.wasm Tier 1 · Deep AST Parser

WebAssembly Binary Module

Portable, sandboxed stack-machine binary bytecode format (`\0asm` v1) structured as a sequence of LEB128-framed Type, Import, Function, Memory, Export, and Code sections.

Leading null byte `0x00` prevents accidental interpretation as UTF-8 text; section lengths use unsigned LEB128 variable-length integers so parsers skip massive Code sections in O(1).

MIME Types application/wasm

Byte Endianness little

Canonical Spec Official Specification ↗

0xFF

Drop any .wasm file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.wasm Magic Bytes & Header Offset Map

Offset: 0x00 (0 B) ASCII: .asm....

00 61 73 6D 01 00 00 00

'\0asm' magic + uint32_le binary version 1

Byte Offset	Length	Data Type	Field Name	Engineering Description
0x00 - 0x03	4 B	uint8[4]	magic	0x00 0x61 0x73 0x6D ('\0asm')
0x04 - 0x07	4 B	uint32_le	version	Binary format version (1)
0x08+	var	u8+leb128	sections	Section ID (0..12) + LEB128 byte length + payload

Upload Gateway & AppSec Advisory

.wasm Security & Polyglot Risk Matrix

Risk Level: medium

Arbitrary Code / Macros

YES (Active Risk)

Pickle Deserialization

SAFE (No Pickle VM)

XML External Entity (XXE)

NONE

Polyglot Prepend Risk

LOW (Strict 0x00 Magic)

Backend Upload Validation Recommendation

Audit the Import section (id=2) before instantiating untrusted .wasm plugins to verify they only bind approved WASI/host capabilities, and enforce fuel/epoch CPU limits.

Compiler-Verified Reference Code

Read .wasm Header & Metadata Without Heavy Dependencies

✓ Zero-Dependency .wasm Header Reader

import struct, sys
with open(sys.argv[1], "rb") as f:
    magic, ver = struct.unpack("<4sI", f.read(8))
    assert magic == b"\x00asm" and ver == 1
    print(f"Valid WebAssembly binary v{ver}")

CI/CD & Unit Test Fixtures

Deterministic .wasm Sample Files & Edge Cases

Open Full .wasm Sample Matrix & Mutator →

minimalexpect: valid

minimal-add.wasm

41-byte valid WASM v1 binary exporting `add(i32, i32) -> i32`, directly instantiable via `WebAssembly.instantiate()`.

↓ Download (41 B)

SHA-256: f61fd62f57c41269c3c23f360eeaf1090b1db9c38651106674d48bc65dba88ba

Exact: 41 bytes

curl -fsSL https://fileformat.co/fixtures/v1/wasm/minimal-add.wasm -o minimal-add.wasm \
  && echo "f61fd62f57c41269c3c23f360eeaf1090b1db9c38651106674d48bc65dba88ba  minimal-add.wasm" | shasum -a 256 -c

realisticexpect: valid

env-import-memory.wasm

Contains Type, Import, Function, Memory, Export, and Code sections for symbol scanner tests.

↓ Download (80 B)

SHA-256: f6462abef751b355d056c266a6e5d376afb018bd445477af9d9df333fa0f4f47

Exact: 80 bytes

curl -fsSL https://fileformat.co/fixtures/v1/wasm/env-import-memory.wasm -o env-import-memory.wasm \
  && echo "f6462abef751b355d056c266a6e5d376afb018bd445477af9d9df333fa0f4f47  env-import-memory.wasm" | shasum -a 256 -c

edge-caseTruncated Code Sectionexpect: parser_error

truncated-code-section.wasm

WASM binary whose Code section LEB128 byte length exceeds remaining file bytes.

↓ Download (75 B)

SHA-256: a43778279d60ece37b28759e01fc505e73e18e6274db914e148bd8bfdd8b295d

Exact: 75 bytes

curl -fsSL https://fileformat.co/fixtures/v1/wasm/truncated-code-section.wasm -o truncated-code-section.wasm \
  && echo "a43778279d60ece37b28759e01fc505e73e18e6274db914e148bd8bfdd8b295d  truncated-code-section.wasm" | shasum -a 256 -c

Related Specifications & Alternatives

.ipa little

iOS IPA

ZIP-compressed iOS/iPadOS application distribution archive structured around `Payload/<AppName>.app/Info.plist` (`bplist00`) and Mach-O ARM64 binaries.

.aab little

Android AAB

Google Play publishing format packaging `BundleConfig.pb`, Protocol-Buffer encoded `base/manifest/AndroidManifest.xml`, and DEX bytecode inside a modular ZIP container.

.onnx little

ONNX

Cross-framework Protocol Buffers computation graph and weight format used by ONNX Runtime, TensorRT, and CoreML converters.