Joern vs Ocular

You can think of Joern as Ocular Community Edition. Where it lacks in comparison to Ocular is (a) it supports only C/C++ via a fuzzy parser, (b) it does NOT have access to our commercial data flow engine, (c) all automated scanning and code annoation features are inavailable.

Language Support

By typing importCode on the shell, you can see the available language modules.

joern> importCode
=> ImportCode = Type `importCode.<language>` to run a
specific language frontend
______________________________________________________
| name | description | available|
|=====================================================|
| c | Fuzzy Parser for C/C++ | true |
| csharp | C# Source Frontend (Roslyn) | false |
| golang | Golang Source Frontend | false |
| java | Java/Dalvik Bytecode Frontend| false |
| javascript| Javascript Source Frontend | false |
| llvm | LLVM Bitcode Frontend | false |

As you can see, only the C/C++ module is available. Ocular on the other hand supports several other programming languages.

Data Flow Engine

In Joern, we only calculate intra-procedural reaching definition edges to create a Program Dependence Graph per function, as proposed in the original paper. Ocular in contrast features an interprocedural commercial on-demand data-flow engine.

Automated Scanning for Vulnerabilities

Ocular provides access to the ShiftLeft query language to enable automated scanning for vulnerabilities. Morever, it includes a large database of readily-available queries and passes that identify vulnerabilities across multiple languages and popular frameworks.

This becomes apparent when you type run on the shell:

joern> run
res49: OverlaysDynamic =
_____________________________________________________________________
| name | description |
|====================================================================|
| ossdataflow| Layer to support the OSS lightweight data flow tracker|
| commit | Apply current custom diffgraph |
| scpg | linked code property graph (OSS) |

Only the ossdataflow module is available, however, passes for automated vulnerability discovery are not available.