DOCSEARCHbyAlgolia
Submit Docs

Joern

repository·master·Indexed 25 days ago

https://github.com/joernio/joern

A platform for analyzing source code, bytecode, and binary executables by generating Code Property Graphs (CPGs). It features a Scala-based domain-specific language for mining code via graph queries, primarily used for static program analysis and vulnerability discovery. Joern includes a Data Flow Engine for taint-tracking and multiple frontends for generating CPGs from languages and formats including C/C++ (c2cpg), ABAP (abap2cpg), Java (javasrc2cpg), JavaScript/TypeScript (jssrc2cpg), Jimple IR (jimple2cpg), and Ghidra (ghidra2cpg).

Tokens
19.7K
Snippets
43
Records
151
Agent score
86%

What's inside Joern

  2. Overview of abap2cpg Architecture

    master

    The abap2cpg frontend converts ABAP (SAP's Advanced Business Application Programming Language) source files into a Code Property Graph (CPG) for analysis using Joern or Ocular. It follows the standard Joern x2cpg pattern:

    1. A language-specific parser produces JSON output.
    2. A Scala frontend transforms that JSON into CPG nodes through a series of specialized passes.

  3. Understand how php2cpg converts PHP to CPG

    master

    The php2cpg tool converts PHP source files into Code Property Graphs (CPGs) using the following two-step process:

    1. AST Generation: It invokes php-parse --json-dump --with-recovery $file on each source file to generate an abstract syntax tree (AST) in JSON format.
    2. CPG Conversion: The resulting JSON ASTs are parsed and converted into Code Property Graphs.

  5. Understand Access Path Algebra in Joern

    master

    Joern models access paths as a 'free monoid' consisting of a list of strings and a special VariableAccess token (?).

    Key concepts:

    • Member Access: Appends a field name or a VariableAccess token to the path.
    • Context Paths (CP): Describes a set of reachable paths using a prefix and a set of exclusions.
    • Splitting: When a function call with access path AP is encountered while tracking a base symbol with context path CP, the tracking splits into:
      1. CP \ AP: Everything reachable through CP that is not reachable through AP (continues tracking around the call).
      2. CP ∩ AP: The intersection, which is translated and tracked into the function call.
    • Deref Operator: The * operator is treated as a standard access path token.

  6. Getting started with Bazel in Joern

    master

    The Bazel build is experimental and intended for development. Only a subset of the repository (e.g., certain frontends) is included. To check if a frontend is supported, look for a BUILD file in joern-cli/frontends/<frontend>/.

    Initial Setup

    1. Configure Cache: Set a local Bazel cache location and size in your ~/.bazelrc to improve performance:
      common --disk_cache ~/.cache/bazelBuildCache
common --experimental_disk_cache_gc_max_size=30G
    2. Project Isolation: It is recommended to clone the repository a second time specifically for Bazel work to avoid conflicts between sbt and Bazel configuration files (like .idea or .bsp).
    3. Importing: Use File -> Open in IntelliJ to load the project; otherwise, the option to import as a Bazel project may not appear.

    Common Commands

    • Format code: bazel run format
    • Check formatting: bazel run formatCheck
    • Build everything: bazel build //...
    • Run all tests: bazel test //...
    • Build and run a specific frontend: bazel run <frontendName> -- <args> Example: bazel run javasrc2cpg -- /tmp/someJavaCodebase -o /tmp/myJava.cpg
    bazel run javasrc2cpg -- /tmp/someJavaCodebase -o /tmp/myJava.cpg

  7. Quickstart: Import Java source code into Joern

    master

    Follow these steps to generate a CPG from your Java source directory and start querying it:

    1. Navigate to the joern root directory.
    2. Run sbt stage to prepare the project.
    3. Start the Joern shell by executing ./joern.sh.
    4. Use the importCode.javasrc command to import your Java source files by providing the path to the source directory.

  8. Run abap2cpg tests

    master

    You can run tests for the abap2cpg frontend using sbt. Note that some tests require the abapgen binary, while others can run as pure unit tests without it.

    • To run all tests (requires abapgen binary): Use sbt "abap2cpg/test".
    • To run only unit tests (does not require the binary): Use sbt "abap2cpg/testOnly *.AstCreatorTests".
    sbt "abap2cpg/test"                         # all tests (requires abapgen binary)
sbt "abap2cpg/testOnly *.AstCreatorTests"   # unit tests only, no binary needed

  10. Build c2cpg from source

    master

    To build the c2cpg parser, ensure you have Java 11 and the Scala build tool (sbt) installed. The build process is verified on Linux and should work on OS X and BSD. Additional build-time dependencies are handled automatically during the build.

    Run the following command to build the project:

    sbt stage

  11. Install Joern via shell script

    master

    To install Joern on Linux or macOS, download and run the joern-install.sh script. The script automatically detects your platform and downloads the appropriate distribution. If the installation fails, you can attempt an interactive installation.

    Requirements:

    • JDK 21 (recommended)
    • gcc and g++ (optional, for C/C++ system header auto-discovery)

    If the standard installation fails, use the --interactive flag.

    wget https://github.com/joernio/joern/releases/latest/download/joern-install.sh
chmod +x ./joern-install.sh
sudo ./joern-install.sh
joern

  12. Test Joern-Scan queries

    master

    Queries should include unit tests located in src/test/scala/io/joern/scanners. Tests use a Suite where you define the source code in the code property and assert the results against the CPG (Code Property Graph).

    To build and run all tests using sbt:

    sbt test

    To test newly developed queries by staging the CLI and running the scan tool:

    sbt joerncli/stage
./querydb-install.sh && ./joern-scan <src>