Function x86_decode_traversal
pub fn x86_decode_traversal(
bytes: &[u8],
bitness: u32,
base_address: u64,
entry_offset: u64,
) -> Result<X86TraversalDecodeResult>Expand description
Decode x86/x64 bytes using recursive traversal (control-flow following).
Unlike linear disassembly, this approach follows control flow edges from the entry point, only decoding reachable code. This is more robust against:
- Junk bytes inserted between instructions
- Data embedded in code sections
- Overlapping instructions
- Anti-disassembly tricks
The algorithm uses a worklist to explore all reachable code paths, handling both conditional and unconditional branches. Indirect jumps are recorded but not followed (they would require runtime analysis to resolve).
§Arguments
bytes- The x86/x64 machine code bytesbitness- 32 for x86, 64 for x64base_address- The base address (RVA) of the code for computing jump targetsentry_offset- Offset withinbytesto start decoding from
§Returns
A X86TraversalDecodeResult containing:
- All decoded instructions sorted by offset
- Addresses that could not be resolved (external calls, indirect jumps)
- Whether indirect control flow was encountered
§Errors
Returns crate::Error::X86Error if:
bytesis emptybitnessis not 32 or 64
Note: Invalid instructions at unreachable addresses are silently skipped,
and unsupported instructions are recorded as X86Instruction::Unsupported.