A fast semantic search tool for C/C++ codebases that uses AST pattern matching to help security researchers find interesting functionality.
weggli is a fast semantic search tool for C and C++ codebases that uses Abstract Syntax Tree pattern matching to help security researchers identify interesting functionality and potential vulnerabilities. It provides a query language that resembles C/C++ code, making it easy to create patterns that search for specific code constructs across large codebases.
Security researchers, reverse engineers, and code auditors who need to analyze large C/C++ codebases for security issues, interesting functionality, or specific code patterns.
Developers choose weggli for its fast performance, minimal setup requirements, and intuitive query language that closely resembles actual C/C++ code, enabling efficient interactive exploration of codebases without requiring complete builds or dependencies.
weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Designed for interactive usage with query performance often faster than grep, enabling quick switching between code review and query creation, as highlighted in the philosophy.
Works out-of-the-box without requiring software builds or complete dependencies, making it easy to start analyzing codebases immediately, as stated in the key features.
Offers first-class support for modern C++ constructs like lambda expressions and range-based for loops, which many similar tools lack, as emphasized in the design decisions.
Query language closely resembles C/C++ code with features like wildcards, variables, and negative queries, simplifying pattern creation for security researchers, as shown in the usage examples.
The greedy matching approach increases false positives, requiring users to manually filter results, which is admitted in the philosophy as a simplification that can be time-consuming.
Only supports C and C++, so it's not suitable for multi-language projects or analysis of other programming languages, limiting its scope compared to more versatile tools.
Lacks a graphical interface or IDE integration, which might hinder usability for those preferring visual tools or seamless integration into development workflows.
weggli is an open-source alternative to the following products:
Coccinelle is a program matching and transformation tool for C code that is used for collateral evolution in software and finding bugs.
CodeQL is a semantic code analysis engine that allows security researchers to write queries to find vulnerabilities in source code.
Semgrep is a fast, open-source static analysis tool for finding bugs and enforcing code standards across multiple languages using pattern matching.
Joern is a platform for static analysis of source code, specifically designed for vulnerability discovery in C/C++ code through code property graphs.