WebAssembly has gained significant traction as a high-performance, secure, and portable compilation target for the Web and beyond. However, its growing adoption has also introduced new security challenges. One such threat is cryptojacking, where websites mine cryptocurrencies on visitors' devices without their knowledge or consent, often through the use of WebAssembly. While detection methods have been proposed, research on circumventing them remains limited. In this paper, we present the most comprehensive evaluation of code obfuscation techniques for WebAssembly to date, assessing their effectiveness, detectability, and overhead across multiple abstraction levels. We obfuscate a diverse set of applications, including utilities, games, and crypto miners, using state-of-the-art obfuscation tools like Tigress and wasm-mutate, as well as our novel tool, emcc-obf. Our findings suggest that obfuscation can effectively produce dissimilar WebAssembly binaries, with Tigress proving most effective, followed by emcc-obf and wasm-mutate. The impact on the resulting native code is also significant, although the V8 engine's TurboFan optimizer can reduce native code size by 30\% on average. Notably, we find that obfuscation can successfully evade state-of-the-art cryptojacking detectors. Although obfuscation can introduce substantial performance overheads, we demonstrate how obfuscation can be used for evading detection with minimal overhead in real-world scenarios by strategically applying transformations. These insights are valuable for researchers, providing a foundation for developing more robust detection methods. Additionally, we make our dataset of over 20,000 obfuscated WebAssembly binaries and the emcc-obf tool publicly available to stimulate further research.

翻译：WebAssembly作为面向Web及其他场景的高性能、安全且可移植的编译目标已获得广泛采用。然而其普及也引来了新型安全挑战，其中加密货币挖矿劫持（cryptojacking）尤为突出——攻击者通过WebAssembly在用户设备上未经授权地挖掘加密货币。尽管已有检测方法被提出，但针对规避检测的研究仍相对匮乏。本文对WebAssembly代码混淆技术进行了迄今最全面的评估，从多个抽象层次衡量其有效性、可检测性与性能开销。我们采用Tigress、wasm-mutate等现有混淆工具及自研工具emcc-obf，对涵盖工具、游戏和加密矿工等多样化应用进行混淆处理。研究发现：混淆可有效生成异构WebAssembly二进制文件，其中Tigress效果最优，emcc-obf与wasm-mutate次之；混淆对生成的原生代码同样影响显著，尽管V8引擎的TurboFan优化器平均可缩减30%的原生代码体积。值得注意的是，混淆技术能成功规避当前最先进的挖矿劫持检测器。虽然混淆可能引入显著性能开销，但我们通过策略性应用变换展示了如何在真实场景中以最小开销实现检测规避。这些发现为研究人员构建更鲁棒的检测方法奠定了基础。此外，我们公开了包含超2万份混淆WebAssembly二进制文件的数据集及emcc-obf工具，以推动相关研究。