Skip to content
PROGRAM SEMANTICS & SECURITYSSA IR · SYNTAXFLOW

Understand the program.
Trace the risk.

Explore the structure and behavior of programs through compiler-level static single assignment. With SyntaxFlow, express security analysis as searchable, readable knowledge.

Explore the rule catalogRead the guide
if (flag)truex₁ = 1false / elsex₂ = 2x₃ = φ(x₁, x₂)return x₃ → 1
FIG. 01 · PHI

From the true branch, Phi selects x₁ = 1.

STATIC ANALYSIS THROUGH PROGRAM SEMANTICSJava · Go · PHP · JavaScript · …
I. THE RULE CATALOG

The SyntaxFlow rule catalog

An evolving collection of program analysis rules. Search the catalog, read the source, and inspect the underlying logic.

Write your first rule
Total rules—SYNTAXFLOW RULES
Language categories—MULTI-LANGUAGE
Library rules—REUSABLE LOGIC
Catalog versionLoadingFROM THE YAK ENGINE CATALOG
SyntaxFlowRule explorer
JSON

Loading the rule catalog

Fetching the latest catalog from the Yak engine…

Data from the official rule catalog
1 / 1
II. FOUNDATIONS

From syntax to semantics.

The depth of an analysis begins with an understanding of the program.

01

A common representation

Compile programs into SSA IR. Understand assignments, branches, and loops through a common semantic structure.

Static single assignment
02

Traceable data flow

Connect data flow and control flow across files and procedures. Study how inputs shape program behavior along the paths of values.

Interprocedural analysis
03

Readable analysis rules

Express queries, filters, and path constraints in SyntaxFlow. Turn an audit idea into a readable, executable, reusable rule.

SyntaxFlow rules
AN EXAMPLE IN SYNTAXFLOW

An analysis you can read.

Locate a call, trace its inputs, and inspect the upstream sources. A concise query connects semantics scattered throughout the code.

Understanding data flow queries
Example 1 · Tracing a call argument upstream
// Locate a call and trace its inputs
Runtime.getRuntime().exec(* #-> * as $source)

alert $source
CALL → ARGUMENT → DATA SOURCE
III. READING & REFERENCE

Practice, informed
by theory.

From using a tool to understanding its language and engine. A path from practical queries to the principles behind them.

[01]
GETTING STARTED

Scanning essentials

Installation, compilation, and queries. Begin with your first scan.

[02]
LANGUAGE REFERENCE

The SyntaxFlow language

Query syntax, data flow operators, and native calls.

[03]
THEORY & PRACTICE

Foundations of static analysis

SSA, control flow, closures, and object-oriented analysis.

[04]
OFFLINE HANDBOOK

The SyntaxFlow handbook

The complete handbook, available as an offline PDF.

IV. TOOLS FOR PRACTICE

An instrument for exploration.

IRify brings code scanning and rule analysis into a graphical workspace.

Fetching latest release…

macOS

Apple Silicon

macOS

Intel

Windows

x64

Linux

x64 · AppImage

Linux

ARM64 · AppImage

Need a legacy build?
Windows 7 · x64Linux · x64Linux · ARM64macOS · IntelmacOS · Apple Silicon
Installation guide

SyntaxFlow is currently for technical exchange. Contact Yak Project for commercial IRify use and authorized development.