Joern vs Ocular
You can think of Joern as Ocular Community Edition. Where it lacks in comparison to Ocular is (a) it supports only C/C++ via a fuzzy parser, (b) it does NOT have access to our commercial data flow engine, (c) all automated scanning and code annoation features are inavailable.
Language Support
By typing importCode
on the shell, you can see the available language modules.
As you can see, only the C/C++ module is available. Ocular on the other hand supports several other programming languages.
Data Flow Engine
In Joern, we only calculate intra-procedural reaching definition edges to create a Program Dependence Graph per function, as proposed in the original paper. Ocular in contrast features an interprocedural commercial on-demand data-flow engine.
Automated Scanning for Vulnerabilities
Ocular provides access to the ShiftLeft query language to enable automated scanning for vulnerabilities. Morever, it includes a large database of readily-available queries and passes that identify vulnerabilities across multiple languages and popular frameworks.
This becomes apparent when you type run
on the shell:
Only the ossdataflow
module is available, however, passes for automated vulnerability discovery are not available.