News for hackers. Stuff that matters.
Re:Making WebAssembly a first-class language on the Web by Retr0id on Wednesday March 11, 2026 @02:29PM (#47339332)
You can already compile malware to obfuscated asm.js. If anything, WASM blobs are easier to reverse engineer than obfuscated JS - good luck writing a ghidra plugin for JS source.
Re:Making WebAssembly a first-class language on the Web by throwaway12pol on Wednesday March 11, 2026 @02:44PM (#47339522)
What about obfuscated WASM blobs? At least obfuscated JS is still basically source code being interpreted, with WASM we will be running proprietary obfuscated binaries in the browser.
Re:Making WebAssembly a first-class language on the Web by Retr0id on Wednesday March 11, 2026 @03:04PM (#47339771)
I'd rather deal with an obfuscated WASM blob than obfuscated JS.
Re:Making WebAssembly a first-class language on the Web by throwaway12pol on Wednesday March 11, 2026 @03:33PM (#47340132)
Why is that? With obfuscated JS you can instantly create ASTs, easily patch and preview the results. We have codemodding tools for mass patching and analysis. With WASM, you can theoretically have a future anti-tamper corporation with a solution to actively obfuscate binaries and antagonize reverse engineers, like we have today with desktop binaries.
Re:Making WebAssembly a first-class language on the Web by Retr0id on Wednesday March 11, 2026 @03:53PM (#47340418)
ASTs are pretty useless once it's been through a control-flow flattening obfuscation pass. At the end of the day it's just one representation vs another, but there are a lot more existing tools for dealing with binary reverse engineering.
Re:Making WebAssembly a first-class language on the Web by kpcyrd on Wednesday March 11, 2026 @06:50PM (#47343456)
Many of the anti-debugging techniques for desktop binaries do not work on WebAssembly: it can't jump to an address, it can't read the instruction pointer, it can't read/access it's own machine code, ...
Re:Making WebAssembly a first-class language on the Web by kpcyrd on Wednesday March 11, 2026 @06:46PM (#47343408)
Obfuscated javascript could still import a WebAssembly polyfill, if there really was any advantage in doing so: https://github.com/evanw/polywasm

Since WebAssembly instructions are much easier to reason about, you could probably auto-optimize away a lot of the obfuscation, like "this is a silly way to do X, so we can just do X directly".