Joern - the tool

For your convenience, you can now dump a syntax-highlighted version of the ghidra decompiler output directly on the joern shell. (joern-1.1.313) - github.com/joernio/joern

Today we release a new default C/C++ frontend. The frontend is based on Eclipse CDT, handles modern C++ and the preprocessor and does NOT require a working build environment. Enjoy! github.com/joernio/joern/…

Bringing you some ridiculously effective micro-optimizations for calculation of the data dependence graph: github.com/joernio/joern/… - about 2x :)

Psst. Joern 1.1.221 ships with a beta version of a new C/C++ frontend based on Eclipse CDT - out of the box handling of the preprocessor (including macro expansions), improved handling of templates and lambdas, more type information. Try out `importCode.newc("/path/to/code")`

@richinseattle @h0mbre_ For not open source, try @joernio . I've had a good amount of success with this so far.

Happy to present a first draft of the Code Property Graph Specification 1.1: cpg.joern.io

Updated my posts about @joernio to work with the newer API and with the the super cool inter-procedural data-flow analysis support. jaiverma.github.io/blog/joern-int… jaiverma.github.io/blog/joern-ubo…

Joern will be presented at BlackHat Arsenal this summer: #joern-an-open-source-code-querying-engine-for-cc-24115" target="_blank" rel="nofollow noopener">blackhat.com/us-21/arsenal/…

We automatically identified a buffer overflow in VLC's updater (again) using `joern-scan`. Fixed in most recent release. Here is the write-up: joern.io/blog/vlc-autom…

And we forgot to click on "Set this link to never expire".. Please use this (permanent) link if you haven't joined us yet! discord.gg/vv4MH284Hc

Join us on discord: discord.gg/zeHXQksy

Interesting post from @Forescout on how to find bugs (RCE/DoS) in DNS implementations forescout.com/company/blog/f… - and they share their joern queries github.com/Forescout/name…

At this year's @NorthSec_io, @tuxology and @vickieli7 will be giving a workshop on building DIY static code analyzers with joern! nsec.io/session/2021-d…

You can now use the Joern code querying engine for LLVM Bitcode! blog.llvm.org/posts/2021-02-… - Many thanks to @1101_debian of ShiftLeft for this contribution!

Joern now supports querying Java bytecode! Many thanks to @SDBakerEffendi who has kindly integrated his Plume code property graph generator with the platform. Read his post here: joern.io/blog/plume-bri…

Find realloc-related memory leaks: cpg.call("realloc").filter(call => call.inAssignment.target.code.exists(_ == call.argument(1).code)).dump

@joernchen =)

@joernio 👀

If you're looking for an adrenaline rush, you can now `curl -L github.com/ShiftLeftSecur… | bash`. Use `sudo` for greater impact and `--reinstall` for `rm -rf` action #YOLO

@fabsx00 Awesome! And an impressive proportion of the bugs too with 67% versus 33% by fuzzing.

Great to see the Joern code querying engine (github.com/ShiftLeftSecur…) as the static bug hunting tool of choice for uncovering the Amnesia:33 TCP/IP stack vulns! forescout.com/company/resour…