idawasm

These IDA Pro plugins add support for loading and disassembling WebAssembly modules.

This version has been forked from fireeye/idawasm to enhance some features.

• IDA 7.4+ support
• add Python 3 type annotations (partially for now)
• support if, else, br_table operations

Features:

• control flow reconstruction and graph mode
• code and data cross references
• globals, function parameters, local variables, etc. can be renamed
• auto-comment hint support

recognizes WebAssembly modules

reconstructs control flow

parses and renders types

extracts code and data cross references

detect function frame layout (for LLVM-compiled binaries)

installation

There are three steps to install this loader and processor:

1. install the python module (i.e. idawasm):

    python.exe setup.py install

2. install the IDA loader and processor plugins (i.e. wasm_loader.py and wasm_proc.py):

    idawasm.exe

or, manually copy/move the Python script files to %IDADIR%:

    mv loaders\wasm_loader.py %IDADIR%\loaders\wasm_loader.py
    mv procs\wasm_proc.py %IDADIR%\procs\wasm_proc.py

Whenever you update this project, you'll need to update the python module, but shouldn't have to touch the loader and processor files.

supported IDA version

IDA 7.4+ and Python 3.8+

todo

• name locations
• mark data xref to memory load/store
• mark xref to imports
• compute stack deltas
• add entry point for start function (need to see an example)

acknowledgements

fireeye/idawasm - Original version of this repository.

This project relies on the athre0z/wasm WebAssembly decoder and disassembler library for Python.

copyright

• Willi Ballenthin (original author of idawasm)
• Takumi Akiyama