Go beyond disassembly. Build the full lifting and analysis pipeline.

Wyvern Advanced includes everything in Wyvern Basic and takes the project all the way from raw AArch64 machine code to optimized LLVM IR, backward slicing, jump-table recovery, and usable C and Python APIs.

You will build a complete binary-analysis pipeline:

Machine Code → Disassembly → Functions → Basic Blocks → CFG → WVIL → LLVM IR → Optimization → Analysis

No black-box lifter. No unexplained framework internals.

You build every layer yourself and learn how modern program-analysis systems transform machine instructions into representations that can actually be reasoned about.

Advanced includes the complete Basic course.

You will first build the foundation:

• LLVM 21 toolchain and C++20 project architecture
• AArch64 assembly using LLVM MC
• AArch64 disassembly and your own instruction model
• Prologue and epilogue detection
• Function discovery using structural heuristics, call targets, linear sweep, and recursive traversal
• Basic-block recovery using the leaders algorithm
• Control-Flow Graph generation
• WVIL, your own architecture-independent semantic Intermediate Language
• AArch64 → WVIL lifting, including register semantics and condition flags

By this point, raw instructions have become structured semantic operations.

Advanced starts where most introductory binary-analysis courses stop.

Now you take your semantic IL and lower it into real LLVM IR.

You will build the backend yourself and learn how machine-level state maps into LLVM’s representation.

Topics include:

• WVIL → LLVM IR lowering
• Register slices and sub-register aliasing
• LLVM IRBuilder
• Control-flow lowering
• Loads, stores, arithmetic, and comparisons
• Register-state representation
• A practical strategy that avoids complex PHI-node placement during initial lifting

The result is no longer just your own custom IL.

Your lifted binary becomes a valid LLVM module that LLVM itself can inspect, verify, transform, and optimize.

A lifter becomes much more powerful once its output can be normalized.

You will connect Wyvern to LLVM’s own optimization infrastructure and learn how compiler passes simplify the program representation for analysis.

You will:

• Run LLVM’s IR verifier over generated modules
• Detect malformed lifting output immediately
• Apply LLVM optimization passes
• Remove unnecessary temporary values
• Propagate constants
• Simplify arithmetic and control-flow expressions
• Transform noisy lifted code into cleaner analysis-friendly IR

The same infrastructure designed to optimize compiled programs now becomes part of your reverse-engineering toolkit.

Once you have lifted semantics, you can ask much more interesting questions.

Where did this value come from?

You will implement a real backward-slicing analysis over the recovered program.

Starting from a value of interest, Wyvern walks backward through the CFG and reconstructs the expressions that influence it.

You will work with:

• Expression trees
• Data dependencies
• Register and temporary-value propagation
• CFG-aware traversal
• Join-node handling

Instead of manually tracing dozens of instructions, you begin asking the IR to explain the program to you.

Indirect control flow is where binary analysis gets interesting.

You will use the lifted representation to recognize patterns generated by compiled switch statements and jump tables.

The analysis connects several parts of the course:

• Indirect branches
• Address computation
• Recovered expressions
• CFG reconstruction
• Lifted LLVM IR

The goal is not merely to identify an indirect branch.

The goal is to recover the higher-level structure hidden behind it.

A useful analysis engine should not be trapped inside a C++ executable.

You will design a stable C ABI over the Wyvern core using the opaque-handle pattern.

You will expose functionality such as:

• Creating and destroying analysis contexts
• Disassembling code
• Recovering functions and basic blocks
• Accessing CFG information
• Requesting lifted representations
• Querying analysis results

This forces you to think about API boundaries, lifetime management, ownership, and how real binary-analysis libraries expose complex C++ internals safely.

Finally, you will wrap the C interface with Python using cffi.

Your analysis engine becomes scriptable.

You can now use Wyvern interactively for:

• Rapid reverse-engineering scripts
• Batch binary analysis
• CFG inspection
• Automated lifting
• Analysis prototyping
• Integration into larger security-research workflows

The same core library you built from scratch becomes usable from both C++ and Python.

The course finishes by applying what you learned to a more complicated architecture model.

The ARM32/Thumb appendix examines what changes when the instruction set itself can switch during execution.

You will explore:

• ARM vs Thumb decoding
• Instruction-set state
• Mode-switching branches
• Different register and calling-convention assumptions
• How the Wyvern architecture would need to evolve to support it

The objective is not another pile of architecture-specific code.

It is to show that once you understand the design of a lifter, the concepts transfer.

Raw assembly tells you what the processor executes.

Intermediate representations let you ask what the program means.

By the end of Wyvern Advanced, you will be able to move between several levels of abstraction:

Bytes → Instructions → CFG → Semantic IL → LLVM IR → Analysis

That ability changes how you approach reverse engineering.

Instead of building every analysis around individual ARM instructions, you can normalize architecture-specific behavior into a representation designed for reasoning.

Lift the program. Simplify it. Follow the data. Recover the structure.

All labs are in-browser and ready to use.

No LLVM installation. No dependency wrestling. No spending hours reproducing a development environment.

Your laboratory includes the complete toolchain required to build and test every stage of Wyvern.

You can:

• Compile and test every module
• Assemble and disassemble AArch64 snippets
• Inspect functions, basic blocks, and CFGs
• Experiment with WVIL lifting
• Inspect generated LLVM IR
• Run LLVM optimization passes
• Develop and debug analysis passes
• Use the final library from C++ and Python

Students should have:

• Basic C++ programming skills
• Basic understanding of pointers, classes, and data structures
• General familiarity with assembly language
• Basic understanding of how compiled programs execute

AArch64 assembly, Intermediate Representations, LLVM IR, and the compiler concepts required by the course are taught as part of the training.

Previous experience building disassemblers, compilers, lifters, or static-analysis frameworks is not required.

You are not building this alone.

• 24/7 support via Discord
• Average response time under 1 hour
• Dedicated DevOps support for laboratory and infrastructure issues

Wyvern Advanced includes the complete Wyvern Basic course plus every advanced lifting, optimization, analysis, and API module.

You start with an empty directory.

You finish with your own scriptable binary-analysis framework capable of turning AArch64 machine code into optimized LLVM IR and running real analyses on top of it.

Disassemble it. Structure it. Lift it. Optimize it. Analyze it.