Stop looking at assembly. Start seeing program structure and semantics.

Build Wyvern, a real AArch64 binary-analysis library, from an empty directory to a working disassembler, control-flow recovery engine, and architecture-independent Intermediate Language.

This hands-on course takes you from raw ARM64 machine code to WVIL — your own semantic IL.

No black boxes. No prebuilt analysis framework hiding the interesting parts.

You build the pipeline yourself and understand exactly how raw bytes become instructions, functions, basic blocks, graphs, and semantics.

By the end of Wyvern Basic, you will have built a working AArch64 program-analysis pipeline capable of:

• Assembling AArch64: turn ARM64 assembly text into raw machine-code bytes using LLVM’s MC layer.
• Disassembling raw code: decode machine code into instructions and build your own instruction model.
• Detecting function boundaries: recognize prologues and epilogues and use them to reason about executable structure.
• Recovering functions: combine linear sweep, recursive traversal, call targets, and structural heuristics.
• Separating basic blocks: implement the leaders algorithm and identify valid block boundaries.
• Generating CFGs: reconstruct control-flow edges, conditional branches, calls, returns, and indirect branches.
• Designing your own IL: create WVIL, a small architecture-independent semantic Intermediate Language.
• Lifting AArch64 to WVIL: translate real machine instructions into explicit program semantics.

A disassembler gives you instructions.

A program-analysis framework needs much more.

You will learn how to take a flat stream of decoded instructions and progressively recover its structure:

• Function entry and exit patterns
• Call targets and branch destinations
• Function boundaries
• Basic-block leaders
• Control-flow relationships
• Direct and indirect edges

By the end of this stage, your code is no longer just a list of instructions.

It has become a graph of the program.

This is where Wyvern changes the way you look at binaries.

Instead of tying every analysis directly to AArch64 instructions, you will design WVIL — Wyvern Intermediate Language.

WVIL gives you a small semantic vocabulary for representing:

• Constants
• Registers
• Temporary values
• Arithmetic and logical operations
• Loads and stores
• Branches and control flow
• Condition flags

Architecture-specific instructions become explicit operations that your analyses can reason about.

Once WVIL exists, you will build the actual lifting layer.

You will map AArch64’s register state, instruction operands, condition flags, and operations into architecture-independent semantics.

This is the crucial transition:

What instruction is this?

becomes:

What does this instruction actually do?

That distinction is at the heart of modern binary lifting and program analysis.

Wyvern is not a toy parser built around hard-coded instruction strings.

You will work directly with LLVM 21 and its MC infrastructure for assembly and disassembly while building your own analysis abstractions on top.

The project uses:

• LLVM MC for AArch64 assembly and disassembly
• C++20 for the core library
• CMake for the build system
• Unit tests developed alongside every stage
• A clean Graph / Function / BasicBlock architecture

You learn both the low-level LLVM interfaces and the higher-level design decisions needed to turn them into a usable analysis library.

All labs are in-browser and ready to use.

No dependency wrestling. No spending your first evening compiling LLVM.

Your laboratory gives you a reproducible environment with the complete toolchain ready for development.

You can:

• Compile and test every stage of Wyvern
• Assemble and disassemble AArch64 snippets interactively
• Inspect recovered functions and basic blocks
• Visualize and debug CFG construction
• Experiment with WVIL semantics
• Modify lifters and immediately observe the result

Students should have:

• Basic C++ programming skills
• Basic understanding of pointers, classes, and data structures
• General familiarity with assembly language
• Basic understanding of how compiled programs execute

AArch64 assembly and compiler/IL concepts are taught from first principles.

Previous experience building disassemblers, compilers, lifters, or program-analysis frameworks is not required.

You are not building this alone.

• 24/7 support via Discord
• Average response time under 1 hour
• Dedicated DevOps support for laboratory and infrastructure issues

Wyvern Basic takes you from an empty directory to a working semantic AArch64 lifting pipeline:

Machine Code → Instructions → Functions → Basic Blocks → CFG → WVIL

At that point, you have something far more powerful than a disassembler.

You have built the foundation of your own program-analysis framework.

Disassemble it. Structure it. Lift it. Understand it.