Search papers, labs, and topics across Lattice.
NotDec is an advanced WebAssembly decompilation framework that enhances type recovery and readability by extending the WebAssembly type checking algorithm and applying the Retypd inter-procedural type recovery algorithm. It achieves a remarkable 100% recompilation success rate across extensive datasets, significantly surpassing existing tools like Ghidra, which only managed a 45.95% success rate. Additionally, NotDec recovers 85.33% of struct member accesses in real-world programs, demonstrating its superior capability in handling complex data structures compared to Ghidra's 9.24% accuracy.
NotDec outperforms Ghidra by achieving a 100% recompilation success rate and recovering 85.33% of struct member accesses, setting a new standard for WebAssembly decompilation.
With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low-level bytecode standard, auditing its hidden vulnerabilities and malicious intentions has become critical. Decompiling existing WebAssembly modules can help security researchers and end users understand binary behavior, but current tools suffer from verbose result, poor readability, and limited type recovery. We present NotDec, an advanced WebAssembly decompilation framework. NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA-based IR, applies the inter-procedural type recovery algorithm Retypd with pointer and numeric value differentiation methods to recover complex data structures, and leverages Memory SSA alongside semantics-preserving structured control-flow analysis to emit readable, semantically consistent C code. NotDec achieves 100% recompilation success rate on all 5,241 Juliet samples and all Howard dataset programs, significantly outperforming baselines including Ghidra (45.95% success rate). On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra's 9.24%. While the full inter-procedural version faces scalability challenges on large binaries, the intra-procedural variant NotDec_F demonstrates superior efficiency, consuming less than half of Ghidra's memory and up to 97% less execution time on unoptimized binaries.
