NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery

• URL: http://arxiv.org/abs/2608.03286v1
• Date: Tue, 04 Aug 2026 08:01:06 GMT
• Title: NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery
• Abstract summary: We present NotDec, an advanced WebAssembly decompilation framework.<n>NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA-based IR.<n>On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra's 9.24%.
• Score: 13.065981393638467
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low-level bytecode standard, auditing its hidden vulnerabilities and malicious intentions has become critical. Decompiling existing WebAssembly modules can help security researchers and end users understand binary behavior, but current tools suffer from verbose result, poor readability, and limited type recovery. We present NotDec, an advanced WebAssembly decompilation framework. NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA-based IR, applies the inter-procedural type recovery algorithm Retypd with pointer and numeric value differentiation methods to recover complex data structures, and leverages Memory SSA alongside semantics-preserving structured control-flow analysis to emit readable, semantically consistent C code. NotDec achieves 100% recompilation success rate on all 5,241 Juliet samples and all Howard dataset programs, significantly outperforming baselines including Ghidra (45.95% success rate). On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra's 9.24%. While the full inter-procedural version faces scalability challenges on large binaries, the intra-procedural variant NotDec_F demonstrates superior efficiency, consuming less than half of Ghidra's memory and up to 97% less execution time on unoptimized binaries.

Related papers

• No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation [1.5034998782245808]
  This article presents a fully static, whole-program binary lifting system requiring no runtime translation support on the target.<n>We have implemented this approach as a prototype binary runtimer from x86-64 binaries to LLVM IR, requiring no code/data runtimes.
  arXiv  Detail & Related papers  (2026-09-14T23:00:09Z)
• Faster Than Flash: Exploiting Attention Sparsity for Efficient Long-Context Decoding [51.48425605758328]
  We present Faster Flash Decoding (FFD), a novel hardware-algorithm co-design framework designed to break the memory wall in long-context decoding.<n>FFD integrates the selector and computer into a fully fused kernel, replacing external metadata indices with content-aware scanning.<n>It achieves up to 11.6x kernel-level speedup and scaling to 256K context length, with 2.37x end-to-end throughput improvement.
  arXiv  Detail & Related papers  (2026-08-31T15:13:20Z)
• AsmRAG: LLM-Driven Malware Detection by Retrieving Functionally Similar Assembly Code [1.2183405753834562]
  We introduce AsmRAG, a framework performing malware analysis through Assembly-Level Retrieval-Augmented Generation.<n>The system uses a code-specialized Large Language Model (LLM) to analyze assembly functions and convert them into semantic embeddings.<n>For inference, we propose a Density-Weighted Anchor Selection mechanism that isolates the primary unit of malicious logic within a binary to extract verifiable forensic evidence and resist evasion attempts.
  arXiv  Detail & Related papers  (2026-04-25T08:05:50Z)
• CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference [10.71961188176124]
  Binary decompilation is a critical reverse engineering task aimed at reconstructing high-level source code from stripped executables.<n>Large Language Models (LLMs) have recently shown promise, but they often suffer from "logical hallucinations" and "semantic misalignment"<n>We propose Cognitive Decompiler Refinement with Robustness (CoDe-R), a lightweight two-stage code refinement framework.
  arXiv  Detail & Related papers  (2026-04-14T15:58:38Z)
• Context-Guided Decompilation: A Step Towards Re-executability [50.71992919223209]
  Binary decompilation plays an important role in software security analysis, reverse engineering and malware understanding.<n>Recent advances in large language models (LLMs) have enabled neural decompilation, but the generated code is typically only semantically plausible.<n>We propose ICL4Decomp, a hybrid decompilation framework that leverages in-context learning (ICL) to guide LLMs toward generating re-executable source code.
  arXiv  Detail & Related papers  (2025-11-03T17:21:39Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• Beyond the Edge of Function: Unraveling the Patterns of Type Recovery in Binary Code [55.493408628371235]
  We propose ByteTR, a framework for recovering variable types in binary code.<n>In light of the ubiquity of variable propagation across functions, ByteTR conducts inter-procedural analysis to trace variable propagation and employs a gated graph neural network to capture long-range data flow dependencies for variable type recovery.
  arXiv  Detail & Related papers  (2025-03-10T12:27:05Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries [4.66875056781341]
  We present a novel framework for empirically evaluating C-based decompilers from various aspects including correctness/ readability/ and structural similarity. This in turn contributes to bolstering the security and reliability of software systems that rely on WASM and native binaries.
  arXiv  Detail & Related papers  (2024-11-04T17:08:03Z)
• WaDec: Decompiling WebAssembly Using Large Language Model [5.667013605202579]
  WebAssembly (abbreviated Wasm) has emerged as a cornerstone of web development. Despite its advantages, Wasm's binary nature presents significant challenges for developers and researchers. We introduce a novel approach, WaDec, which is the first use of a fine-tuned LLM to interpret and decompile Wasm binary code.
  arXiv  Detail & Related papers  (2024-06-17T09:08:30Z)
• Towards Effective and Efficient Non-autoregressive Decoding Using Block-based Attention Mask [74.64216073678617]
  AMD performs parallel NAR inference within contiguous blocks of output labels concealed using attention masks. A beam search algorithm is designed to leverage a dynamic fusion of CTC, AR Decoder, and AMD probabilities. Experiments on the LibriSpeech-100hr corpus suggest the tripartite Decoder incorporating the AMD module produces a maximum decoding speed-up ratio of 1.73x.
  arXiv  Detail & Related papers  (2024-06-14T13:42:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.