ARM Disassembler & IL From Scratch

[vc_row][vc_column] Wyvern — Building an ARM Disassembler & IL From Scratch [vc_column_text css=””] Stop looking at assembly. Start seeing program structure and semantics. Build Wyvern, a real AArch64 binary-analysis library, from an empty directory to a working disassembler, control-flow recovery engine, and architecture-independent Intermediate Language. This hands-on course takes you from raw ARM64 machine code to WVIL — your own semantic IL. No black boxes. No prebuilt analysis framework hiding the interesting parts. You build the pipeline yourself and understand exactly how raw bytes become instructions, functions, basic blocks, graphs, and semantics. [/vc_column_text][vc_empty_space height=”24px”] AArch64 text copy on click ↓ copy on click raw machine code copy on click ↓ copy on click disassembly copy on click ↓ copy on click functions copy on click ↓ copy on click basic blocks copy on click ↓ copy on click CFG copy on click ↓ copy on click WVIL semantic IL copy on click [vc_empty_space] What You Will Build [vc_column_text css=””] By the end of Wyvern Basic, you will have built a working AArch64 program-analysis pipeline capable of: Assembling AArch64: turn ARM64 assembly text into raw machine-code bytes using LLVM’s MC layer. Disassembling raw code: decode machine code into instructions and build your own instruction model. Detecting function boundaries: recognize prologues and epilogues and use them to reason about executable structure. Recovering functions: combine linear sweep, recursive traversal, call targets, and structural heuristics. Separating basic blocks: implement the leaders algorithm and identify valid block boundaries. Generating CFGs: reconstruct control-flow edges, conditional branches, calls, returns, and indirect branches. Designing your own IL: create WVIL, a small architecture-independent semantic Intermediate Language. Lifting AArch64 to WVIL: translate real machine instructions into explicit program semantics. [/vc_column_text][vc_empty_space height=”24px”] 0x1000 stp x29, x30, [sp, #-16]! copy on click 0x1004 mov x29, sp copy on click 0x1008 add x0, x0, #1 copy on click 0x100c ldp x29, x30, [sp], #16 copy on click 0x1010 ret copy on click [vc_empty_space] Recover Program Structure [vc_column_text css=””] A disassembler gives you instructions. A program-analysis framework needs much more. You will learn how to take a flat stream of decoded instructions and progressively recover its structure: Function entry and exit patterns Call targets and branch destinations Function boundaries Basic-block leaders Control-flow relationships Direct and indirect edges By the end of this stage, your code is no longer just a list of instructions. It has become a graph of the program. [/vc_column_text][vc_empty_space] Build Your Own Intermediate Language [vc_column_text css=””] This is where Wyvern changes the way you look at binaries. Instead of tying every analysis directly to AArch64 instructions, you will design WVIL — Wyvern Intermediate Language. WVIL gives you a small semantic vocabulary for representing: Constants Registers Temporary values Arithmetic and logical operations Loads and stores Branches and control flow Condition flags Architecture-specific instructions become explicit operations that your analyses can reason about. [/vc_column_text][vc_empty_space height=”24px”] AArch64: copy on click add x0, x1, x2 copy on click copy on click WVIL: copy on click t0 = REG_READ x1 copy on click t1 = REG_READ x2 copy on click t2 = ADD t0, t1 copy on click REG_WRITE x0, t2 copy on click [vc_empty_space] AArch64 Lifting [vc_column_text css=””] Once WVIL exists, you will build the actual lifting layer. You will map AArch64’s register state, instruction operands, condition flags, and operations into architecture-independent semantics. This is the crucial transition: What instruction is this? becomes: What does this instruction actually do? That distinction is at the heart of modern binary lifting and program analysis. [/vc_column_text][vc_empty_space] Built on LLVM 21 [vc_column_text css=””] Wyvern is not a toy parser built around hard-coded instruction strings. You will work directly with LLVM 21 and its MC infrastructure for assembly and disassembly while building your own analysis abstractions on top. The project uses: LLVM MC for AArch64 assembly and disassembly C++20 for the core library CMake for the build system Unit tests developed alongside every stage A clean Graph / Function / BasicBlock architecture You learn both the low-level LLVM interfaces and the higher-level design decisions needed to turn them into a usable analysis library. [/vc_column_text][vc_empty_space] Your Program Analysis Laboratory [vc_column_text css=””] All labs are in-browser and ready to use. No dependency wrestling. No spending your first evening compiling LLVM. Your laboratory gives you a reproducible environment with the complete toolchain ready for development. You can: Compile and test every stage of Wyvern Assemble and disassemble AArch64 snippets interactively Inspect recovered functions and basic blocks Visualize and debug CFG construction Experiment with WVIL semantics Modify lifters and immediately observe the result [/vc_column_text][vc_empty_space] Prerequisites [vc_column_text css=””] Students should have: Basic C++ programming skills Basic understanding of pointers, classes, and data structures General familiarity with assembly language Basic understanding of how compiled programs execute AArch64 assembly and compiler/IL concepts are taught from first principles. Previous experience building disassemblers, compilers, lifters, or program-analysis frameworks is not required. [/vc_column_text][vc_empty_space] Support [vc_column_text css=””] You are not building this alone. 24/7 support via Discord Average response time under 1 hour Dedicated DevOps support for laboratory and infrastructure issues [/vc_column_text][vc_empty_space] Where Basic Takes You [vc_column_text css=””] Wyvern Basic takes you from an empty directory to a working semantic AArch64 lifting pipeline: Machine Code → Instructions → Functions → Basic Blocks → CFG → WVIL At that point, you have something far more powerful than a disassembler. You have built the foundation of your own program-analysis framework. Disassemble it. Structure it. Lift it. Understand it. [/vc_column_text][/vc_column][/vc_row]