Better False-Positive Detection in rz_scan_strings #2691
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
borzacchiello
requested review from
ret2libc,
thestr4ng3r,
wargio,
XVilka and
kazarmy
as code owners
wargio
approved these changes
Jun 13, 2022
XVilka
requested changes
Jun 14, 2022
This commit adds the following features: - Extend the false-positive check on ASCII frequencies to all UTF strings - Add a global option to activate/deactivate di check - Improve the false-positive heuristic adding a special case for extended-ASCII strings
borzacchiello
force-pushed
the
strsearch_better_pruning
branch
from
ca4528e
to
42d5e4b
Compare
borzacchiello
force-pushed
the
strsearch_better_pruning
branch
from
d9bd714
to
a8e48b6
Compare
XVilka
approved these changes
Jun 14, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello everyone!
I tried to improve rz_scan_strings, with the main goal of making the false-positive check more robust, and fix #1836.
I also added a global option to activate/deactivate a check in the false-positive detection function. I am not sure that I added it in the correct way, so let me know.
Your checklist for this pull request
Detailed description
This PR adds the following features:
I had to modify some regression test because some of them checked the number of detected strings that is changed due to the PR.
The removed strings should be only false positives: this zip file contains a diff for each binary of the regression tests for which the number of strings found changed.
Test plan
...
Closing issues
closes #1836