{"record":{"id":"0d4f1c6537d2d9b5","repo":"gchq/CyberChef","slug":"no-valid-architecture-instructions-found-in-inp","errorCode":null,"errorMessage":"No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.","messagePattern":"No valid (.+?) instructions found in input\\. The bytes may be for a different architecture or mode\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DisassembleARM.mjs","lineNumber":156,"sourceCode":"        if (isWorkerEnvironment()) {\n            self.sendStatusMessage(\"Disassembling...\");\n        }\n\n        let disassembler;\n        try {\n            disassembler = new cs.Capstone(arch, modeValue);\n        } catch (e) {\n            throw new OperationError(`Failed to initialise Capstone disassembler: ${e}`);\n        }\n\n        let instructions;\n        try {\n            instructions = disassembler.disasm(bytes, startAddress);\n        } catch (e) {\n            disassembler.close();\n            // Check if it's a \"no valid instructions\" error (code 0 means OK but nothing decoded)\n            if (e && e.includes && e.includes(\"code 0:\")) {\n                throw new OperationError(`No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.`);\n            }\n            throw new OperationError(`Disassembly failed: ${e}`);\n        }\n\n        // Format output\n        const output = [];\n        for (const insn of instructions) {\n            let line = \"\";\n\n            if (showPosition) {\n                // Format address as hex with 0x prefix\n                const addrHex = \"0x\" + insn.address.toString(16).padStart(8, \"0\");\n                line += addrHex + \"  \";\n            }\n\n            if (showHex) {\n                // Format instruction bytes as hex\n                const bytesHex = insn.bytes.map(b => b.toString(16).padStart(2, \"0\")).join(\"\");","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DisassembleARM.mjs#L138-L174","documentation":"Thrown by Disassemble ARM run() inside the disasm catch when the capstone error string contains 'code 0:'. Capstone returns code 0 (CS_ERR_OK) but decodes zero instructions when the input bytes do not form any valid instruction for the chosen arch/mode - i.e. the bytes are garbage or belong to a different architecture. This is a more user-friendly re-wrap of that specific case.","triggerScenarios":"Feeding bytes that are not valid machine code for the selected Architecture/Mode: x86 bytes disassembled as ARM, random data, or bytes with the wrong endianness. disassembler.disasm() throws with a message containing 'code 0:' and this branch converts it.","commonSituations":"Wrong architecture selected (ARM vs ARM64); wrong endianness; the hex is not actually code (e.g. it is data, a compressed blob, or a different ISA); bytes extracted from the wrong section of a binary.","solutions":["Switch Architecture between ARM (32-bit) and ARM64 (AArch64) to match the source binary.","Toggle Endianness (ARM code is often little-endian, but some firmware is big-endian).","Try Mode = ARM vs Thumb (Thumb code disassembled as ARM looks invalid).","Verify the bytes are actually code and not data/compressed - run through a Detect File Type or entropy check."],"exampleFix":"// before - 64-bit code, 32-bit ARM selected\nArchitecture: ARM (32-bit), input: 64-bit ARM64 hex\n\n// after\nArchitecture: ARM64 (AArch64)","handlingStrategy":"validation","validationCode":"// heuristic: if first bytes do not look like plausible code for the arch, warn\nfunction looksPlausibleForArch(hexBytes, architecture) {\n    // not definitive; ARM instructions are 4 bytes; ARM64 also 4 bytes\n    const len = hexBytes.replace(/\\s/g, \"\").length;\n    return architecture.startsWith(\"ARM\") && len % 8 === 0;\n}","typeGuard":"/** @returns {boolean} */\nfunction isAlignedToInstructionWidth(hexBytes, architecture) {\n    const h = String(hexBytes).replace(/\\s/g, \"\");\n    if (!/^[0-9a-fA-F]*$/.test(h) || h.length % 2 !== 0) return false;\n    const bytes = h.length / 2;\n    return architecture.startsWith(\"ARM\") ? bytes % 4 === 0 : bytes % 4 === 0;\n}","tryCatchPattern":"try {\n    out = await disassembleArm.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && /No valid .* instructions found/.test(e.message)) {\n        // toggle architecture (ARM <-> ARM64) and endianness, then retry\n        args[0] = args[0] === \"ARM64 (AArch64)\" ? \"ARM (32-bit)\" : \"ARM64 (AArch64)\";\n        out = await disassembleArm.run(input, args);\n    } else throw e;\n}","preventionTips":["Match the Architecture to the source binary (ARM vs ARM64).","Try ARM vs Thumb mode when results are empty.","Verify endianness matches the firmware/code origin.","Confirm the bytes are code and not data/compressed (use Detect File Type / entropy)."],"tags":["disassembly","arm","capstone","architecture"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}