Querying Program Analysis

An LLVM-based static analysis framework that maps control flow and audits security paths in LodePNG, answering queries instantly from the command line.

Querying Program Analysis is a research project for Wei Le’s Program Analysis course at Iowa State, built with Lucas Sorge and Michael Linker. It is a custom static analysis framework for auditing and mapping complex execution paths in safety-critical software, targeting the LodePNG image library. The goal was to make compiler-level insight accessible and queryable: ask a question about the code and get an answer without re-analyzing the codebase.

Problem

Modern security depends on understanding complex execution paths, but static analysis output is often too inaccessible to quickly check critical, safety-conscious libraries. Security researchers, software auditors, and developers optimizing performance need to see how a low-level change ripples through callers and control flow, and the tool had to fit into existing LLVM toolchains.

Process

A multi-stage pipeline turns source code into human-readable intermediate representation and stores it in a JSON database. The system compiles C++ to LLVM bitcode with Clang++, links dependencies, and disassembles them into .ll files. A Python parser extracts call graphs and control flow graphs and caches them as JSON, so queries run near-instantly without re-processing the entire codebase. Because it operates on IR, the engine stays language-agnostic across anything LLVM supports.

Solution

Clang++ front end and LLVM linker producing bitcode and disassembled IR for LodePNG.
Python CFG generator that extracts call graphs and per-function control flow graphs, cached as JSON.
Query engine for callers, function dependencies, cfg-summary metrics, and dead-code paths.
A minimalist command-line interface with structured output; the JSON backend leaves room for web-based UIs.

Results

89.7% Line coverage on LodePNG’s core decompression logic
4 Query types: callers, dependencies, CFG summary, dead code
JSON Cached graphs, so no re-processing per query
3 Researchers on the team

Justin Moran · Software Engineer · Chicago, IL · LinkedIn · GitHub · Resume (PDF)