How to get AST, CFG graph

[shiftleftsecurity]

How to get AST, CFG graph

[fabsx00]

Hi! Take a look at https://github.com/ShiftLeftSecurity/joern and follow the instructions there to get access to a code property graph for C/C++ programs. It contains a control flow graph and all statements are decomposed into their expressions to yield an AST-like structure.

[shangqing-liu]

Hi! Take a look at https://github.com/ShiftLeftSecurity/joern and follow the instructions there to get access to a code property graph for C/C++ programs. It contains a control flow graph and all statements are decomposed into their expressions to yield an AST-like structure.

thanks for the reply, but I have checked the documentation, it seems there is no interface about outputting ast or cfg on this https://ocular.shiftleft.io/api/io/shiftleft/queryprimitives/index.html. The documentation only provides some high level functions such as cfg.methods. If I want to get the raw ast or cfg graph with Joern, what can I do?

[jinho10]

@fabsx00 do you have an instruction to generate the java cpg?

[fabsx00]

@shangqing-liu the methods for traversing the CFG are called cfgPrev and cfgNext, and they follow incoming and outcoming CFG edges respectively. I think it might make sense if you tell us more about what you want to achieve. Do you want to have a CFG in some standard format like json? Do you want to plot the CFG?

[fabsx00]

@jinho10 currently, an open-source input module only exists for C/C++ but not for Java. Ocular at https://ocular.shiftleft.io/ has a commercial Java language frontend.