Skip to main content

x86_decode_traversal

Function x86_decode_traversal 

pub fn x86_decode_traversal(
    bytes: &[u8],
    bitness: u32,
    base_address: u64,
    entry_offset: u64,
) -> Result<X86TraversalDecodeResult>
Expand description

Decode x86/x64 bytes using recursive traversal (control-flow following).

Unlike linear disassembly, this approach follows control flow edges from the entry point, only decoding reachable code. This is more robust against:

  • Junk bytes inserted between instructions
  • Data embedded in code sections
  • Overlapping instructions
  • Anti-disassembly tricks

The algorithm uses a worklist to explore all reachable code paths, handling both conditional and unconditional branches. Indirect jumps are recorded but not followed (they would require runtime analysis to resolve).

§Arguments

  • bytes - The x86/x64 machine code bytes
  • bitness - 32 for x86, 64 for x64
  • base_address - The base address (RVA) of the code for computing jump targets
  • entry_offset - Offset within bytes to start decoding from

§Returns

A X86TraversalDecodeResult containing:

  • All decoded instructions sorted by offset
  • Addresses that could not be resolved (external calls, indirect jumps)
  • Whether indirect control flow was encountered

§Errors

Returns crate::Error::X86Error if:

  • bytes is empty
  • bitness is not 32 or 64

Note: Invalid instructions at unreachable addresses are silently skipped, and unsupported instructions are recorded as X86Instruction::Unsupported.