joern
joern copied to clipboard
how to custom Data-Flow Semantics?
i want to add a custom data-flow sematic in joern shell with following code:
val parser = new io.joern.dataflowengineoss.semanticsloader.FullNameSemanticsParser()
val flowtransfer = """"strncpy" 4 -> 4"""
val rule = parser.parse(flowtransfer)
val fullNameSemantics = semantics.asInstanceOf[io.joern.dataflowengineoss.semanticsloader.FullNameSemantics]
val sematics = fullNameSemantics.plus(rule)
fullNameSemantics.forMethod(cpg.method("strncpy").l(0))
val context = new LayerCreatorContext(cpg)
val options = new OssDataFlowOptions(4000,sematics)
new OssDataFlow(options).run(context)
but it dont process the dataflow process :
new OssDataFlow(options).run(context)
|
2025-04-10 21:08:27.949 WARN OssDataFlow: The overlay dataflowOss already exists - skipping creation
and the link for custom source code has been removed :https://docs.joern.io/dataflow-semantics/
I also try following constructions :
import io.joern.dataflowengineoss.semanticsloader.FlowSemantic
import io.shiftleft.semanticcpg.layers.LayerCreatorOptions
import io.joern.dataflowengineoss.layers.dataflows.*
import io.shiftleft.semanticcpg.layers.*
import io.joern.dataflowengineoss.*
import io.shiftleft.semanticcpg.Overlays
val extraFlows = List(
FlowSemantic.from(
"strncpy",
List((2, 1) )),
FlowSemantic.from(
"strncpy",
List((1, 2) )
))
Overlays.removeLastOverlayName(cpg)
val context = new LayerCreatorContext(cpg)
val options = new OssDataFlowOptions(semantics = DefaultSemantics().plus(extraFlows))
new OssDataFlow(options).run(context)
cpg.call("strncpy").argument.reachableByFlows(cpg.call("process_layer3").argument).p
target code is :
void process_layer3(char* input) {
char temp[BUFFER_SIZE];
char processed[BUFFER_SIZE];
strncpy(temp, input, BUFFER_SIZE);
transform_case(temp);
snprintf(processed, BUFFER_SIZE, "echo %s", temp);
pass_to_executor(processed);
}
I want to confirm the flow form char* input to the argument processed ,but the strncpy stop the flow.
I think that caused by the DefaultSemantics:
def cFlows: List[FlowSemantic] = List(
F("strncpy", List((1, 1), (2, 2), (3, 3), (1, -1), (2, -1))),
)
it lack the flow patten from 2 to 1.
I've discovered similar issues when writing custom data-flow semantics for strncat.