Addition of C/C++ Semgrep ruleset

[neutrinoguy]

Is your feature request related to a problem? Please describe.
Can we add below released semgrep rules to EMBA if the original author is okay with it ?

https://github.com/0xdea/semgrep-rules

Additional reference: Blog

Describe the solution you'd like
Addition of above rules in current EMBA semgrep repository.

Describe alternatives you've considered
NA

Priority issue
Are you already a [Sponsor]? - N

Additional context
NA

Thanks

[m-1-k-3]

Do you have a firmware where these rules will provide value?

[neutrinoguy]

Hello @m-1-k-3 ,

I don't have a firmware at this point in time. But the author of these rules has an excellent blog showing its application on closed source binaries.

https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/

Here he suggests to use an additional GHIDRA script to extract all pseudo code generated by decompiler and run this rules on them.

https://github.com/0xdea/ghidra-scripts/blob/main/Haruspex.java

I think this can apply to any given firmware and be used on possibly all first party binaries discovered in firmware during EMBA analysis.

Alternatively ghidra decompiler is already present in radare2 to help automate it maybe.

Your thoughts around this ?

Thanks

[m-1-k-3]

This looks very interesting and similar to our idea around module s19 where we already created some pseudo code with r2. Nevertheless, our testing with semgrep and gpt on this pseudo code was not that successful. Probably the code generated by Ghidra is better for further automated analysis. As we have Ghidra and semgrep already in place in our EMBA container we can directly start to poke around with it on how to get best results out of it. This will take some time as we are currently quite busy. If you can support in this area it would be really great.

[github-actions]

This issue is stale because it has been open for 28 days with no activity.

[neutrinoguy]

Great to see this has been implemented in EMBA now. Nice work @m-1-k-3

Can't wait to see what it discovers 🤩

[m-1-k-3]

Check it out and give me feedback