search

joernio / joern

Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
https://joern.io/
Apache License 2.0
1.95k stars 264 forks source link

Inter-procedural dataflow using joern #2425

Open debesheedas opened 1 year ago

debesheedas commented 1 year ago

I am looking to produce an inter-procedural data-flow graph (not a data-dependence graph) for java source code using joern but could not find any clear documentation on how to do the same. To what extent does joern support inter-procedural analysis? This says that the inter-procedural analysis with joern is limited, but I am unable to understand the exact details of where it works and where it doesn't? Does it have fully functional alias analysis as well? Any explanation of the approach used to support this would be greatly appreciated! Thank you!

for-just-we commented 1 year ago

Have you succeed in generating inter-procedural graph? I also don't find any code producing inter-procedural graph. The dumped dot are all for each function

debesheedas commented 1 year ago

@for-just-we You could check out this repository: COMEX It generates inter-procedural control-flow and data-flow for Java and C# in dot and json formats.

for-just-we commented 1 year ago

@for-just-we You could check out this repository: COMEX It generates inter-procedural control-flow and data-flow for Java and C# in dot and json formats.

Thank you, but currently I focus on C/C++. By the way, how is COMEX's ability in analyzing indirect function call or cross-file inter-procedural analyze.

ramsey-coding commented 3 months ago

@for-just-we @debesheedas do you get data-flow using COMEX?

ramsey-coding commented 3 months ago

@xavierpinho @tuxology @max-leuthaeuser can you please help with Joern query?