Advanced Program Analysis

[vc_row][vc_column] Wyvern Advanced — From AArch64 Machine Code to LLVM IR & Program Analysis [vc_column_text css=””] Go beyond disassembly. Build the full lifting and analysis pipeline. Wyvern Advanced includes everything in Wyvern Basic and takes the project all the way from raw AArch64 machine code to optimized LLVM IR, backward slicing, jump-table recovery, and usable C and Python APIs. You will build a complete binary-analysis pipeline: Machine Code → Disassembly → Functions → Basic Blocks → CFG → WVIL → LLVM IR → Optimization → Analysis No black-box lifter. No unexplained framework internals. You build every layer yourself and learn how modern program-analysis systems transform machine instructions into representations that can actually be reasoned about. [/vc_column_text][vc_empty_space height=”24px”] AArch64 machine code copy on click ↓ copy on click disassembly copy on click ↓ copy on click functions / basic blocks copy on click ↓ copy on click CFG copy on click ↓ copy on click WVIL copy on click ↓ copy on click LLVM IR copy on click ↓ copy on click optimization copy on click ↓ copy on click program analysis copy on click [vc_empty_space] Everything in Wyvern Basic [vc_column_text css=””] Advanced includes the complete Basic course. You will first build the foundation: LLVM 21 toolchain and C++20 project architecture AArch64 assembly using LLVM MC AArch64 disassembly and your own instruction model Prologue and epilogue detection Function discovery using structural heuristics, call targets, linear sweep, and recursive traversal Basic-block recovery using the leaders algorithm Control-Flow Graph generation WVIL, your own architecture-independent semantic Intermediate Language AArch64 → WVIL lifting, including register semantics and condition flags By this point, raw instructions have become structured semantic operations. Advanced starts where most introductory binary-analysis courses stop. [/vc_column_text][vc_empty_space] Lift WVIL to Real LLVM IR [vc_column_text css=””] Now you take your semantic IL and lower it into real LLVM IR. You will build the backend yourself and learn how machine-level state maps into LLVM’s representation. Topics include: WVIL → LLVM IR lowering Register slices and sub-register aliasing LLVM IRBuilder Control-flow lowering Loads, stores, arithmetic, and comparisons Register-state representation A practical strategy that avoids complex PHI-node placement during initial lifting The result is no longer just your own custom IL. Your lifted binary becomes a valid LLVM module that LLVM itself can inspect, verify, transform, and optimize. [/vc_column_text][vc_empty_space height=”24px”] %x = load i64, ptr %x0_slot copy on click %y = load i64, ptr %x1_slot copy on click %r = add i64 %x, %y copy on click store i64 %r, ptr %x0_slot copy on click [vc_empty_space] Optimize and Verify Lifted Code [vc_column_text css=””] A lifter becomes much more powerful once its output can be normalized. You will connect Wyvern to LLVM’s own optimization infrastructure and learn how compiler passes simplify the program representation for analysis. You will: Run LLVM’s IR verifier over generated modules Detect malformed lifting output immediately Apply LLVM optimization passes Remove unnecessary temporary values Propagate constants Simplify arithmetic and control-flow expressions Transform noisy lifted code into cleaner analysis-friendly IR The same infrastructure designed to optimize compiled programs now becomes part of your reverse-engineering toolkit. [/vc_column_text][vc_empty_space] Backward Slicing [vc_column_text css=””] Once you have lifted semantics, you can ask much more interesting questions. Where did this value come from? You will implement a real backward-slicing analysis over the recovered program. Starting from a value of interest, Wyvern walks backward through the CFG and reconstructs the expressions that influence it. You will work with: Expression trees Data dependencies Register and temporary-value propagation CFG-aware traversal Join-node handling Instead of manually tracing dozens of instructions, you begin asking the IR to explain the program to you. [/vc_column_text][vc_empty_space height=”24px”] target: x0 copy on click ↑ copy on click copy on click copy on click load [base+%0x10] copy on click copy on click function input copy on click [vc_empty_space] Recover Switches & Jump Tables [vc_column_text css=””] Indirect control flow is where binary analysis gets interesting. You will use the lifted representation to recognize patterns generated by compiled switch statements and jump tables. The analysis connects several parts of the course: Indirect branches Address computation Recovered expressions CFG reconstruction Lifted LLVM IR The goal is not merely to identify an indirect branch. The goal is to recover the higher-level structure hidden behind it. [/vc_column_text][vc_empty_space] Build a Stable C API [vc_column_text css=””] A useful analysis engine should not be trapped inside a C++ executable. You will design a stable C ABI over the Wyvern core using the opaque-handle pattern. You will expose functionality such as: Creating and destroying analysis contexts Disassembling code Recovering functions and basic blocks Accessing CFG information Requesting lifted representations Querying analysis results This forces you to think about API boundaries, lifetime management, ownership, and how real binary-analysis libraries expose complex C++ internals safely. [/vc_column_text][vc_empty_space] Control Wyvern From Python [vc_column_text css=””] Finally, you will wrap the C interface with Python using cffi. Your analysis engine becomes scriptable. You can now use Wyvern interactively for: Rapid reverse-engineering scripts Batch binary analysis CFG inspection Automated lifting Analysis prototyping Integration into larger security-research workflows The same core library you built from scratch becomes usable from both C++ and Python. [/vc_column_text][vc_empty_space] ARM32 / Thumb — What Changes? [vc_column_text css=””] The course finishes by applying what you learned to a more complicated architecture model. The ARM32/Thumb appendix examines what changes when the instruction set itself can switch during execution. You will explore: ARM vs Thumb decoding Instruction-set state Mode-switching branches Different register and calling-convention assumptions How the Wyvern architecture would need to evolve to support it The objective is not another pile of architecture-specific code. It is to show that once you understand the design of a lifter, the concepts transfer. [/vc_column_text][vc_empty_space] IR-View: Your Program Analysis Superpower [vc_column_text css=””] Raw assembly tells you what the processor executes. Intermediate representations let you ask what the program means. By the end of Wyvern Advanced, you will be able to move between several levels of abstraction: Bytes → Instructions → CFG → Semantic IL → LLVM IR → Analysis That ability changes how you approach reverse engineering. Instead of building every analysis around individual ARM instructions, you can normalize architecture-specific behavior into a representation designed for reasoning. Lift the program. Simplify it. Follow the data. Recover the structure. [/vc_column_text][vc_empty_space] Your Program Analysis Laboratory [vc_column_text css=””] All labs are in-browser and ready to use. No LLVM installation. No dependency wrestling. No spending hours reproducing a development environment. Your laboratory includes the complete toolchain required to build and test every stage of Wyvern. You can: Compile and test every module Assemble and disassemble AArch64 snippets Inspect functions, basic blocks, and CFGs Experiment with WVIL lifting Inspect generated LLVM IR Run LLVM optimization passes Develop and debug analysis passes Use the final library from C++ and Python [/vc_column_text][vc_empty_space] Prerequisites [vc_column_text css=””] Students should have: Basic C++ programming skills Basic understanding of pointers, classes, and data structures General familiarity with assembly language Basic understanding of how compiled programs execute AArch64 assembly, Intermediate Representations, LLVM IR, and the compiler concepts required by the course are taught as part of the training. Previous experience building disassemblers, compilers, lifters, or static-analysis frameworks is not required. [/vc_column_text][vc_empty_space] Support [vc_column_text css=””] You are not building this alone. 24/7 support via Discord Average response time under 1 hour Dedicated DevOps support for laboratory and infrastructure issues [/vc_column_text][vc_empty_space] Wyvern Advanced — The Complete Program Analysis Course [vc_column_text css=””] Wyvern Advanced includes the complete Wyvern Basic course plus every advanced lifting, optimization, analysis, and API module. You start with an empty directory. You finish with your own scriptable binary-analysis framework capable of turning AArch64 machine code into optimized LLVM IR and running real analyses on top of it. Disassemble it. Structure it. Lift it. Optimize it. Analyze it. [/vc_column_text][/vc_column][/vc_row]