StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation

TL;DR

StackSight targets the challenging problem of WebAssembly decompilation by fusing static analysis of the virtual stack with Large Language Models in a step-by-step, chain-of-thought framework. The approach explicitly tracks stack state, recovers semantic variable names, and summarizes functionality in natural language, guiding the model toward functionally correct C/C++ outputs. Empirical results show significant gains in decompilation correctness and semantic relevance of summaries, with notable improvements in user comprehension and reductions in hallucinations. The work demonstrates a practical pathway for safer, more interpretable WASM analysis, with broad implications for code review, malware detection, and third-party module understanding.

Abstract

WebAssembly enables near-native execution in web applications and is increasingly adopted for tasks that demand high performance and robust security. However, its assembly-like syntax, implicit stack machine, and low-level data types make it extremely difficult for human developers to understand, spurring the need for effective WebAssembly reverse engineering techniques. In this paper, we propose StackSight, a novel neurosymbolic approach that combines Large Language Models (LLMs) with advanced program analysis to decompile complex WebAssembly code into readable C++ snippets. StackSight visualizes and tracks virtual stack alterations via a static analysis algorithm and then applies chain-of-thought prompting to harness LLM's complex reasoning capabilities. Evaluation results show that StackSight significantly improves WebAssembly decompilation. Our user study also demonstrates that code snippets generated by StackSight have significantly higher win rates and enable a better grasp of code semantics.

Figures (12)

• Figure 1: StackSight: The decompilation pipeline.
• Figure 2: A Running example for StackSight. (a) C++ source code in HumanEval-X dataset. (b) WebAssembly Text Format (WAT) code compiled with Emscripten and translated with WABT. (c) Annotated WAT code with our proposed static analysis tool capturing the virtual stack alterations, variable assignments, control flow, and branching statements. (d) Chain-of-Thought prompting by breaking decompilation into multiple phases. LLM is able to utilize stack annotations, make reasonable predictions, summarize function purposes, and decompile WAT code to high-level C++.
• Figure 3: Hallucination case study.
• Figure 4: Comparison of correct answer percentages.
• Figure 5: Comparison of similarity ratios.