Checkmarx parse raw source code (no need to compile) stores it in a DB and queries it with hundreds of rules to find vulnerabilities. Rules can be easily modified & added.
Want to learn more? Here are some additional pieces for you to read.