Improve C++ legacy crypto algorithm query#22
Merged
GrosQuildu merged 3 commits intotrailofbits:mainfrom Oct 18, 2025
Merged
Conversation
Adds the name of the detected algorithm to help identify the substring that triggered the detection, and reduces false positives when detecting DES by using a regex to exclude common words like "description" and "nodes".
gsutherland-trailofbits
requested review from
GrosQuildu and
fegge
as code owners
|
|
The "DES" string is covered by the regex and should not be in the first list. This was a typo made during testing.
GrosQuildu
approved these changes
Oct 18, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As it stands the query outputs detections that look like this:
This PR alters the message to include the detected cipher name, to make it easier to identify which substring triggered the detection:
This makes things a bit less confusing and makes it easier to quickly triage false positives.
This PR also reduces false positive detections for the DES cipher by using a regex match to avoid common words like "description" and "nodes". The regex has been tested to ensure that fragments such as "descrypt", "3des", "tripledes", etc. are still properly detected.