pxb1988/dex2jar · error · BadOpException

jump out of insns -> %04x

Error message

jump out of insns %s -> %04x

What it means

BadOpException thrown during code traversal when a kFmt10t (10-bit) branch instruction computes a jump target that is negative or beyond the end of the insns array. Such a target cannot be labeled, so the bytecode is deemed malformed.

Solutions

1. Disassemble the method with baksmali to inspect the branching instruction
2. Rebuild the dex with dx/d8 to regenerate valid branch offsets
3. Update d2j; some versions fixed off-by-one boundary checks
4. Catch BadOpException around accept() to skip the broken method

// Caller-side sanity check on code item size before traversal
if (codeItem.insns == null || codeItem.insns.length == 0) throw new IllegalStateException("empty insns");

try {
    reader.accept(dmv);
} catch (DexException e) {
    if (e.getCause() instanceof BadOpException) log.warn("bad branch target, method skipped");
}

When it happens

Trigger: Opcode walker hits a kFmt10t op whose signed byte displacement makes target = offset + insns[u1offset+1] satisfy target < 0 || target*2 > insns.length.

Common situations: Corrupted or truncated dex code items, junk-injected obfuscated bytecode, or dexes patched by tools that don't fix up branch displacements.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• Encountered RESTART_LOCAL on new v
• while accept parameter annotation in method
• while accept code in method
• While accepting parameter annotation in parameter
• zero-width instruction op=0x%02x

AI-assisted analysis of pxb1988/dex2jar@b5bda4fb49 (2026-09-08). Data as JSON: /api/errors/7eb2ad95bc3c35b1. Report an issue: GitHub.

Appendix: source

Thrown at dex-reader/src/main/java/com/googlecode/d2j/reader/DexFileReader.java:1163

    private void travelInsn(Map<Integer, DexLabel> labelsMap, Queue<Integer> q, byte[] insns, int offset) {
        int u1offset = offset * 2;
        if (u1offset >= insns.length) {
            throw new IndexOutOfBoundsException();
        }
        int opcode = 0xFF & insns[u1offset];
        Op op = Op.ops[opcode];
        if (op == null || op.format == null) {
            throw new BadOpException("zero-width instruction op=0x%02x", opcode);
        }
        int target;
        boolean canContinue = true;
        if (op.canBranch()) {
            switch (op.format) {
            case kFmt10t:
                target = offset + insns[u1offset + 1];
                if (target < 0 || target * 2 > insns.length ) {
                    throw new BadOpException("jump out of insns %s -> %04x", op, target);
                }
                q.add(target);
                order(labelsMap, target);
                break;
            case kFmt20t:
            case kFmt21t:
                target = offset + sshort(insns, u1offset + 2);
                if (target < 0 || target * 2 > insns.length ) {
                    throw new BadOpException("jump out of insns %s -> %04x", op, target);
                }
                q.add(target);
                order(labelsMap, target);
                break;
            case kFmt22t:
                target = offset + sshort(insns, u1offset + 2);

                int u = ubyte(insns, u1offset + 1);
                boolean cmpSameReg = (u & 0x0F) == ((u >> 4) & 0x0F);

View on GitHub (pinned to b5bda4fb49)