dotnet: format(dotnet) does not match correctly

[mike-hunhoff]

format(dotnet) does not match at function/bb scope but matches at global scope. Additionally, capa metadata lists .NET file format as pe instead of dotnet.

Should we extract both pe and dotnet formats for .NET files? Otherwise, when analyzing .NET files we miss out on native capabilities bound by format(pe).

[mr-tz]

format should be a global feature so match at all scopes. Is this a bug currently?

I'd say it'd be fair to emit pe and dotnet for PEs.

The metadata discrepancy should be an easy fix.

[mr-tz]

related: #938

[mr-tz]

While looking at #1258 I noticed that we may want to improve capa.features.extractors.common.extract_format() or at least discuss and document our decision.

I think extract_format() would ideally also detect dotnet and we could simplify the code a bit (including parts of #1256).

Right now the dotnet detection depends on capa.features.extractors.dnfile_.DnfileFeatureExtractor.is_dotnet_file() and then some manual format setting subsequently.

[mr-tz]

We've refactored the code and addressed this.