Once a vulnerability is found, its variants are rarely far behind, and finding them is tedious, repetitive work. CodeQL solved this for source code by making a codebase queryable. No equivalent existed for the binaries reverse engineers actually work on.

This post details the reverse engineering of CodeQL’s undocumented components, its extractors and proprietary formats, and their reimplementation for binaries in BinQL, a tool that makes CodeQL as effective on compiled code as on C/C++, whether to hunt variants, track a bug across versions, or shortlist exploit candidates.