ByteQL

ByteQL is a browser-based tool that allows users to query binary files using SQL, with support for formats like pcap, MIDI, and ZIP. The author states it runs entirely in the browser without uploading files to servers, leveraging technologies such as DuckDB-WASM, WebAssembly, and Kaitai Struct. It offers bidirectional byte provenance: queries can highlight source bytes, and selecting bytes highlights corresponding rows.

The description is self-reported and unverified — no revenue, customers, or traction data are provided. The author claims to have used GPT-5.6 Sol through Codex for development, including architecture planning, implementation, and UI/UX design. The tool supports local analysis workflows with privacy as a core architectural constraint.

The single most important open question is: What is the actual commercial viability of this tool? The author describes a niche use case (DFIR analysts, protocol engineers), but there is no evidence of market demand, adoption, or monetization strategy beyond the hackathon submission.

The description states that ByteQL turns binary files into relational tables queryable with DuckDB SQL. It supports formats like classic pcap, Standard MIDI Files, and structural ZIP analysis. Users can run SQL queries such as:

```

SELECT src_addr, count(*) AS packets

FROM ip

GROUP BY src_addr

ORDER BY packets DESC;

```

It includes features like:

• Format detection
• Streaming intake
• Table explorer
• Saved queries
• SQL editor
• Virtualized result grid
• Row inspector
• Diagnostics
• Canvas hex pane

The tool uses Apache Arrow IPC for data flow between components and supports bidirectional byte provenance — selecting a row highlights the bytes that produced it, and vice versa.

It is built using:

• Kaitai Struct for parsing
• DuckDB-WASM for querying
• Svelte for UI
• TypeScript
• WebAssembly (WASM)
• Browser-based storage via OPFS (Origin Private File System)

Not evidenced: actual product functionality beyond the author’s claims, user feedback, or performance benchmarks outside of the described tests.

The author positions ByteQL as:

• A tool for querying binary files using SQL
• Running entirely in the browser
• With strong privacy guarantees (no file upload)
• Supporting multiple binary formats through a modular "format pack" model

The evolution of claims shows:

1. Initial inspiration: Need for general-purpose binary file analysis without losing byte context.
2. Core thesis: “Ask the file a question in SQL, then prove the answer against its source bytes.”
3. Technical approach: Browser-only operation with WebAssembly and Arrow-based pipelines.
4. Validation slice: MIDI playback to validate the concept.
5. Future direction: Expansion into DFIR use cases and community-driven format packs.

Not evidenced: how this positions itself relative to existing tools like Wireshark or custom parsers, nor whether it competes with or complements them.

The author states that ByteQL targets:

• DFIR analysts
• Protocol engineers
• Consultants who cannot legally upload evidence to cloud services

It appears to be aimed at professionals working with binary data in environments where privacy and compliance are critical.

Not evidenced: customer segmentation beyond the stated use cases, actual user base, or market size estimates. No mention of pricing strategy or target accounts.

The description does not include any information about:

• Revenue streams
• Pricing models
• Monetization plans
• Customer acquisition strategies

Not evidenced: business model or commercial viability beyond the hackathon submission.

Key technical signals from the description:

• Uses DuckDB-WASM for querying
• Leverages WebAssembly and OPFS for local storage
• Implements streaming pipelines with Arrow IPC at every boundary
• Supports format packs that separate engine behavior from format knowledge
• Includes automated privacy checks (bundle audits, network request assertions)
• Uses GPT-5.6 Sol via Codex for development, including architecture planning and implementation

Inferences:

• The tool is designed to be lightweight and secure by design.
• It uses modern web technologies to avoid cloud dependencies.

Not evidenced: performance metrics beyond the 44.25 seconds for a 1 GB parse, or scalability limits in production use.

The author states:

• ByteQL is a deployed, runnable product
• Supports three format packs (pcap, MIDI, ZIP)
• Has same-format multi-file sessions and SQL editing capabilities
• Includes bidirectional hex provenance
• Achieved performance targets (e.g., 1.71% of original capture read for large queries)

However:

• No evidence of user adoption or retention
• No mention of customer feedback or usage statistics
• No indication of product maturity beyond the hackathon prototype

Not evidenced: traction, user engagement, or long-term viability.

The author mentions Wireshark as a relevant tool but notes its interaction model does not generalize to every binary format. Other tools likely exist for specific binary formats (e.g., MIDI editors, packet analyzers), but the description does not name them directly.

Not evidenced: competitive landscape analysis or comparison with existing tools in the DFIR or developer tooling space.

Risks and red flags identified:

1. Unproven commercial viability: No evidence of revenue, customers, or market traction.
2. Niche target audience: DFIR professionals may be a small, specialized group.
3. Dependency on AI tools: Heavy reliance on GPT-5.6 Sol raises questions about reproducibility and scalability.
4. Limited format support: Only three formats currently supported; expansion path unclear.
5. Privacy vs. usability trade-offs: The strict privacy model may limit features or performance.
6. Lack of independent verification: All claims are self-reported, with no third-party validation.

Not evidenced: risk mitigation strategies or competitive advantages beyond the stated privacy and browser-based execution.

1. What is your plan for monetization or scaling beyond the hackathon?
2. How do you intend to expand support for new binary formats?
3. Have you validated demand from potential users in DFIR or protocol engineering?
4. Can you demonstrate how ByteQL compares to existing tools like Wireshark or custom parsers?
5. What are the limitations of browser-based processing for large-scale data analysis?
6. How do you plan to ensure ongoing maintenance and updates post-hackathon?
7. Are there any known compliance or legal issues with running this in enterprise environments?