{"record":{"id":"60bf99d1d70cd242","repo":"gchq/CyberChef","slug":"failed-to-initialise-capstone-disassembler-e","errorCode":null,"errorMessage":"Failed to initialise Capstone disassembler: ${e}","messagePattern":"Failed to initialise Capstone disassembler: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DisassembleARM.mjs","lineNumber":146,"sourceCode":"        } else {\n            // ARM64 only has one mode (ARM mode is default for ARM64)\n            modeValue = cs.MODE_ARM;\n        }\n\n        // Add endianness\n        if (endianness === \"Big Endian\") {\n            modeValue |= cs.MODE_BIG_ENDIAN;\n        }\n\n        if (isWorkerEnvironment()) {\n            self.sendStatusMessage(\"Disassembling...\");\n        }\n\n        let disassembler;\n        try {\n            disassembler = new cs.Capstone(arch, modeValue);\n        } catch (e) {\n            throw new OperationError(`Failed to initialise Capstone disassembler: ${e}`);\n        }\n\n        let instructions;\n        try {\n            instructions = disassembler.disasm(bytes, startAddress);\n        } catch (e) {\n            disassembler.close();\n            // Check if it's a \"no valid instructions\" error (code 0 means OK but nothing decoded)\n            if (e && e.includes && e.includes(\"code 0:\")) {\n                throw new OperationError(`No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.`);\n            }\n            throw new OperationError(`Disassembly failed: ${e}`);\n        }\n\n        // Format output\n        const output = [];\n        for (const insn of instructions) {\n            let line = \"\";","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DisassembleARM.mjs#L128-L164","documentation":"Thrown by Disassemble ARM run() when `new cs.Capstone(arch, modeValue)` raises during construction. Capstone (via @alexaltea/capstone-js, a WASM binding) throws if the architecture/mode combination is unsupported, if the WASM module failed to load, or if the underlying cs_open returned an error. The original exception is stringified into the message.","triggerScenarios":"An invalid arch/mode pairing passed to cs.Capstone; the WASM module not initialised (e.g. in an environment without WASM support); a mode bitmask combination Capstone rejects. Because the operation builds modeValue from the Architecture/Mode/Endianness args, an inconsistent combination (e.g. a Thumb mode flag combined with ARM64 arch) can reach here.","commonSituations":"Running in a worker/host without WASM; an architecture+mode combo the binding does not support (the code forces ARM64 to MODE_ARM so Thumb+ARM64 is prevented, but other combos may slip through); a corrupted or partial capstone-js bundle; memory/resource limits in the WASM runtime.","solutions":["Try a different Architecture/Mode/Endianness combination (e.g. ARM (32-bit) + ARM instead of an exotic combo).","Confirm the runtime supports WASM and the capstone bundle loaded (check the worker console for load errors).","If the error is environment-related, run in the main thread or a WASM-capable browser.","Update/reinstall the @alexaltea/capstone-js dependency if the bundle is corrupted."],"exampleFix":"// before - exotic combo\nArchitecture: ARM64 (AArch64), Mode: Thumb + Cortex-M  // overridden to MODE_ARM but may still misbehave\n\n// after - consistent combo\nArchitecture: ARM (32-bit), Mode: Thumb","handlingStrategy":"try-catch","validationCode":"// cannot fully validate capstone init without constructing it; sanity-check combos instead\nfunction isPlausibleArmCombo(architecture, mode) {\n    if (architecture === \"ARM64 (AArch64)\") return mode === \"ARM\" || mode === undefined; // code forces MODE_ARM\n    return [\"ARM\", \"Thumb\", \"Thumb + Cortex-M\", \"ARMv8\"].includes(mode);\n}","typeGuard":"/** @returns {boolean} */\nfunction isPlausibleArmCombo(architecture, mode) {\n    if (architecture === \"ARM64 (AArch64)\") return true; // forced to MODE_ARM\n    return [\"ARM\", \"Thumb\", \"Thumb + Cortex-M\", \"ARMv8\"].includes(mode);\n}","tryCatchPattern":"try {\n    out = await disassembleArm.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && /Failed to initialise Capstone/.test(e.message)) {\n        // retry with a known-good Architecture/Mode/Endianness, or report WASM init failure\n        args[1] = \"ARM\";\n        out = await disassembleArm.run(input, args);\n    } else throw e;\n}","preventionTips":["Run CyberChef in a WASM-capable environment (modern browser/Node).","Use consistent Architecture+Mode+Endianness combinations.","Check the worker console for capstone-js/WASM load errors.","Keep @alexaltea/capstone-js updated if the bundle is suspect."],"tags":["disassembly","arm","capstone","wasm"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}