There are certainly wasm decompilers -- wasm2c, wasm2js, etc. You also have access to the browser's JS debugger for breakpoints, line by line execution control, dumping wasm's linear memory.
I haven't written any productive WebAssembly but I play Capture The Flag competitions, and it's become frequent for a wasm reverse engineering challenge to be thrown in. The tools are good enough to make that tractable, even for non-experts in wasm like me.
It helps a little that it's a stack-based rather than register-based VM. Usually more of the intent of code is preserved that way. It's like reversing a JVM class, rather than like reversing a native binary.
Re:W3C recommends WebAssembly
by throwaway40324 on Friday December 06, 2019 @11:10PM
(#21728413)
What are these Capture The Flag competitions? Do you mind posting a link?
Sure. My favorite explanation's a short video:
That is correct, a minified JS will preserve most of the semantics of the original program.
And since the original source can come from any language, how would one know which decompiler to use.
Re:W3C recommends WebAssembly
by MikeHolman on Friday December 06, 2019 @06:52PM
(#21727297)
You could already compile programs from other languages to javascript.
https://github.com/jashkenas/coffeescript/wiki/List-of-langu...
Wasm was effectively an extension of asm.js. It makes the experience of compile-to-web better, but it isn't much more opaque than other projects.
That said, I don't know of any webassembly decompilers, although I guess they must exist by this point. But also historically decompilers have been imperfect as some of the structure of the code is lost in the compilation process and has to be inferred, sometimes incorrectly, by the decompiler. Compare to a minifier where all you lose is the variable names, comments, and possibly helpful whitespace. All of the structure of the code is still there and there are no heuristics necessary to recreate something that resembles the original source.