joern icon indicating copy to clipboard operation
joern copied to clipboard

how to custom Data-Flow Semantics?

Open HeouDonkey opened this issue 9 months ago • 2 comments

i want to add a custom data-flow sematic in joern shell with following code:

val parser = new io.joern.dataflowengineoss.semanticsloader.FullNameSemanticsParser()
val flowtransfer = """"strncpy" 4 -> 4"""
val rule = parser.parse(flowtransfer)
val fullNameSemantics = semantics.asInstanceOf[io.joern.dataflowengineoss.semanticsloader.FullNameSemantics]
val sematics = fullNameSemantics.plus(rule)
fullNameSemantics.forMethod(cpg.method("strncpy").l(0))
val context = new LayerCreatorContext(cpg)
val options = new OssDataFlowOptions(4000,sematics)
new OssDataFlow(options).run(context)

but it dont process the dataflow process :

new OssDataFlow(options).run(context)
     | 
2025-04-10 21:08:27.949 WARN OssDataFlow: The overlay dataflowOss already exists - skipping creation

and the link for custom source code has been removed :https://docs.joern.io/dataflow-semantics/

HeouDonkey avatar Apr 10 '25 13:04 HeouDonkey

I also try following constructions :

import io.joern.dataflowengineoss.semanticsloader.FlowSemantic
import io.shiftleft.semanticcpg.layers.LayerCreatorOptions
import io.joern.dataflowengineoss.layers.dataflows.*
import io.shiftleft.semanticcpg.layers.*
import io.joern.dataflowengineoss.*
import io.shiftleft.semanticcpg.Overlays

val extraFlows = List(
    FlowSemantic.from(
        "strncpy",
        List((2, 1) )),
    FlowSemantic.from(
        "strncpy",
        List((1, 2) )
))
Overlays.removeLastOverlayName(cpg)
val context = new LayerCreatorContext(cpg)
val options = new OssDataFlowOptions(semantics = DefaultSemantics().plus(extraFlows))
new OssDataFlow(options).run(context)

cpg.call("strncpy").argument.reachableByFlows(cpg.call("process_layer3").argument).p

target code is :

void process_layer3(char* input) {
    char temp[BUFFER_SIZE];
    char processed[BUFFER_SIZE];
    
    strncpy(temp, input, BUFFER_SIZE);
    transform_case(temp);
    
    snprintf(processed, BUFFER_SIZE, "echo %s", temp);
    pass_to_executor(processed);
}

I want to confirm the flow form char* input to the argument processed ,but the strncpy stop the flow. I think that caused by the DefaultSemantics:

def cFlows: List[FlowSemantic] = List(
    F("strncpy", List((1, 1), (2, 2), (3, 3), (1, -1), (2, -1))),
  )

it lack the flow patten from 2 to 1.

HeouDonkey avatar Apr 11 '25 08:04 HeouDonkey

I've discovered similar issues when writing custom data-flow semantics for strncat.

0roman avatar May 08 '25 11:05 0roman