@@ -85,6 +85,12 @@ private void ExtractType(TypeDefinition type) {
       ExtractMethod(method, typeId);
     }
 
+    // Extract fields
+    foreach (var field in type.Fields) {
+      var fieldId = trap.GetId();
+      ExtractField(field, typeId);
+    }
+
     // Extract nested types (includes compiler-generated state machines)
     if (type.HasNestedTypes) {
       foreach (var nestedType in type.NestedTypes) {
@@ -125,6 +131,11 @@ private void ExtractMethod(MethodDefinition method, int typeId) {
     }
   }
 
+  private void ExtractField(FieldDefinition field, int typeId) {
+    var fieldId = trap.GetId();
+    trap.WriteTuple("fields", fieldId, field.Name, typeId);
+  }
+
   private void ExtractMethodBody(MethodDefinition method, int methodId) {
     var body = method.Body;
 
@@ -174,6 +185,9 @@ private void ExtractMethodBody(MethodDefinition method, int methodId) {
       } else if (instruction.Operand is VariableDefinition varDef) {
         // Local variable reference (ldloc, stloc, ldloca)
         trap.WriteTuple("il_operand_local_index", instrId, varDef.Index);
+      } else if (instruction.Operand is FieldReference fieldRef) {
+        var declaringTypeName = fieldRef.DeclaringType.FullName.Replace('/', '.');
+        trap.WriteTuple("il_field_operand", instrId, declaringTypeName, fieldRef.Name);
       } else if (instruction.Operand is string str) {
         trap.WriteTuple("il_operand_string", instrId, str);
       } else if (instruction.Operand is sbyte sb) {
 
@@ -1,5 +1,15 @@
 private import binary
 
+class CilField extends @field {
+  string toString() { result = this.getName() }
+
+  string getName() { fields(this, result, _) }
+
+  CilType getDeclaringType() { fields(this, _, result) }
+
+  Location getLocation() { none() } // TODO: Extract
+}
+
 /**
  * A CIL type (class, struct, interface, etc.).
  */
@@ -18,6 +28,9 @@ class CilType extends @type {
   /** Gets a method declared in this type. */
   CilMethod getAMethod() { result.getDeclaringType() = this }
 
+  /** Gets a field declared by this type. */
+  CilField getAField() { result.getDeclaringType() = this }
+
   Location getLocation() { none() } // TODO: Extract
 }
 
@@ -625,14 +638,33 @@ class CilLdsfld extends @il_ldsfld, CilLoadFieldInstruction { }
 /** An instruction that loads the address of a static field. */
 class CilLdsflda extends @il_ldsflda, CilLoadFieldInstruction { }
 
+pragma[nomagic]
+private predicate fieldHasDeclaringTypeNameAndName(
+  string declaringTypeName, string fieldName, CilField f
+) {
+  f.getDeclaringType().getFullName() = declaringTypeName and
+  f.getName() = fieldName
+}
+
 /** An instruction that stores a value to a field. */
-abstract class CilStoreFieldInstruction extends CilInstruction { }
+abstract class CilStoreFieldInstruction extends CilInstruction {
+  CilField getField() {
+    exists(string declaringTypeName, string fieldName |
+      il_field_operand(this, declaringTypeName, fieldName) and
+      fieldHasDeclaringTypeNameAndName(declaringTypeName, fieldName, result)
+    )
+  }
+
+  predicate isStatic() { none() }
+}
 
 /** An instruction that stores a value to an instance field. */
 class CilStfld extends @il_stfld, CilStoreFieldInstruction { }
 
 /** An instruction that stores a value to a static field. */
-class CilStsfld extends @il_stsfld, CilStoreFieldInstruction { }
+class CilStsfld extends @il_stsfld, CilStoreFieldInstruction {
+  final override predicate isStatic() { any() }
+}
 
 class CilStobj extends @il_stobj, CilInstruction { }
 
 
@@ -2141,6 +2141,12 @@ methods(
   int type_id: @type ref
 );
 
+fields(
+  unique int id: @field,
+  string name: string ref,
+  int type_id: @type ref
+);
+
 case @il_instruction.mnemonic of
   0 = @il_nop
 | 1 = @il_break
@@ -2438,6 +2444,12 @@ il_call_target_unresolved(
   string target_method_name: string ref
 );
 
+il_field_operand(
+  int instruction: @il_instruction ref,
+  string declaring_type_name: string ref,
+  string field_name: string ref
+);
+
 /**
  * String operands for IL instructions.
  * Used for ldstr (load string) instructions.