Generating a CPG for a codebase and exporting in .dot format

[jsdelfino]

How do I export a CPG for a codebase and export it in .dot format using Chen?

I am able to do generate a CPG using Joern with the following commands:

# Codebase in ./app, generates ./graph/export/export.dot 
podman run --rm -it -v $(pwd)/app:/app -v $(pwd)/graph:/graph:rw ghcr.io/joernio/joern:nightly joern-parse -o /graph/cpg.bin /app                                                                                                                                                                              
podman run --rm -it -v $(pwd)/app:/app -v $(pwd)/graph:/graph:rw ghcr.io/joernio/joern:nightly joern-export --repr all --format dot --out /graph/export /graph/cpg.bin

Is there an equivalent with Chen, ideally a simple Python API to do something similar?

Additional info:
I'm open to other formats than .dot as long as they're supported by the NetworkX python package.
I don't necessarily need the whole codebase, backward/forward CPG slices around a specific point in the codebase will work for me as well.

Thanks!

[prabhu]

@jsdelfino atom is the cli tool you need for this. I would recommend graphml format.

https://github.com/AppThreat/atom?tab=readme-ov-file#export-atom-to-graphml-or-dot-format

[jsdelfino]

Ok, I'm now able to generate graphml files using Atom. Atom generates multiple graphml files where Joern was generating a single file so I'm going to adjust my code to process the multiple files. I will be opening issues in the Atom repo if I run into more questions or problems.

One more high level question here though: What is the relationship between Atom and Chen?

I initially assumed Chen, as a fork of Joern, handled CPG parsing and generation, especially since commands like calltree, distance, and reachables exist in Chennai. The doc’s mention of NetworkX reinforced this. So, I was surprised to learn I needed Atom instead.

Also, the dependency is unclear. Does Atom depend on Chen, or vice versa? Initially, I thought Atom relied on Chen, but Chen’s docs mention installing Atom, and Chennai has an importAtom command, suggesting the opposite. Since Atom defines its own format, does Chen depend on Atom instead?

Could you help clarify the relationship? Thanks!