqua]

Summary

Allow substring or regex matching for API to allow for more generic rules.

Motivation

Want to key on something like this regardless of glibc version:

• api: .dynsym.fopen@@glibc_2.2.5

Describe alternatives you've considered

Could enumerate all glibc versions out there but rule would be expensive and high maintenance.

[williballenthin]

We could add regex/substring matching to API features, though I'd prefer to try to find another solution first, so that we don't get tempted to be lazy in the future with rule writing.

For example, I wonder if we could de-mangle the symbols to extract the function name from the ABI, e.g. emit both fopen and .dynsym.fopen@@glibc_2.2.5, similar to how we handle DLLs + exports in PE files. In fact, I believe this is what the existing TODO means: https://github.com/mandiant/capa/blob/bae1b2950542d34c7d8c88e16d016784a7638213/capa/features/extractors/elffile.py#L42

Do you think this could work?

[mbevilacqua]

Yes that would certainly work. Thanks.