Document Open Access Logo

Wastrumentation: Portable WebAssembly Dynamic Analysis with Support for Intercession

Authors Aäron Munsters , Angel Luis Scull Pupo , Elisa Gonzalez Boix

PDF

File

Thumbnail PDF
PDF
LIPIcs.ECOOP.2025.23.pdf
  • Filesize: 1.51 MB
  • 29 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Software and its engineering → Object oriented frameworks
  • Software and its engineering → Dynamic analysis
  • Information systems → Web applications
  • Security and privacy → Information flow control
Keywords
  • WebAssembly
  • dynamic analysis
  • instrumentation platform
  • intercession

Metrics

  • Access Statistics
  • Total Accesses (updated on a weekly basis)
    0
    PDF Downloads
    0
    Metadata Views

Abstract

Dynamic program analyses help in understanding a program’s runtime behavior and detect issues related to security, program comprehension, or profiling. Instrumentation platforms aid analysis developers by offering a high-level API to write the analysis, and inserting the analysis into the target program. However, current instrumentation platforms for WebAssembly (Wasm) restrict analysis portability because they require concrete runtime environments. Moreover, their analysis API only allows the development of analyses that observe the target program but cannot modify it. As a result, many popular dynamic analyses present for other languages, such as runtime hardening, virtual patching or runtime optimization, cannot currently be implemented for Wasm atop a dynamic analysis platform. Instead, they need to be built manually, which requires knowledge of low-level details of the Wasm’s semantics and instruction set, and how to safely manipulate it.
This paper introduces Wastrumentation, the first dynamic analysis platform for WebAssembly that supports intercession. Our solution, based on source code instrumentation, weaves the analysis code directly into the target program code. Inlining the analysis into the target’s source code avoids dependencies on the runtime environment, making analyses portable across Wasm VMs. Moreover, it enables the implementation of analyses in any Wasm-compatible language. We evaluate our solution in two ways. First, we compare it against a state-of-the-art source code instrumentation platform using the WasmR3 benchmarks. The results show improved memory consumption and competitive performance overhead. Second, we develop an extensive portfolio of dynamic analyses, including novel analyses previously unattainable with source code instrumentation platforms, such as memoization, safe heap access, and the removal of NaN non-determinism.

Cite As Get BibTex

Aäron Munsters, Angel Luis Scull Pupo, and Elisa Gonzalez Boix. Wastrumentation: Portable WebAssembly Dynamic Analysis with Support for Intercession. In 39th European Conference on Object-Oriented Programming (ECOOP 2025). Leibniz International Proceedings in Informatics (LIPIcs), Volume 333, pp. 23:1-23:29, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2025) https://doi.org/10.4230/LIPIcs.ECOOP.2025.23

Author Details

Aäron Munsters
  • Vrije Universiteit Brussel, Brussels, Belgium
Angel Luis Scull Pupo
  • Vrije Universiteit Brussel, Brussels, Belgium
Elisa Gonzalez Boix
  • Vrije Universiteit Brussel, Brussels, Belgium

Funding

  • Munsters, Aäron: Funded by the Research Foundation Flanders, project number 1S53725N.
  • Scull Pupo, Angel Luis: Funded by the Cybersecurity Research Program Flanders (CRPF) from the Flemish Government.

References

  1. Doehyun Baek, Jakob Getz, Yusung Sim, Daniel Lehmann, Ben L. Titzer, Sukyoung Ryu, and Michael Pradel. Wasm-R3: Record-Reduce-Replay for Realistic and Standalone WebAssembly Benchmarks. Proc. ACM Program. Lang., 8(OOPSLA2):2156-2182, October 2024. URL: https://doi.org/10.1145/3689787.
  2. Iulia Bastys, Maximilian Algehed, Alexander Sjösten, and Andrei Sabelfeld. SecWasm: Information Flow Control for WebAssembly. In Gagandeep Singh and Caterina Urban, editors, Static Analysis - 29th International Symposium, SAS 2022, Auckland, New Zealand, December 5-7, 2022, Proceedings, volume 13790 of Lecture Notes in Computer Science, pages 74-103, Cham, 2022. Springer. URL: https://doi.org/10.1007/978-3-031-22308-2_5.
  3. Daniel G. Bobrow, Linda G. DeMichiel, Richard P. Gabriel, Sonya E. Keene, Gregor Kiczales, and David A. Moon. Common lisp object system specification X2JI3 document 88-002r. ACM SIGPLAN Notices, 23(SI):1.1-2.94, 1988. URL: https://doi.org/10.1145/885631.885632.
  4. Derek Bruening. Efficient, transparent, and comprehensive runtime code manipulation. PhD thesis, Massachusetts Institute of Technology, Cambridge, MA, USA, USA, 2004. AAI0807735. URL: https://hdl.handle.net/1721.1/30160.
  5. Shangtong Cao, Ningyu He, Yao Guo, and Haoyu Wang. BREWasm: A General Static Binary Rewriting Framework for WebAssembly. In Manuel V. Hermenegildo and José F. Morales, editors, Static Analysis - 30th International Symposium, SAS 2023, Cascais, Portugal, October 22-24, 2023, Proceedings, volume 14284 of Lecture Notes in Computer Science, pages 139-163, Cham, 2023. Springer. URL: https://doi.org/10.1007/978-3-031-44245-2_8.
  6. Laurent Christophe, Elisa Gonzalez Boix, Wolfgang De Meuter, and Coen De Roover. Linvail: A General-Purpose Platform for Shadow Execution of JavaScript. In 2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER), volume 1, pages 260-270. IEEE Computer Society, 2016. URL: https://doi.org/10.1109/SANER.2016.91.
  7. Michael L. Van de Vanter, Chris Seaton, Michael Haupt, Christian Humer, and Thomas Würthinger. Fast, Flexible, Polyglot Instrumentation Support for Debuggers and other Tools. Art Sci. Eng. Program., 2(3):14, March 2018. URL: https://doi.org/10.22152/programming-journal.org/2018/2/14.
  8. Aryaz Eghbali and Michael Pradel. DynaPyt: a dynamic analysis framework for Python. In Abhik Roychoudhury, Cristian Cadar, and Miryung Kim, editors, Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE 2022, pages 760-771. ACM, 2022. URL: https://doi.org/10.1145/3540250.3549126.
  9. William Fu, Raymond Lin, and Daniel Inge. TaintAssembly: Taint-Based Information Flow Control Tracking for WebAssembly. CoRR, abs/1802.01050, 2018. URL: https://doi.org/10.48550/arXiv.1802.01050.
  10. WebAssembly Group. Binaryen: Optimizer and compiler/toolchain library for WebAssembly, 2025. URL: https://github.com/WebAssembly/binaryen.
  11. WebAssembly Group. DeNaN.cpp. https://github.com/WebAssembly/binaryen/blob/8c0429ac09d06d6056687e36fd4fb37f61681233/src/passes/DeNaN.cpp#L44-L46, 2025.
  12. WebAssembly Group. Multi-Memory Proposal: Multiple per-module memories for Wasm. https://github.com/WebAssembly/multi-memory, 2025.
  13. Andreas Haas, Andreas Rossberg, Derek L. Schuff, Ben L. Titzer, Michael Holman, Dan Gohman, Luke Wagner, Alon Zakai, and J. F. Bastien. Bringing the web up to speed with WebAssembly. In Albert Cohen and Martin T. Vechev, editors, Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2017, pages 185-200, New York, NY, USA, 2017. ACM. URL: https://doi.org/10.1145/3062341.3062363.
  14. Shuyao Jiang, Ruiying Zeng, Zihao Rao, Jiazhen Gu, Yangfan Zhou, and Michael R. Lyu. Revealing Performance Issues in Server-Side WebAssembly Runtimes Via Differential Testing. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 661-672. IEEE, 2023. URL: https://doi.org/10.1109/ASE56229.2023.00088.
  15. Jacob Kreindl, Daniele Bonetta, David Leopoldseder, Lukas Stadler, and Hanspeter Mössenböck. Polyglot, Label-Defined Dynamic Taint Analysis in TruffleTaint. In Elisa Gonzalez Boix and Tobias Wrigstad, editors, Proceedings of the 19th International Conference on Managed Programming Languages and Runtimes, MPLR '22, pages 152-153, New York, NY, USA, 2022. ACM. URL: https://doi.org/10.1145/3546918.3560807.
  16. Jacob Kreindl, Daniele Bonetta, Lukas Stadler, David Leopoldseder, and Hanspeter Mössenböck. Low-overhead multi-language dynamic taint analysis on managed runtimes through speculative optimization. In Herbert Kuchen and Jeremy Singer, editors, Proceedings of the 18th ACM SIGPLAN International Conference on Managed Programming Languages and Runtimes, MPLR 2021, pages 70-87, New York, NY, USA, 2021. ACM. URL: https://doi.org/10.1145/3475738.3480939.
  17. Daniel Lehmann. Wasabi_Wasm. https://github.com/danleh/wasabi/tree/master/crates/wasabi_wasm, 2025.
  18. Daniel Lehmann, Johannes Kinder, and Michael Pradel. Everything Old is New Again: Binary Security of WebAssembly. In Srdjan Capkun and Franziska Roesner, editors, 29th USENIX Security Symposium (USENIX Security 20), pages 217-234. USENIX Association, August 2020. URL: https://doi.org/10.5555/3489212.3489225.
  19. Daniel Lehmann and Michael Pradel. Wasabi: A Framework for Dynamically Analyzing WebAssembly. In Iris Bahar, Maurice Herlihy, Emmett Witchel, and Alvin R. Lebeck, editors, Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '19, pages 1045-1058, New York, NY, USA, 2019. ACM. URL: https://doi.org/10.1145/3297858.3304068.
  20. Daniel Lehmann and Michael Pradel. Finding the Dwarf: Recovering Precise Types from WebAssembly Binaries. In Ranjit Jhala and Isil Dillig, editors, Proceedings of the 43rd ACM SIGPLAN International Conference on Programming Language Design and Implementation, PLDI 2022, pages 410-425. Association for Computing Machinery, 2022. URL: https://doi.org/10.1145/3519939.3523449.
  21. Zhibo Liu, Dongwei Xiao, Zongjie Li, Shuai Wang, and Wei Meng. Exploring Missed Optimizations in WebAssembly Optimizers. In René Just and Gordon Fraser, editors, Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, pages 436-448, New York, NY, USA, 2023. ACM. URL: https://doi.org/10.1145/3597926.3598068.
  22. Chi-Keung Luk, Robert S. Cohn, Robert Muth, Harish Patil, Artur Klauser, P. Geoffrey Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim M. Hazelwood. Pin: building customized program analysis tools with dynamic instrumentation. In Vivek Sarkar and Mary W. Hall, editors, Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI '05, pages 190-200, New York, NY, USA, 2005. ACM. URL: https://doi.org/10.1145/1065010.1065034.
  23. Quentin Michaud, Yohan Pipereau, Olivier Levillain, and Dhouha Ayed. Securing Stack Smashing Protection in WebAssembly Applications. CoRR, abs/2410.17925, 2024. URL: https://doi.org/10.48550/arXiv.2410.17925.
  24. Donald Michie. "Memo" functions and machine learning. Nature, 218(5136):19-22, April 1968. URL: https://doi.org/10.1038/218019a0.
  25. Aäron Munsters, Angel Luis Scull Pupo, and Elisa Gonzalez Boix. Wastrumentation: Portable WebAssembly Dynamic Analysis with Support for Intercession (Appendix), 2025. URL: https://soft.vub.ac.be/Publications/2025/vub-tr-soft-25-03.pdf.
  26. Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck. Thieves in the Browser: Web-based Cryptojacking in the Wild. In Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES '19, pages 4:1-4:10, New York, USA, 2019. ACM. URL: https://doi.org/10.1145/3339252.3339261.
  27. Shravan Narayan, Craig Disselkoen, Daniel Moghimi, Sunjay Cauligi, Evan Johnson, Zhao Gang, Anjo Vahldiek-Oberwagner, Ravi Sahita, Hovav Shacham, Dean M. Tullsen, and Deian Stefan. Swivel: Hardening WebAssembly against Spectre. In Michael D. Bailey and Rachel Greenstadt, editors, 30th USENIX Security Symposium (USENIX Security 21), pages 1433-1450. USENIX Association, August 2021. URL: https://www.usenix.org/conference/usenixsecurity21/presentation/narayan.
  28. Nicholas Nethercote and Julian Seward. Valgrind: a framework for heavyweight dynamic binary instrumentation. In Jeanne Ferrante and Kathryn S. McKinley, editors, Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI '07, pages 89-100, New York, NY, USA, 2007. ACM. URL: https://doi.org/10.1145/1250734.1250746.
  29. João Rodrigues and Jorge Barreiros. Aspect-Oriented Webassembly Transformation. In 2022 17th Iberian Conference on Information Systems and Technologies (CISTI), pages 1-6, 2022. URL: https://doi.org/10.23919/CISTI54924.2022.9820136.
  30. Alan Romano and Weihang Wang. WasmView: Visual Testing for WebAssembly Applications. In Gregg Rothermel and Doo-Hwan Bae, editors, 2020 IEEE/ACM 42nd International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), pages 13-16, Seoul, Korea (South), 2020. ACM. URL: https://doi.org/10.1145/3377812.3382155.
  31. Mike Rourke. Learn WebAssembly: Build web applications with native performance using Wasm and C/C++. Packt Publishing, 2018. Google Scholar
  32. Rust and WebAssembly community. Walrus. https://github.com/rustwasm/walrus, 2025.
  33. Koushik Sen, Swaroop Kalasapur, Tasneem G. Brutch, and Simon Gibbs. Jalangi: a selective record-replay and dynamic analysis framework for JavaScript. In Bertrand Meyer, Luciano Baresi, and Mira Mezini, editors, Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2013, pages 488-498. ACM, 2013. URL: https://doi.org/10.1145/2491411.2491447.
  34. Suhyeon Song, Seonghwan Park, and Donghyun Kwon. metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly. IEEE Access, 11:124887-124898, 2023. URL: https://doi.org/10.1109/ACCESS.2023.3327817.
  35. Haiyang Sun, Daniele Bonetta, Christian Humer, and Walter Binder. Efficient dynamic analysis for Node.js. In Christophe Dubach and Jingling Xue, editors, Proceedings of the 27th International Conference on Compiler Construction, CC '18, pages 196-206. ACM, 2018. URL: https://doi.org/10.1145/3178372.3179527.
  36. Aron Szanto, Timothy Tamm, and Artidoro Pagnoni. Taint Tracking for WebAssembly. CoRR, abs/1807.08349, 2018. URL: https://doi.org/10.48550/arXiv.1807.08349.
  37. Ben L. Titzer. Virgil: objects on the head of a pin. In Peri L. Tarr and William R. Cook, editors, Proceedings of the 21th Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA 2006, October 22-26, 2006, Portland, Oregon, USA, volume 41, pages 191-208. ACM, October 2006. URL: https://doi.org/10.1145/1167473.1167489.
  38. Ben L. Titzer, Elizabeth Gilbert, Bradley Wei Jie Teo, Yash Anand, Kazuyuki Takayama, and Heather Miller. Flexible Non-intrusive Dynamic Instrumentation for WebAssembly. In Rajiv Gupta, Nael B. Abu-Ghazaleh, Madan Musuvathi, and Dan Tsafrir, editors, Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3, ASPLOS '24, pages 398-415, New York, NY, USA, 2024. ACM. URL: https://doi.org/10.1145/3620666.3651338.
  39. Wenhao Wang, Benjamin Ferrell, Xiaoyang Xu, Kevin W. Hamlen, and Shuang Hao. SEISMIC: SEcure In-lined Script Monitors for Interrupting Cryptojacks. In Javier López, Jianying Zhou, and Miguel Soriano, editors, Computer Security, volume 11099 of Lecture Notes in Computer Science, pages 122-142, Cham, 2018. Springer. URL: https://doi.org/10.1007/978-3-319-98989-1_7.
  40. Christian Wimmer and Thomas Würthinger. Truffle: a self-optimizing runtime system. In Gary T. Leavens, editor, Proceedings of the 3rd Annual Conference on Systems, Programming, and Applications: Software for Humanity, SPLASH '12, pages 13-14, New York, NY, USA, 2012. ACM. URL: https://doi.org/10.1145/2384716.2384723.
  41. Thomas Würthinger, Christian Wimmer, Andreas Wöß, Lukas Stadler, Gilles Duboscq, Christian Humer, Gregor Richards, Doug Simon, and Mario Wolczko. One VM to rule them all. In Antony L. Hosking, Patrick Th. Eugster, and Robert Hirschfeld, editors, Proceedings of the 2013 ACM International Symposium on New Ideas, New Paradigms, and Reflections on Programming & Software, Onward! 2013, pages 187-204, New York, NY, USA, 2013. ACM. URL: https://doi.org/10.1145/2509578.2509581.
  42. Ziyao Zhang, Wenlong Zheng, Baojian Hua, Qiliang Fan, and Zhizhong Pan. VMCanary: Effective Memory Protection for WebAssembly via Virtual Machine-assisted Approach. In 2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security (QRS), pages 662-671. IEEE, 2023. URL: https://doi.org/10.1109/QRS60937.2023.00070.
  43. Wenxuan Zhao, Ruiying Zeng, and Yangfan Zhou. Wapplique: Testing WebAssembly Runtime via Execution Context-Aware Bytecode Mutation. In Maria Christakis and Michael Pradel, editors, Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2024, pages 1035-1047. ACM, 2024. URL: https://doi.org/10.1145/3650212.3680340.
Questions / Remarks / Feedback
X

Feedback for Dagstuhl Publishing


Thanks for your feedback!

Feedback submitted

Could not send message

Please try again later or send an E-mail
© 2023-2025 Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact