WebAssembly enables near-native execution in web applications and is
increasingly adopted for tasks that demand high performance and robust
security. However, its assembly-like syntax, implicit stack machine, and
low-level data types make it extremely difficult for human developers to
understand, spurring the need for effective WebAssembly reverse engineering
techniques. In this paper, we propose StackSight, a novel neurosymbolic
approach that combines Large Language Models (LLMs) with advanced program
analysis to decompile complex WebAssembly code into readable C++ snippets.
StackSight visualizes and tracks virtual stack alterations via a static
analysis algorithm and then applies chain-of-thought prompting to harness LLM's
complex reasoning capabilities. Evaluation results show that StackSight
significantly improves WebAssembly decompilation. Our user study also
demonstrates that code snippets generated by StackSight have significantly
higher win rates and enable a better grasp of code semantics.

通过结合大型语言模型（LLMs）和高级程序分析技术，StackSight 提出了一种新的神经符号化方法，将复杂的 WebAssembly 代码反编译为可读性高的 C++ 代码片段，通过可视化和追踪虚拟栈的改变，以及利用 LLM 的复杂推理能力，显著改进了 WebAssembly 的反编译，并通过用户研究证明 StackSight 生成的代码片段具有更高的胜率和更好的代码语义理解。

StackSight: 透过大型语言模型和神经符号链式思维解构揭示 WebAssembly

StackSight: Unveiling WebAssembly through Large Language Models and  Neurosymbolic Chain-of-Thought Decompilation

The increasing adoption of WebAssembly (Wasm) for performance-critical and
security-sensitive tasks drives the demand for WebAssembly program
comprehension and reverse engineering. Recent studies have introduced machine
learning (ML)-based WebAssembly reverse engineering tools. Yet, the
generalization of task-specific ML solutions remains challenging, because their
effectiveness hinges on the availability of an ample supply of high-quality
task-specific labeled data. Moreover, previous works overlook the high-level
semantics present in source code and its documentation. Acknowledging the
abundance of available source code with documentation, which can be compiled
into WebAssembly, we propose to learn representations of them concurrently and
harness their mutual relationships for effective WebAssembly reverse
engineering.
In this paper, we present WasmRev, the first multi-modal pre-trained language
model for WebAssembly reverse engineering. WasmRev is pre-trained using
self-supervised learning on a large-scale multi-modal corpus encompassing
source code, code documentation and the compiled WebAssembly, without requiring
labeled data. WasmRev incorporates three tailored multi-modal pre-training
tasks to capture various characteristics of WebAssembly and cross-modal
relationships. WasmRev is only trained once to produce general-purpose
representations that can broadly support WebAssembly reverse engineering tasks
through few-shot fine-tuning with much less labeled data, improving data
efficiency. We fine-tune WasmRev onto three important reverse engineering
tasks: type recovery, function purpose identification and WebAssembly
summarization. Our results show that WasmRev pre-trained on the corpus of
multi-modal samples establishes a robust foundation for these tasks, achieving
high task accuracy and outperforming the state-of-the-art ML methods for
WebAssembly reverse engineering.

提出了 WasmRev—— 第一个用于 WebAssembly 反向工程的多模态预训练语言模型，通过自监督学习对大规模的多模态语料库进行预训练，包括源代码、代码文档和编译后的 WebAssembly，而不需要标记的数据。WasmRev 包含三个定制的多模态预训练任务，以捕捉 WebAssembly 的各种特征和跨模态关系。在少量标记数据上进行微调后，WasmRev 能广泛支持 WebAssembly 的反向工程任务，提高数据效率，并在类型恢复、函数目的识别和 WebAssembly 摘要等重要反向工程任务上实现了高的准确性，并超越了现有的机器学习方法。

多模态学习用于 WebAssembly 逆向工程

Multi-modal Learning for WebAssembly Reverse Engineering

Machine learning is often used for malicious website detection, but an
approach incorporating WebAssembly as a feature has not been explored due to a
limited number of samples, to the best of our knowledge. In this paper, we
propose JABBERWOCK (JAvascript-Based Binary EncodeR by WebAssembly Optimization
paCKer), a tool to generate WebAssembly datasets in a pseudo fashion via
JavaScript. Loosely speaking, JABBERWOCK automatically gathers JavaScript code
in the real world, convert them into WebAssembly, and then outputs vectors of
the WebAssembly as samples for malicious website detection. We also conduct
experimental evaluations of JABBERWOCK in terms of the processing time for
dataset generation, comparison of the generated samples with actual WebAssembly
samples gathered from the Internet, and an application for malicious website
detection. Regarding the processing time, we show that JABBERWOCK can construct
a dataset in 4.5 seconds per sample for any number of samples. Next, comparing
10,000 samples output by JABBERWOCK with 168 gathered WebAssembly samples, we
believe that the generated samples by JABBERWOCK are similar to those in the
real world. We then show that JABBERWOCK can provide malicious website
detection with 99\% F1-score because JABBERWOCK makes a gap between benign and
malicious samples as the reason for the above high score. We also confirm that
JABBERWOCK can be combined with an existing malicious website detection tool to
improve F1-scores. JABBERWOCK is publicly available via GitHub
(this https URL).

JABBERWOCK 是一个工具，它可以将 JavaScript 代码自动转换为 WebAssembly，并将其输出为恶意网站检测的样本，通过实验评估，它可以在 4.5 秒内生成一个数据集，并提供 99％的 F1 分数。