{"id":2613,"date":"2023-11-28T07:38:50","date_gmt":"2023-11-28T06:38:50","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=2613"},"modified":"2025-10-21T09:19:14","modified_gmt":"2025-10-21T09:19:14","slug":"big-update-to-my-semgrep-c-cpp-ruleset","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/big-update-to-my-semgrep-c-cpp-ruleset\/","title":{"rendered":"Big update to my Semgrep C\/C++ ruleset"},"content":{"rendered":"
\n

“The attack surface is the vulnerability. Finding a bug there is just a detail.”<\/em>
\n\u2014 Mark Dowd<\/em><\/p>\n

“Some details are more important than others.” <\/em>
\n— Fedor G. Pikus<\/em><\/p><\/blockquote>\n

Initial release<\/h3>\n

Last year I published a collection of Semgrep rules<\/a> that I developed to facilitate C\/C++ vulnerability research<\/strong>. I also wrote a couple of accompanying blog posts to introduce my ruleset<\/a> and to show how to use it to automate binary vulnerability discovery<\/a>.<\/p>\n

My research was well-received by the team behind Semgrep<\/a>:<\/p>\n

\n

Community member spotlight on…. Marco Ivaldi, aka @0xdea<\/a>!<\/p>\n

We retweeted a blog post he wrote earlier this week on pen testing binaries with Semgrep, but he's also written a wealth of C++ rules (35!) to catch vulnerabilities: https:\/\/t.co\/FUgVuuMzKV<\/a><\/p>\n

THANK YOU, @0xdea<\/a>!!#cpp<\/a><\/p>\n

— Semgrep (@semgrep) July 8, 2022<\/a><\/p><\/blockquote>\n