{"id":161453,"date":"2026-07-15T08:29:22","date_gmt":"2026-07-15T08:29:22","guid":{"rendered":"https:\/\/hnsecurity.it\/?p=161453"},"modified":"2026-07-15T08:52:21","modified_gmt":"2026-07-15T08:52:21","slug":"my-semgrep-c-cpp-ruleset-is-ready-for-prime-time-again","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/my-semgrep-c-cpp-ruleset-is-ready-for-prime-time-again\/","title":{"rendered":"My Semgrep C\/C++ ruleset is ready for prime time again"},"content":{"rendered":"
\n

“Retention of critical thinking and problem solving skills in an AI saturated world <\/em>will probably become a superpower for those who can resist the autocomplete revolution.”
\n\u2014 Bas Alberts<\/em><\/p>\n

“I spend a truly unreasonable amount of my life writing YAML.”<\/em>
\n\u2014 William Woodruff<\/em><\/p><\/blockquote>\n

TL;DR<\/h3>\n

For those with an attention span shorter than a goldfish<\/a>, a quick summary of what’s going on here:<\/p>\n

    \n
  • Back in 2022, I published a collection of Semgrep rules<\/a> that I developed to facilitate C\/C++ vulnerability research<\/strong>. I also wrote a couple of accompanying blog posts to introduce my ruleset<\/a> and show how to use it to automate binary vulnerability discovery<\/a>.<\/li>\n
  • Over the years, my project has gained popularity<\/strong> and has been featured in prominent guides<\/a> and toolkits<\/a>. Meanwhile, I kept improving my ruleset<\/a> and applying it to real-world vulnerability research scenarios<\/a>.<\/li>\n
  • Today, it’s once again time to shed light on some recent updates and improvements<\/strong>, before our new robot overlords take over the field of vulnerability research<\/a> entirely.<\/li>\n<\/ul>\n

    So, bear with me while I introduce you to my newly-improved Semgrep C\/C++ ruleset<\/a>.\"\"<\/p>\n

    A blast from the past<\/h3>\n

    First, a quick review of my previous work.<\/p>\n

    As stated in the summary above, in 2022 I released<\/a> my custom Semgrep rules<\/a> for C\/C++ vulnerability research<\/strong> and published a well-received article<\/a> on how to become a better security researcher<\/strong>, using the power of Semgrep<\/a> to automate some menial tasks<\/strong> even against binary targets.<\/p>\n

    At the end of 2023, I published a big update<\/a> to my ruleset. It featured several new rules, a reorganization into three priority tiers, and general accuracy and performance tweaks. These improvements were driven by the experience gained in the field<\/strong> during my vulnerability<\/a> research<\/a> efforts<\/a> and by attending training courses on this subject (namely, OST2<\/a>\u2018s\u00a0Vulns1001<\/a>\u00a0and\u00a0Vulns1002,<\/a>\u00a0and\u00a0InfoSect<\/a>\u2018s Code Review). Finally, I extensively tested my rules against available SAST test suites\u00a0and\u00a0test cases, conveniently collected by NIST\u2019s Software Assurance Metrics And Tool Evaluation (SAMATE<\/a>) project.<\/p>\n

    Again, these updates sparked quite a bit of interest in the security community, which led me to implement similar functionality<\/a> in the form of weggli patterns<\/a>.<\/p>\n

    Besides presenting my toolkit, in my blog posts<\/a> I also focused on providing an actionable vulnerability research workflow<\/strong> that can be summarized as follows:<\/p>\n

      \n
    1. Read the\u00a0documentation<\/strong> (but don’t believe it!<\/a>) to uncover attack surface and interesting paths.<\/li>\n
    2. Scan with\u00a0static analysis<\/strong> tools against interesting paths in the codebase.<\/li>\n
    3. Review scan results to quickly\u00a0mark hotspots<\/strong>\u00a0in code where bugs may be.<\/li>\n
    4. Understand relevant code around the hotspots to identify\u00a0potential vulnerabilities<\/strong>.<\/li>\n
    5. Confirm vulnerabilities via\u00a0further analysis<\/strong>, dynamic testing, targeted fuzzing, etc.<\/li>\n
    6. Identify\u00a0variants<\/strong>\u00a0of confirmed vulnerabilities in other parts of the codebase.<\/li>\n<\/ol>\n

      Revisiting this workflow in 2026, you’ll probably want to weave AI into each step <\/strong>as a force multiplier. Don’t worry though, fuzzer jobs are (probably) safe for now.<\/p>\n

      \n

      Frankly, I'm appalled by the prospect of LLMs taking offensive security research jobs from honest, hard-working fuzzers<\/p>\n

      — lcamtuf (@lcamtuf) June 22, 2024<\/a><\/p><\/blockquote>\n