gchq/CyberChef · error · OperationError

Failed to initialise Capstone disassembler: ${e}

Error message

Failed to initialise Capstone disassembler: ${e}

What it means

Thrown by Disassemble ARM run() when `new cs.Capstone(arch, modeValue)` raises during construction. Capstone (via @alexaltea/capstone-js, a WASM binding) throws if the architecture/mode combination is unsupported, if the WASM module failed to load, or if the underlying cs_open returned an error. The original exception is stringified into the message.

Source

Thrown at src/core/operations/DisassembleARM.mjs:146

        } else {
            // ARM64 only has one mode (ARM mode is default for ARM64)
            modeValue = cs.MODE_ARM;
        }

        // Add endianness
        if (endianness === "Big Endian") {
            modeValue |= cs.MODE_BIG_ENDIAN;
        }

        if (isWorkerEnvironment()) {
            self.sendStatusMessage("Disassembling...");
        }

        let disassembler;
        try {
            disassembler = new cs.Capstone(arch, modeValue);
        } catch (e) {
            throw new OperationError(`Failed to initialise Capstone disassembler: ${e}`);
        }

        let instructions;
        try {
            instructions = disassembler.disasm(bytes, startAddress);
        } catch (e) {
            disassembler.close();
            // Check if it's a "no valid instructions" error (code 0 means OK but nothing decoded)
            if (e && e.includes && e.includes("code 0:")) {
                throw new OperationError(`No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.`);
            }
            throw new OperationError(`Disassembly failed: ${e}`);
        }

        // Format output
        const output = [];
        for (const insn of instructions) {
            let line = "";

View on GitHub (pinned to 4290ea7539)

Solutions

1. Try a different Architecture/Mode/Endianness combination (e.g. ARM (32-bit) + ARM instead of an exotic combo).
2. Confirm the runtime supports WASM and the capstone bundle loaded (check the worker console for load errors).
3. If the error is environment-related, run in the main thread or a WASM-capable browser.
4. Update/reinstall the @alexaltea/capstone-js dependency if the bundle is corrupted.

Example fix

// before - exotic combo
Architecture: ARM64 (AArch64), Mode: Thumb + Cortex-M  // overridden to MODE_ARM but may still misbehave

// after - consistent combo
Architecture: ARM (32-bit), Mode: Thumb

// cannot fully validate capstone init without constructing it; sanity-check combos instead
function isPlausibleArmCombo(architecture, mode) {
    if (architecture === "ARM64 (AArch64)") return mode === "ARM" || mode === undefined; // code forces MODE_ARM
    return ["ARM", "Thumb", "Thumb + Cortex-M", "ARMv8"].includes(mode);
}

/** @returns {boolean} */
function isPlausibleArmCombo(architecture, mode) {
    if (architecture === "ARM64 (AArch64)") return true; // forced to MODE_ARM
    return ["ARM", "Thumb", "Thumb + Cortex-M", "ARMv8"].includes(mode);
}

try {
    out = await disassembleArm.run(input, args);
} catch (e) {
    if (e instanceof OperationError && /Failed to initialise Capstone/.test(e.message)) {
        // retry with a known-good Architecture/Mode/Endianness, or report WASM init failure
        args[1] = "ARM";
        out = await disassembleArm.run(input, args);
    } else throw e;
}

When it happens

Trigger: An invalid arch/mode pairing passed to cs.Capstone; the WASM module not initialised (e.g. in an environment without WASM support); a mode bitmask combination Capstone rejects. Because the operation builds modeValue from the Architecture/Mode/Endianness args, an inconsistent combination (e.g. a Thumb mode flag combined with ARM64 arch) can reach here.

Common situations: Running in a worker/host without WASM; an architecture+mode combo the binding does not support (the code forces ARM64 to MODE_ARM so Thumb+ARM64 is prevented, but other combos may slip through); a corrupted or partial capstone-js bundle; memory/resource limits in the WASM runtime.

Related errors

• No valid ${architecture} instructions found in input. The by
• Disassembly failed: ${e}
• Invalid hexadecimal input. Please provide valid hex characte
• Invalid hexadecimal input. Length must be even.
• Invalid mode value

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/60bf99d1d70cd242. Report an issue: GitHub.