2025 · Conference paper
Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries
Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. The same C programs are compiled with Emscripten to WebAssembly and with clang to native code, then decompiled by wasm2c, w2c2 and wasm-decompile or by Ghidra and RetDec. Correctness reuses 1,000 Csmith programs from DecFuzzer, recompiling the output and comparing its execution with the original; code-complexity metrics and AST similarity to the original source are measured on PolyBenchC and CHStone at -O0 to -O2. wasm2c passed all 1,000 correctness programs, against 649 for wasm-decompile, 818 for Ghidra and 775 for RetDec.
Scope and limitations
Correctness covers only generated single functions with local-variable arithmetic and no library calls, pointers or global state, so the wasm2c result does not establish correctness on general programs. w2c2 is excluded from the correctness test, and wasm-decompile output could be parsed for structural similarity only at -O0. Native baselines pass through DecFuzzer’s syntax rewriter, and the authors note that some Ghidra and RetDec failures may come from that evaluation step rather than the decompilers. Readability is estimated from metrics such as lines of code, nesting depth, cyclomatic and Halstead complexity, gotos and casts, not from a human study. The benchmarks are C suites compiled by the authors with one Emscripten/clang toolchain, not real-world WebAssembly modules, and tool versions are described only as the latest available at the time.
Why it fits this collection
Adds an empirical baseline for existing WebAssembly decompilers, complementing the LLM-based WebAssembly decompilation papers and native decompiler correctness testing in this section.
Publication and review details
- Venue
- SecureComm 2024
- Status
- Conference paper
- Publication / posting date
- September 1, 2025
- Date source
- Springer’s Crossref deposit gives published-online and issued date 2025-09-01, labelled First Online, and print year 2026. The October 2024 conference dates and the 2024-11-04 arXiv submission are not substituted for this publication date.
- First arXiv submission
- November 4, 2024
- arXiv
- 2411.02278
- Reviewed arXiv version
- v1
- DOI
- 10.1007/978-3-031-94448-2_6
Crossref records the chapter in the LNICST book Security and Privacy in Communication Networks, pages 108–130, with conference information for SecureComm 2024 (the 20th edition, Dubai, 28–30 October 2024). Crossref gives no series volume number, so none is recorded. The Springer landing page refused automated requests; the description and limitations rest on the 13-page arXiv v1 manuscript, whose footer names SecureComm 2024. It is not claimed to match the published chapter page for page. The paper says its benchmark and analysis framework will be open-sourced but gives no URL, and no release was found. No code or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.