NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery

2026-08-04

AI Summary

Existing WebAssembly decompilers often suffer from verbose output, poor readability, and weak type recovery, severely limiting their utility for effective security auditing. This work proposes NotDec, a novel framework that introduces the Retypd algorithm to WebAssembly for the first time. By extending its type system to construct an SSA-based intermediate representation and integrating interprocedural type inference, Memory SSA, and structured control-flow analysis, NotDec precisely distinguishes pointers from numeric values and recovers complex data structure semantics. Experimental results demonstrate that NotDec achieves a 100% recompilation success rate on the Juliet and Howard datasets and attains an 85.33% accuracy in recovering struct member access types—substantially outperforming Ghidra, which achieves only 9.24%. Moreover, the lightweight variant NotDec_F consumes less than half the memory of Ghidra and reduces execution time by up to 97%.

Abstract

With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low-level bytecode standard, auditing its hidden vulnerabilities and malicious intentions has become critical. Decompiling existing WebAssembly modules can help security researchers and end users understand binary behavior, but current tools suffer from verbose result, poor readability, and limited type recovery. We present NotDec, an advanced WebAssembly decompilation framework. NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA-based IR, applies the inter-procedural type recovery algorithm Retypd with pointer and numeric value differentiation methods to recover complex data structures, and leverages Memory SSA alongside semantics-preserving structured control-flow analysis to emit readable, semantically consistent C code. NotDec achieves 100% recompilation success rate on all 5,241 Juliet samples and all Howard dataset programs, significantly outperforming baselines including Ghidra (45.95% success rate). On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra's 9.24%. While the full inter-procedural version faces scalability challenges on large binaries, the intra-procedural variant NotDec_F demonstrates superior efficiency, consuming less than half of Ghidra's memory and up to 97% less execution time on unoptimized binaries.

Problem

• WebAssembly
• decompilation
• type recovery
• binary analysis
• security auditing

Innovation

• WebAssembly decompilation
• inter-procedural type recovery
• SSA-based IR
• structured control-flow analysis
• Retypd