gchq/CyberChef · error · OperationError

No valid ${architecture} instructions found in input. The by

Error message

No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.

What it means

Thrown by Disassemble ARM run() inside the disasm catch when the capstone error string contains 'code 0:'. Capstone returns code 0 (CS_ERR_OK) but decodes zero instructions when the input bytes do not form any valid instruction for the chosen arch/mode - i.e. the bytes are garbage or belong to a different architecture. This is a more user-friendly re-wrap of that specific case.

Source

Thrown at src/core/operations/DisassembleARM.mjs:156

        if (isWorkerEnvironment()) {
            self.sendStatusMessage("Disassembling...");
        }

        let disassembler;
        try {
            disassembler = new cs.Capstone(arch, modeValue);
        } catch (e) {
            throw new OperationError(`Failed to initialise Capstone disassembler: ${e}`);
        }

        let instructions;
        try {
            instructions = disassembler.disasm(bytes, startAddress);
        } catch (e) {
            disassembler.close();
            // Check if it's a "no valid instructions" error (code 0 means OK but nothing decoded)
            if (e && e.includes && e.includes("code 0:")) {
                throw new OperationError(`No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.`);
            }
            throw new OperationError(`Disassembly failed: ${e}`);
        }

        // Format output
        const output = [];
        for (const insn of instructions) {
            let line = "";

            if (showPosition) {
                // Format address as hex with 0x prefix
                const addrHex = "0x" + insn.address.toString(16).padStart(8, "0");
                line += addrHex + "  ";
            }

            if (showHex) {
                // Format instruction bytes as hex
                const bytesHex = insn.bytes.map(b => b.toString(16).padStart(2, "0")).join("");

View on GitHub (pinned to 4290ea7539)

Solutions

1. Switch Architecture between ARM (32-bit) and ARM64 (AArch64) to match the source binary.
2. Toggle Endianness (ARM code is often little-endian, but some firmware is big-endian).
3. Try Mode = ARM vs Thumb (Thumb code disassembled as ARM looks invalid).
4. Verify the bytes are actually code and not data/compressed - run through a Detect File Type or entropy check.

Example fix

// before - 64-bit code, 32-bit ARM selected
Architecture: ARM (32-bit), input: 64-bit ARM64 hex

// after
Architecture: ARM64 (AArch64)

// heuristic: if first bytes do not look like plausible code for the arch, warn
function looksPlausibleForArch(hexBytes, architecture) {
    // not definitive; ARM instructions are 4 bytes; ARM64 also 4 bytes
    const len = hexBytes.replace(/\s/g, "").length;
    return architecture.startsWith("ARM") && len % 8 === 0;
}

/** @returns {boolean} */
function isAlignedToInstructionWidth(hexBytes, architecture) {
    const h = String(hexBytes).replace(/\s/g, "");
    if (!/^[0-9a-fA-F]*$/.test(h) || h.length % 2 !== 0) return false;
    const bytes = h.length / 2;
    return architecture.startsWith("ARM") ? bytes % 4 === 0 : bytes % 4 === 0;
}

try {
    out = await disassembleArm.run(input, args);
} catch (e) {
    if (e instanceof OperationError && /No valid .* instructions found/.test(e.message)) {
        // toggle architecture (ARM <-> ARM64) and endianness, then retry
        args[0] = args[0] === "ARM64 (AArch64)" ? "ARM (32-bit)" : "ARM64 (AArch64)";
        out = await disassembleArm.run(input, args);
    } else throw e;
}

When it happens

Trigger: Feeding bytes that are not valid machine code for the selected Architecture/Mode: x86 bytes disassembled as ARM, random data, or bytes with the wrong endianness. disassembler.disasm() throws with a message containing 'code 0:' and this branch converts it.

Common situations: Wrong architecture selected (ARM vs ARM64); wrong endianness; the hex is not actually code (e.g. it is data, a compressed blob, or a different ISA); bytes extracted from the wrong section of a binary.

Related errors

• Failed to initialise Capstone disassembler: ${e}
• Disassembly failed: ${e}
• Invalid hexadecimal input. Please provide valid hex characte
• Invalid hexadecimal input. Length must be even.
• Invalid mode value

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/0d4f1c6537d2d9b5. Report an issue: GitHub.