WebAssembly disassembler
Convert a .wasm module to readable WAT, list exports and imports, and follow the control flow.
Open in ctfpalWebAssembly reversing shows up in web challenges where the flag check was moved out of JavaScript to look harder. It is not harder - WASM is a stack machine with a text format that maps one-to-one onto the binary, so disassembly is lossless in a way native code never is.
Because the module carries its own type information and an explicit function table, you get names, signatures, and structure for free. The result reads much closer to a decompiled high-level language than to assembly, and for the size of module a web challenge ships, reading it end to end is entirely practical.
Where to start
- Exports - the functions JavaScript can call. The flag checker is one of them.
- Data section - constants and strings, frequently including the expected answer in plain sight.
- Comparison sequences -
i32.eqchains against constants are a character-by-character check you can read straight off.
Related tools
ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Java .class disassembler
Disassemble JVM bytecode, read the constant pool, and recover strings and logic from .class and .jar files.
Python .pyc bytecode disassembler
Disassemble compiled Python, read code objects and constants, and recover logic from a .pyc without running it.