CodeQL: Also a Powerful Binary Analysis Engine
summary
Reverse engineers CodeQL’s closed engine and adds binary support by building a new DB schema, an extractor pipeline using Ad Pro to emit TRAP files, and an autobuild.sh workflow that converts TRAP into CodeQL databases; implements a binary Q library that exposes exports, basic blocks, registers and SSA-friendly metadata; debugs the Java engine with jdb by attaching to the JVM and enabling hidden CLI flags; demoed live queries against generated DBs, produced correct results, and plans to open source the work.
AI-written summary · about
chapters (18)
- 0:00CodeQL and binary analysis intro
- 1:13Static analysis fundamentals
- 2:40Popular static analysis tools
- 3:22CodeQL architecture workflow
- 6:55Database generation structure
- 10:30CodeQL query language
- 13:27CodeQL advantages design
- 14:30Extending CodeQL for binaries
- 16:13Binary support design principles
- 17:20Binary file database schema
- 18:47Ghidra Pro as extractor
- 20:31Binary Q library capabilities
- 21:56Future improvements goals
- 23:00CodeQL debugger for binaries
- 24:52Execution model optimization
- 26:40Debugging CodeQL engine
- 28:08Live CodeQL debugger demo
- 31:24Summary open-source plans
related talks
57mVariant analysis
37mSecurity as Code: A DevSecOps Approach
22mSecurity as Code: A DevSecOps Approach
40mDynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
50mUsing language-theoretics and runtime visibility to align AppSec with DevOps
30mEnhancing CTI Processes with Code Search Technology
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
59mSecurity as Code: A DevSecOps Approach