Code as Graph

AST (Abstract Syntax Trees)

: 프로그램 코드의 syntactic structure를 그래프로 표현함
: 고수준의 소스코드를 기계코드로 변환시켜줌

• [Java] javaparser
  • Java 1-15 Parser and Abstract Syntax Tree for Java, including preview features to Java 13
• [Java] PropertyGraph
  • A library to generate AST, CFG, PDG for Java program
    • JDK version 8+

  • git clone https://github.com/Zanbrachrissik/PropertyGraph
    java -jar PropertyGraph/out/artifacts/PropertyGraph_jar/PropertyGraph.jar -d src -a

CFGs (Control Flow Graphs)

: 코드가 실행되면서 분기되는 것을 그래프로 표현함

• [Java] PropertyGraph
  • A library to generate AST, CFG, PDG for Java program
    • JDK version 8+

  • git clone https://github.com/Zanbrachrissik/PropertyGraph
    java -jar PropertyGraph/out/artifacts/PropertyGraph_jar/PropertyGraph.jar -d src -c

• [Java] bytecode-to-cfg
  • Generation of a Control Flow Graph from a java bytecode using ASM
• [Java] kfg
  • Library for building CFG for Java bytecode
• [Smali] Smali-CFGs
  • Smali Control Flow Graph's

CPG (Code Property Graph)

:

• [C/C++/Java/Binary/Javascript/Python/Kotlin] joern
  • Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs
• [Java] plume
  • Plume is a code property graph analysis library with options to extract the CPG from Java bytecode and store the result in various graph databases.

DDG (Data Dependence Graph)

:

PDG (Program Dependence Graph)

: data 및 control 의존성을 명시적으로 그래프로 표현함

• [Java] accrue-bytecode
  • Interprocedural Java byte code analysis framework together with several analyses. Notably includes a multi-threaded points-to analysis (flow-sensitive and flow-insensitive) and a PDG construction analysis.
• [Java] PropertyGraph
  • A library to generate AST, CFG, PDG for Java program
    • JDK version 8+

  • git clone https://github.com/Zanbrachrissik/PropertyGraph
    java -jar PropertyGraph/out/artifacts/PropertyGraph_jar/PropertyGraph.jar -d src -p

• [Java] sourcedg
  • System Dependence Graph generation from Java source code
• [Java] TinyPDG
  • A library for building intraprocedural PDGs for Java programs