{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://docs.joern.io/",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/joern-cli/frontends/ghidra2cpg/README.md",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/joern-cli/frontends/ghidra2cpg/src/main/scala/io/joern/ghidra2cpg/Ghidra2Cpg.scala#L135-L146",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/joern-cli/frontends/jimple2cpg/src/main/scala/io/joern/jimple2cpg/Jimple2Cpg.scala#L102-L104",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/joern-cli/build.sbt#L44-L57",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/project/Versions.scala#L20",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/joern-cli/src/main/scala/io/joern/joerncli/JoernExport.scala#L34-L50",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/CITATION.cff",
    "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/LICENSE",
    "https://github.com/joernio/joern/releases/tag/v4.0.660"
  ],
  "category": "native-analysis",
  "description_en": "Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. Frontends cover C/C++, Java, JavaScript, Python, Kotlin, PHP, Go, Ruby, Swift, C#, Rust and ABAP source, JVM bytecode and APK/DEX files through Soot, and binaries loaded through an embedded Ghidra, which the documentation lists as x86/x64 support. It adds a static taint-tracking engine, the joern-scan query database of vulnerability patterns, and export of AST, CFG, PDG or whole-graph views to DOT, GraphML, GraphSON or Neo4j CSV.",
  "description_zh": "静态代码分析平台，将源代码、JVM 字节码和可执行文件解析为代码属性图并存入图数据库，可在交互式 shell 或服务器模式下用基于 Scala 的查询语言检索。前端覆盖 C/C++、Java、JavaScript、Python、Kotlin、PHP、Go、Ruby、Swift、C#、Rust 和 ABAP 源码，借助 Soot 处理 JVM 字节码及 APK/DEX 文件，并通过内置的 Ghidra 加载二进制文件，文档将这部分列为 x86/x64 支持。它还提供静态污点追踪引擎、收录漏洞模式的 joern-scan 查询库，并可将 AST、CFG、PDG 或整图导出为 DOT、GraphML、GraphSON 或 Neo4j CSV。",
  "entry_url": "https://awesomerea.org/resources/joern/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/joern/",
  "evidence_url": "https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/README.md",
  "group": "tools",
  "id": "joern",
  "json_url": "https://awesomerea.org/resources/joern/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/joern/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/joern/index.md",
  "name": "Joern",
  "name_zh": "Joern 代码属性图分析平台",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Release at review: v4.0.660, published 2026-10-19; the README says releases are created automatically once a day, and the reviewed master commit is three commits ahead of that tag. Each release ships joern-cli zips for Linux, macOS and Windows on x86_64 and arm64 plus joern-install.sh, and the README also documents ghcr.io/joernio/joern Docker images, with an AlmaLinux 8 variant for CPUs without SSE4.2.",
    "The README requires JDK 21 and says other versions have not been properly tested; gcc and g++ are optional, for discovering C/C++ system headers. Source builds use sbt, with an experimental partial Bazel setup. Inputs are the user's own source trees, class, JAR, APK or DEX files, or executables.",
    "Binary support is the ghidra2cpg frontend, built on a bundled Ghidra 12.2 package. It has specific passes for MIPS and ARM/AArch64 and routes every other processor through its x86 pass; its README notes that varargs are not handled properly. The documentation's maturity table rates C/C++ and Java very high, JavaScript, Python and x86/x64 via Ghidra high, JVM bytecode, Kotlin, PHP, Go and Swift medium, and Ruby and C# medium-low; the Rust and ABAP frontends in the reviewed tree are not rated there.",
    "Apache-2.0; CITATION.cff still names version 2.0, released 2024-01-18. The project describes itself as a tool for vulnerability discovery and static program analysis research; query and taint results describe the generated graph, not observed runtime behavior."
  ],
  "requirements_zh": [
    "审阅时的版本为 v4.0.660，发布于 2026-10-19；README 称每天自动生成一次发布，所审阅的 master 提交比该标签多三个提交。每个版本都提供适用于 Linux、macOS 和 Windows（x86_64 与 arm64）的 joern-cli 压缩包及 joern-install.sh；README 还介绍了 ghcr.io/joernio/joern Docker 镜像，并为不支持 SSE4.2 的 CPU 提供 AlmaLinux 8 版本。",
    "README 要求 JDK 21，并称其他版本未经充分测试；gcc 和 g++ 为可选项，用于查找 C/C++ 系统头文件。从源码构建使用 sbt，另有实验性的部分 Bazel 构建配置。输入为使用者自己的源码目录、class、JAR、APK 或 DEX 文件，或可执行文件。",
    "二进制支持由 ghidra2cpg 前端提供，基于随附的 Ghidra 12.2 软件包。它为 MIPS 和 ARM/AArch64 设有专门的处理流程，其他处理器一律走 x86 流程；其 README 指出可变参数尚未正确处理。文档中的成熟度表将 C/C++ 和 Java 评为很高，JavaScript、Python 以及基于 Ghidra 的 x86/x64 评为高，JVM 字节码、Kotlin、PHP、Go 和 Swift 评为中等，Ruby 和 C# 评为中低；所审源码中的 Rust 和 ABAP 前端未在表中评级。",
    "采用 Apache-2.0 许可；CITATION.cff 仍写着 2024-01-18 发布的 2.0 版。项目自称用于漏洞挖掘和静态程序分析研究；查询与污点分析结果反映的是生成的代码图，而非实际运行行为。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/joernio/joern",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}