exclude/tag strings that match expert patterns

[mr-tz]

For collecting community knowledge it should be easy to add raw entries by just adding to a file for example:

string; explanation; tags
...
too many length or distance symbols; GZIP text exception; gzip
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@; mangled name; cpp

maybe use tab \t as separator so text can contain all symbols

[mr-tz]

Would also be cool to capture and explain multi-line strings, like:

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

[williballenthin]

should enumerate all the Windows API functions (and DLLs) so that they can be reasoned about (e.g., API not part of the import table).

[williballenthin]

i blindly pull all strings referenced by capa rules into an "expert" database which results in this output:

seems like a pretty good starting point!