WebAssembly is a recent web standard designed to provide a portable execution environment. As of the time of writing, more than 40 languages support WebAssembly as a compilation target. Initially targeted at running inside Web browsers, WebAssembly can nowadays be run in a multitude of runtimes targeting various usages, ranging from cloud applications to IoT devices.

Tooling for WebAssembly is gaining traction. The WebAssembly website lists a number of mature tools for compiler writers. The research community has produced tools to perform dynamic analysis of WebAssembly and to fuzz implementations of WebAssembly. In terms of static analysis, there exists a simple prototype plugin for IDA Pro to load WebAssembly modules, as well as a code size profiler that is able to construct call graphs. However, both of these tools are not in active development.

In this presentation, we will present our work on Wassail, a static analysis library for WebAssembly. Our goal is to facilitate the development of various static analyses for WebAssembly, by providing a set of useful building blocks from which analyses can be constructed. We aim to support both lightweight static analyses such as code querying, as well as heavyweight static analyses such as dataflow analyses. Wassail is still in an early development phase and we are interested in feedback from the community to steer its future development.