WABT (pronounced “wabbit”) is the reference WebAssembly Binary Toolkit — a suite of command-line tools for working with wasm at a low level. It converts between the binary .wasm format and the human-readable .wat text format, disassembles and dumps modules, validates them, produces a C-like decompilation, and interprets/executes wasm. It is the foundational toolbox for both wasm development and reverse engineering.
Installation
| Platform | Command |
|---|
| macOS (Homebrew) | brew install wabt |
| Debian/Ubuntu | sudo apt install wabt |
| Arch Linux | sudo pacman -S wabt |
| npm | npm install -g wabt |
| From source | build with CMake from the WebAssembly/wabt repo |
| Verify | wat2wasm --version |
| Tool | Converts / does |
|---|
wat2wasm | Text .wat → binary .wasm |
wasm2wat | Binary .wasm → text .wat (disassemble) |
wasm-objdump | Dump sections, opcodes, symbols |
wasm-decompile | Produce readable C-like pseudocode |
wasm-validate | Validate a module |
wasm-interp | Interpret/run a module (stack machine) |
wasm2c | Convert wasm → C source |
wasm-strip | Remove sections (e.g. names) from a module |
Text ↔ Binary
# Assemble text to binary
wat2wasm module.wat -o module.wasm
# Disassemble binary to text (the RE starting point)
wasm2wat module.wasm -o module.wat
# Keep debug names / custom sections while disassembling
wasm2wat --generate-names module.wasm
| Option | Effect |
|---|
-o FILE | Output file |
--generate-names | Synthesize names for unnamed funcs/locals |
--enable-FEATURE | Turn on a wasm proposal (e.g. --enable-threads) |
-v | Verbose |
Inspecting a Module (objdump)
# Full section + disassembly dump
wasm-objdump -x module.wasm # headers/sections
wasm-objdump -d module.wasm # disassemble code
wasm-objdump -s module.wasm # section contents (hex)
| Flag | Shows |
|---|
-h | Section headers |
-x | Details of all sections |
-d | Disassembled function bodies |
-s | Raw section contents |
-j SECTION | Limit to one section |
Decompiling (Readable Output)
# C-like decompilation — much easier to read than WAT
wasm-decompile module.wasm -o module.dcmp
wasm-decompile reconstructs structured control flow and typed locals, making it a fast way to understand what a module does during triage.
Validate & Run
| Command | Purpose |
|---|
wasm-validate module.wasm | Confirm the module is well-formed |
wasm-interp module.wasm --run-all-exports | Execute exported functions |
wasm2c module.wasm -o module.c | Emit C for compilation/analysis |
Reverse-Engineering Workflow
# 1) Disassemble with names
wasm2wat --generate-names target.wasm -o target.wat
# 2) Dump imports/exports to understand capabilities
wasm-objdump -x target.wasm | grep -E "import|export"
# 3) Get readable pseudocode
wasm-decompile target.wasm -o target.dcmp
# 4) Hunt for strings/URLs in data sections
wasm-objdump -s target.wasm | less
Feature Flags (Proposals)
| Flag | Enables |
|---|
--enable-threads | Threads/atomics |
--enable-simd | SIMD |
--enable-bulk-memory | Bulk memory ops |
--enable-reference-types | Reference types |
--enable-all | All supported proposals |
Use these when a module uses newer wasm features and the default tools reject it.
| Tool | Role |
|---|
| WABT | Convert/inspect/validate/decompile wasm |
| diswasm | Higher-level pseudocode decompiler |
| wasm-tools | Rust low-level manipulation |
| Binaryen | Compiler/optimizer toolchain (wasm-dis, wasm-opt) |
Resources
