AI 中文总结
NotDec是一款WebAssembly反编译框架，通过过程间类型恢复算法提升反编译质量，在重编译成功率、类型恢复准确率上远超Ghidra，其过程内变体NotDec_F效率更优。
AI 中文摘要
随着WebAssembly在浏览器、容器、物联网设备和无服务器平台中得到广泛支持，并日益被采用为通用低级字节码标准，审计其隐藏漏洞和恶意意图变得至关重要。反编译现有WebAssembly模块可帮助安全研究人员和终端用户理解二进制行为，但当前工具存在结果冗长、可读性差、类型恢复能力有限的问题。本文提出NotDec，一款先进的WebAssembly反编译框架。NotDec扩展WebAssembly类型检查算法，将字节码提升为基于静态单赋值（SSA）的中间表示（IR）；应用过程间类型恢复算法Retypd，并结合指针与数值区分方法来恢复复杂数据结构；同时利用内存SSA以及保留语义的结构化控制流分析，生成可读、语义一致的C代码。NotDec在全部5241个Juliet样本和所有Howard数据集程序上实现100%的重编译成功率，显著优于包括Ghidra（成功率45.95%）在内的基线工具。在类型恢复准确率方面，NotDec恢复了真实程序中85.33%的结构体成员访问，远超Ghidra的9.24%。尽管完整过程间版本在大型二进制文件上面临可扩展性挑战，但其过程内变体NotDec_F展现出优异效率，在未优化的二进制文件上，内存消耗不到Ghidra的一半，执行时间最多减少97%。
英文摘要
With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low-level bytecode standard, auditing its hidden vulnerabilities and malicious intentions has become critical. Decompiling existing WebAssembly modules can help security researchers and end users understand binary behavior, but current tools suffer from verbose result, poor readability, and limited type recovery. We present NotDec, an advanced WebAssembly decompilation framework. NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA-based IR, applies the inter-procedural type recovery algorithm Retypd with pointer and numeric value differentiation methods to recover complex data structures, and leverages Memory SSA alongside semantics-preserving structured control-flow analysis to emit readable, semantically consistent C code. NotDec achieves 100% recompilation success rate on all 5,241 Juliet samples and all Howard dataset programs, significantly outperforming baselines including Ghidra (45.95% success rate). On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra's 9.24%. While the full inter-procedural version faces scalability challenges on large binaries, the intra-procedural variant NotDec_F demonstrates superior efficiency, consuming less than half of Ghidra's memory and up to 97% less execution time on unoptimized binaries.
CommentsPublished in ICSE'26
