StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation
This addresses the challenge for developers in reverse engineering WebAssembly, which is critical for security and performance tasks, though it appears incremental as it builds on existing LLM and program analysis techniques.
The paper tackles the problem of understanding complex WebAssembly code by proposing StackSight, a neurosymbolic approach that decompiles it into readable C++ snippets, with evaluation showing significant improvements in decompilation and user studies indicating higher win rates and better semantic grasp.
WebAssembly enables near-native execution in web applications and is increasingly adopted for tasks that demand high performance and robust security. However, its assembly-like syntax, implicit stack machine, and low-level data types make it extremely difficult for human developers to understand, spurring the need for effective WebAssembly reverse engineering techniques. In this paper, we propose StackSight, a novel neurosymbolic approach that combines Large Language Models (LLMs) with advanced program analysis to decompile complex WebAssembly code into readable C++ snippets. StackSight visualizes and tracks virtual stack alterations via a static analysis algorithm and then applies chain-of-thought prompting to harness LLM's complex reasoning capabilities. Evaluation results show that StackSight significantly improves WebAssembly decompilation. Our user study also demonstrates that code snippets generated by StackSight have significantly higher win rates and enable a better grasp of code semantics.