AwesomeREA.org

Tool

Joern

Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. Frontends cover C/C++, Java, JavaScript, Python, Kotlin, PHP, Go, Ruby, Swift, C#, Rust and ABAP source, JVM bytecode and APK/DEX files through Soot, and binaries loaded through an embedded Ghidra, which the documentation lists as x86/x64 support. It adds a static taint-tracking engine, the joern-scan query database of vulnerability patterns, and export of AST, CFG, PDG or whole-graph views to DOT, GraphML, GraphSON or Neo4j CSV.

Requirements & limits

  • Release at review: v4.0.660, published 2026-10-19; the README says releases are created automatically once a day, and the reviewed master commit is three commits ahead of that tag. Each release ships joern-cli zips for Linux, macOS and Windows on x86_64 and arm64 plus joern-install.sh, and the README also documents ghcr.io/joernio/joern Docker images, with an AlmaLinux 8 variant for CPUs without SSE4.2.
  • The README requires JDK 21 and says other versions have not been properly tested; gcc and g++ are optional, for discovering C/C++ system headers. Source builds use sbt, with an experimental partial Bazel setup. Inputs are the user's own source trees, class, JAR, APK or DEX files, or executables.
  • Binary support is the ghidra2cpg frontend, built on a bundled Ghidra 12.2 package. It has specific passes for MIPS and ARM/AArch64 and routes every other processor through its x86 pass; its README notes that varargs are not handled properly. The documentation's maturity table rates C/C++ and Java very high, JavaScript, Python and x86/x64 via Ghidra high, JVM bytecode, Kotlin, PHP, Go and Swift medium, and Ruby and C# medium-low; the Rust and ABAP frontends in the reviewed tree are not rated there.
  • Apache-2.0; CITATION.cff still names version 2.0, released 2024-01-18. The project describes itself as a tool for vulnerability discovery and static program analysis research; query and taint results describe the generated graph, not observed runtime behavior. No REA connection is established, and nothing was built, installed or run for this review.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · joernio/joern · Revision 7f886b3
  2. https://docs.joern.io/
  3. joern-cli/frontends/ghidra2cpg/README.md GitHub · joernio/joern · Revision 7f886b3
  4. joern-cli/frontends/ghidra2cpg/src/main/scala/io/joern/ghidra2cpg/Ghidra2Cpg.scala#L135-L146 GitHub · joernio/joern · Revision 7f886b3
  5. joern-cli/frontends/jimple2cpg/src/main/scala/io/joern/jimple2cpg/Jimple2Cpg.scala#L102-L104 GitHub · joernio/joern · Revision 7f886b3
  6. joern-cli/build.sbt#L44-L57 GitHub · joernio/joern · Revision 7f886b3
  7. project/Versions.scala#L20 GitHub · joernio/joern · Revision 7f886b3
  8. joern-cli/src/main/scala/io/joern/joerncli/JoernExport.scala#L34-L50 GitHub · joernio/joern · Revision 7f886b3
  9. CITATION.cff GitHub · joernio/joern · Revision 7f886b3
  10. LICENSE GitHub · joernio/joern · Revision 7f886b3
  11. https://github.com/joernio/joern/releases/tag/v4.0.660

More in Native binaries

All 89 entries in Native binaries