WASM反編譯，WASM逆向

騰訊安全中心的一個"碼上種樹"活動里遇到了一道題，用的是WebAssembly。
放一個測試的wasm地址：test.wasm

之前沒有接觸過，上網查了一下之后發現都是通過wabt(WebAssembly二進制工具包)中的wasm2c進行轉換:
在線轉換地址

轉換結果：

(module
  (type $t0 (func (param i32 i32) (result i32)))
  (import "Math" "min" (func $Math.min (type $t0)))
  (import "Math" "max" (func $Math.max (type $t0)))
  (func $Run (type $t0) (param $p0 i32) (param $p1 i32) (result i32)
    (local $l2 i32) (local $l3 i32) (local $l4 i32) (local $l5 i32) (local $l6 i32) (local $l7 i32)
    local.get $p0
    local.set $l2
    i32.const 10
    i32.const 1
    i32.sub
    local.tee $l4
    if $I0
      loop $L1
        local.get $l2
        local.set $l3
        i32.const 0
        local.set $l6
        i32.const 10
        local.set $l7
        loop $L2
          local.get $l3
          i32.const 10
          i32.rem_u
          local.set $l5
          local.get $l3
          i32.const 10
          i32.div_u
          local.set $l3
          local.get $l5
          local.get $l6
          call $Math.max
          local.set $l6
          local.get $l5
          local.get $l7
          call $Math.min
          local.set $l7
          local.get $l3
          i32.const 0
          i32.gt_u
          br_if $L2
        end
        local.get $l2
        local.get $l6
        local.get $l7
        i32.mul
        i32.add
        local.set $l2
        local.get $l4
        i32.const 1
        i32.sub
        local.tee $l4
        br_if $L1
      end
    end
    local.get $l2)
  (export "Run" (func $Run)))

用wasm2c轉換之后還是比較復雜，看了WebAssembly官方文檔之后發現了一個工具可以轉換成可讀性更好的偽代碼：
wasm-decompile

通過wabt工具庫編譯出的wasm-decomplie進行轉換，清晰多了

./wabt/bin/wasm-decompile test.wasm -o test.o

import function Math_min(a:int, b:int):int;
import function Math_max(a:int, b:int):int;
export function Run(a:int, b:int):int {
  var c:int = a;
  var e:int = b - 1;
  if (e) {
    loop L_b {
      var d:int = c;
      var g:int = 0;
      var h:int = 10;
      loop L_c {
        var f:int = d % 10;
        d = d / 10;
        g = Math_max(f, g);
        h = Math_min(f, h);
        if (d > 0) continue L_c;
      }
      c = c + g * h;
      e = e - 1;
      if (e) continue L_b;
    }
  }
  return c;
}