一句话：提出 WebAssembly 反编译框架 NotDec，通过跨过程类型恢复生成可读且语义一致的 C 代码。
WebAssembly 已被浏览器、容器、IoT 与无服务器平台广泛采用，审计其中隐藏的漏洞与恶意行为成为关键需求，但现有反编译工具存在结果冗长、可读性差、类型恢复能力有限的问题。本文提出 NotDec 反编译框架：扩展 WebAssembly 类型检查算法将字节码提升为基于 SSA 的 IR，采用跨过程类型恢复算法 Retypd 并结合指针与数值区分方法恢复复杂数据结构，再利用 Memory SSA 与保语义的结构化控制流分析输出可读、语义一致的 C 代码。在 5,241 个 Juliet 样本与全部 Howard 数据集程序上，NotDec 重编译成功率达 100%，远超 Ghidra 的 45.95%；在真实程序上恢复 85.33% 的结构体成员访问，而 Ghidra 仅为 9.24%。完整跨过程版本在大二进制上面临可扩展性挑战，过程内变体 NOTDEC_F 则效率更优，内存不足 Ghidra 一半、在未优化二进制上执行时间最多减少 97%。
With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low‑level bytecode standard, auditing its hidden vulnerabilities and malicious intentions has become critical. Decompiling existing WebAssembly modules can help security researchers and end users understand binary behavior, but current tools suffer from verbose result, poor readability, and limited type recovery. We present NotDec, an advanced WebAssembly decompilation framework. NotDec extends the WebAssembly type checking algorithm to lift bytecode into an SSA‑based IR, applies the inter-procedural type recovery algorithm Retypd with pointer and numeric value differentiation methods to recover complex data structures, and leverages Memory SSA alongside semantics‑preserving structured control‑flow analysis to emit readable, semantically consistent C code. NotDec achieves 100% recompilation success rate on all 5,241 Juliet samples and all Howard dataset programs, significantly outperforming baselines including Ghidra (45.95% success rate). On type recovery accuracy, NotDec recovers 85.33% of struct member accesses in real-world programs, vastly exceeding Ghidra’s 9.24%. While the full inter-procedural version faces scalability challenges on large binaries, the intra-procedural variant \({{\rm\small {NOTDEC}}}_F\) demonstrates superior efficiency, consuming less than half of Ghidra’s memory and up to 97% less execution time on unoptimized binaries.