This repository contains CodeQL queries focused on identifying patterns and objects within the Linux kernel source code that could be relevant for heap exploitation scenarios.

Queries

InterestingObjects.ql

This query targets the identification of specific objects or data structures within the Linux kernel that could be useful for heap exploitation. Such as, "I need an object of this size, that's allocated with these flags" or "I need a dynamically sized object that's allocated with these flags" We'll be updating this query to make it more useful, like finding reachability and interesting properties of these objects.

Run query

codeql query run $query -d=$database --threads=$(nproc) -o output.bqrs

Export results

codeql bqrs decode output.bqrs --format=csv > interesting_objects.csv

Note: in the results directory you will find some results of a previous run.