mirror of
https://github.com/github/codeql.git
synced 2026-05-19 05:37:10 +02:00
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
/**
|
|
* @name Detects a modified FNV function
|
|
* @description Possible indication of Solorigate. Detects a modified FNV1 function, where there is an additional xor using a literal after the regular FNV hash
|
|
* @kind problem
|
|
* @tags security
|
|
* solorigate
|
|
* @precision high
|
|
* @id cs/solorigate/modified-fnv-function-detection
|
|
* @problem.severity error
|
|
*/
|
|
|
|
import csharp
|
|
import Solorigate
|
|
import experimental.code.csharp.Cryptography.NonCryptographicHashes
|
|
|
|
from Variable v, Literal l, LoopStmt loop, Expr additional_xor
|
|
where
|
|
maybeUsedInFnvFunction(v, _, _, loop) and
|
|
(
|
|
exists(BitwiseXorExpr xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
|
|
loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
|
|
xor2.getAnOperand() = v.getAnAccess()
|
|
)
|
|
or
|
|
exists(AssignXorExpr xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
|
|
loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
|
|
xor2.getAnOperand() = v.getAnAccess()
|
|
)
|
|
)
|
|
select l, "This literal is used in an $@ after an FNV-like hash calculation with variable $@.",
|
|
additional_xor, "additional xor", v, v.toString()
|