In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers:
The Linear Sweep technique starts from the first byte of the code and disassembles one instruction at a time until the end. [...]
The Recursive Traversal technique relies on the control flow of the program and decodes the bytes by following the control flow of the program. [...]
Afterwards, the author introduces distorm and he makes the following statement:
Both techniques have some deficiencies. To overcome these deficiencies a good disassembler would combine both techniques. One such open source disassembler, for non-commercial use, is distorm.
After reading the docs of distorm, I'm not able to confirm this last statement. In my opinion, distorm seems to work like a classic Linear-Sweep version, and also will struggle with fake instructions and obfuscation (see 1). It calls itself "stream disassembler", where I was not able to fully clarify this expression.
With these facts, I have two questions:
Is distorm really a combination of linear sweep and recursive traversal as mentioned by the author?
What is your formal understanding of a "stream disassembler"?
0 Page 47 in Alam, Shahid, et al. "A framework for metamorphic malware analysis and real-time detection." computers & security 48 (2015): 212-233.