# Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries

> Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. The same C programs are compiled with Emscripten to WebAssembly and with clang to native code, then decompiled by wasm2c, w2c2 and wasm-decompile or by Ghidra and RetDec. Correctness reuses 1,000 Csmith programs from DecFuzzer, recompiling the output and comparing its execution with the original; code-complexity metrics and AST similarity to the original source are measured on PolyBenchC and CHStone at -O0 to -O2. wasm2c passed all 1,000 correctness programs, against 649 for wasm-decompile, 818 for Ghidra and 775 for RetDec.

- Authors: Wei-Cheng Wu; Yutian Yan; Hallgrimur David Egilsson; David Park; Steven Chan; Christophe Hauser; Weihang Wang
- Venue: SecureComm 2024
- Status: Conference paper
- Publication / posting date: September 1, 2025
- Date source: Springer’s Crossref deposit gives published-online and issued date 2025-09-01, labelled First Online, and print year 2026. The October 2024 conference dates and the 2024-11-04 arXiv submission are not substituted for this publication date.
- First arXiv submission: November 4, 2024
- arXiv: 2411.02278
- Reviewed arXiv version: v1
- DOI: 10.1007/978-3-031-94448-2_6
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original paper: <https://link.springer.com/chapter/10.1007/978-3-031-94448-2_6>
- PDF: <https://arxiv.org/pdf/2411.02278v1>
- BibTeX: <https://awesomerea.org/papers/citations/paper-wasm-decompiler-study.bib>
- Catalog page: <https://awesomerea.org/papers/paper-wasm-decompiler-study/>
- Record JSON: <https://awesomerea.org/papers/paper-wasm-decompiler-study/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-wasm-decompiler-study/index.md)

## Scope and limitations

Correctness covers only generated single functions with local-variable arithmetic and no library calls, pointers or global state, so the wasm2c result does not establish correctness on general programs. w2c2 is excluded from the correctness test, and wasm-decompile output could be parsed for structural similarity only at -O0. Native baselines pass through DecFuzzer’s syntax rewriter, and the authors note that some Ghidra and RetDec failures may come from that evaluation step rather than the decompilers. Readability is estimated from metrics such as lines of code, nesting depth, cyclomatic and Halstead complexity, gotos and casts, not from a human study. The benchmarks are C suites compiled by the authors with one Emscripten/clang toolchain, not real-world WebAssembly modules, and tool versions are described only as the latest available at the time.

## Why it fits this collection

Adds an empirical baseline for existing WebAssembly decompilers, complementing the LLM-based WebAssembly decompilation papers and native decompiler correctness testing in this section.

## Publication and review notes

Crossref records the chapter in the LNICST book Security and Privacy in Communication Networks, pages 108–130, with conference information for SecureComm 2024 (the 20th edition, Dubai, 28–30 October 2024). Crossref gives no series volume number, so none is recorded. The Springer landing page refused automated requests; the description and limitations rest on the 13-page arXiv v1 manuscript, whose footer names SecureComm 2024. The paper says its benchmark and analysis framework will be open-sourced but gives no URL, and no release was found.

## Primary sources

1. <https://api.crossref.org/works/10.1007/978-3-031-94448-2_6>
2. <https://api.crossref.org/works/10.1007/978-3-031-94448-2>
3. <https://arxiv.org/abs/2411.02278v1>
4. <https://arxiv.org/pdf/2411.02278v1>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.