Fix: Updated capa2yara.py for issue #1909

[Dronesh77]

Description of Changes 🍉

This pull request addresses issue #1909 by enhancing the capa2yara.py script to improve the handling of regular expressions during the conversion process. The changes include:

Unescaping Regex Patterns:

• Added a new function get_unescaped_regex(regex) to properly unescape backslashes and other special characters in regex patterns. This ensures compatibility with YARA's regex engine.

• The function removes unnecessary escaping for characters like (, ), [, and ], which do not require escaping in YARA.

Regex Conversion Enhancements:

• Modified the convert_rule function to use the new get_unescaped_regex function for handling regex types.

• Adjusted the conversion logic to correctly translate capa's regex syntax to YARA's, including handling case-insensitive flags (/i) and modifying .* to {,1000} to prevent performance warnings.

Motivation and Context

The changes were necessary to improve the accuracy and efficiency of converting capa rules to YARA rules. This update ensures better compatibility and performance, aligning with the project's goals of maintaining high-quality tools for reverse engineering and malware analysis.

Related Issue

Closes #1909

How Has This Been Tested?

The updated script has been tested in multiple environments to verify functionality.

Existing Test Cases Passed:

All existing test cases have been run successfully without any regressions.

Checklist

• [x] 'CHANGELOG.md' updated by adding Enhancements in capa2yara.py

• [x] No new tests needed.

• [x] No documentation update needed.

Feel free to review the changes and provide feedback. Thank you! 🍉

[google-cla[bot]]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.