add dynamic analysis

[williballenthin]

This is a draft PR so that we can begin to review the whole set of changes that @yelhamer proposes to enable dynamic analysis in capa. I'm not sure if we'll merge from this PR or re-create one later that we keep a bit tidier.

For the time being, when a change needs a review, lets continue to open PRs against the branch dynamic-feature-extraction, not update this PR. Its ok to merge small "suggested changes" from here when little discussion is required.

TODO:

• merge dynamic freeze update freeze for dynamic #1822
• merge rule updates upgrade rules using updated script capa-rules#839
  • Dynamic rules: handle operand[].number #1833
  • CAPE traced APIs vs. rule APIs #1843 -> to be addressed later
• merge capabilities module add a capabilities module #1820
• document the dynamic analysis workflow, limitations, rule format, output interpretation update rule format documentation with dynamic details capa-rules#851 add documentation for dynamic capa capabilties #1837
• simplify changelog entries, add major sections for Ghidra and Dynamic
• collect extensions seen in traces capa.features.extractors.helpers::generate_symbols collect file extensions seen in CAPE sample imports #1823 Handle API versions sandboxes vs. rules #1815
• show process name in dynamic output dynamic vverbose rendering should use process name #1816
• don't load signatures for dynamic analysis -> converted to issue dynamic: don't load signatures for dynamic analysis #1875
• add suggestion to run on dynamic trace for packed and samples with limitations -> suggest to run on dynamic trace for packed samples capa-rules#852
• merge dynamic into master
  • merge dynamic rules into rules master upgrade rules using updated script capa-rules#839
  • merge dynamic testfiles into testfiles master add testfiles for dynamic analysis capa-testfiles#221
  • point rules submodule to master
  • point testfiles submodule to master
  • revert CI named branch events
  • merge dynamic into master

[williballenthin]

i read through all 3,600 lines of changes. i didn't see any major architectural issues - that's great!

i added small items, suggested changes, and TODOs (via checklist items) inline here. please check and resolve so that we can track outstanding work here. major efforts ive added to the original PR comment text.

there are a lot of small things to tweak, though, perhaps two dozen things of 30 mins each to think about and implement.

[williballenthin]

i read through all 3,600 lines of changes. i didn't see any major architectural issues - that's great!

i added small items, suggested changes, and TODOs (via checklist items) inline here. please check and resolve so that we can track outstanding work here. major efforts ive added to the original PR comment text.

there are a lot of small things to tweak, though, perhaps two dozen things of 30 mins each to think about and implement.

[williballenthin]

we should also see what the experience is like against a ransomware report with a million file read/writes.