A Systematic LLM-Based Procedure for the Deobfuscation of WebAssembly: Benchmark and Security Evaluation
WebAssembly (Wasm) has emerged as a widely adopted compilation target for systems programming languages, offering near-native performance and portability across platforms. However, the increasing use of code obfuscation techniques in Wasm binaries poses significant challenges for program analysis, malware inspection, and reverse engineering. In this paper, we investigate the capability of large language models (LLMs) to perform automated Wasm deobfuscation. We first provide a conceptual formulation of Wasm deobfuscation as a semantic recovery problem under unknown and potentially non-invertible program transformations, which naturally leads to an underdetermined reconstruction task. Building on this formulation, we introduce a three-tier evaluation hierarchy for assessing deobfuscation quality, consisting of syntax correctness, execution validity, and semantic similarity. We also employ fuzzing based validation as an intermediate evaluation procedure between execution validity and semantic similarity. By generating diverse input cases and comparing the resulting behaviors of the original and reconstructed programs, fuzzing enables us to assess whether semantic preservation holds beyond a limited set of manually specified test cases. We further interpret prompt design as an experimental configuration and study how it induces different inductive biases over the latent semantic hypothesis space explored by LLMs during reconstruction. To empirically study these factors, we construct a structured evaluation framework spanning multiple programming languages, obfuscation stages, and transformation regimes. Experiments with four state-of-the-art LLMs under multiple prompting strategies demonstrate that syntax-aware prompting significantly improves reconstruction accuracy; in particular, for the best performing LLM on C, applying the mono-shot prompting strategy under single obfuscation yields improvements of 33.06%, 7.43%, and 0.13 in syntax, execution, and semantic(LLM) performance, respectively, while virtualization-based obfuscation exposes an identifiability gap that limits semantic recovery without interpreter-level knowledge. These results provide empirical evidence and a conceptual framework for analyzing LLM-assisted deobfuscation as an inverse semantic reconstruction problem under adversarial program transformations.