skylot/jadx · error · JadxRuntimeException

Unexpected registers count in {}

Error message

Unexpected registers count in {}

What it means

Thrown by ArithNode.build when decoding a binary arithmetic instruction (e.g. add/sub/mul) whose register count is neither 2 (two-register form: v0 = v0 op v1) nor 3 (three-register form: v0 = v1 op v2). DEX arithmetic opcodes are defined with exactly these register layouts; any other count is malformed.

Source

Thrown at jadx-core/src/main/java/jadx/core/dex/instructions/ArithNode.java:26

import jadx.core.dex.instructions.args.InsnArg;
import jadx.core.dex.instructions.args.LiteralArg;
import jadx.core.dex.instructions.args.RegisterArg;
import jadx.core.dex.nodes.InsnNode;
import jadx.core.utils.InsnUtils;
import jadx.core.utils.exceptions.JadxRuntimeException;

public class ArithNode extends InsnNode {

	public static ArithNode build(InsnData insn, ArithOp op, ArgType type) {
		RegisterArg resArg = InsnArg.reg(insn, 0, fixResultType(op, type));
		ArgType argType = fixArgType(op, type);
		switch (insn.getRegsCount()) {
			case 2:
				return new ArithNode(op, resArg, InsnArg.reg(insn, 0, argType), InsnArg.reg(insn, 1, argType));
			case 3:
				return new ArithNode(op, resArg, InsnArg.reg(insn, 1, argType), InsnArg.reg(insn, 2, argType));
			default:
				throw new JadxRuntimeException("Unexpected registers count in " + insn);
		}
	}

	public static ArithNode buildLit(InsnData insn, ArithOp op, ArgType type) {
		RegisterArg resArg = InsnArg.reg(insn, 0, fixResultType(op, type));
		ArgType argType = fixArgType(op, type);
		LiteralArg litArg = InsnArg.lit(insn, argType);
		switch (insn.getRegsCount()) {
			case 1:
				return new ArithNode(op, resArg, InsnArg.reg(insn, 0, argType), litArg);
			case 2:
				return new ArithNode(op, resArg, InsnArg.reg(insn, 1, argType), litArg);
			default:
				throw new JadxRuntimeException("Unexpected registers count in " + insn);
		}
	}

	private static ArgType fixResultType(ArithOp op, ArgType type) {

View on GitHub (pinned to e738a26571)

Solutions

1. Validate the DEX is well-formed (run a verifier like dexdump / baksmali) before decompiling.
2. Log insn (printed in the message) to see the opcode and decoded registers; a wrong unit-size read is the usual culprit.
3. Update jadx; instruction decoding has many version-specific fixes.
4. Report the malformed DEX; if unavoidable, catch JadxRuntimeException at the method-decode boundary to skip the method.

Example fix

// before
switch (insn.getRegsCount()) {
    case 2: return new ArithNode(op, resArg, reg(0), reg(1));
    case 3: return new ArithNode(op, resArg, reg(1), reg(2));
    default: throw new JadxRuntimeException("Unexpected registers count in " + insn);
}

// after (decode boundary guard)
try {
    return ArithNode.build(insn, op, type);
} catch (JadxRuntimeException e) {
    LOG.warn("Skipping malformed arith insn in {}: {}", mth, insn);
    mth.add(AFlag.INCONSISTENT_CODE);
    return null;
}

int rc = insn.getRegsCount();
if (rc != 2 && rc != 3) {
    LOG.warn("Malformed arith instruction with regsCount={} in {}", rc, mth);
    mth.add(AFlag.INCONSISTENT_CODE);
}

static boolean isValidArithRegCount(int rc) {
    return rc == 2 || rc == 3;
}

try {
    insn = ArithNode.build(insn, op, type);
} catch (JadxRuntimeException e) {
    LOG.warn("Bad arith decode in {}: {}", mth, insn);
    mth.add(AFlag.INCONSISTENT_CODE);
    insn = null;
}

When it happens

Trigger: Decoding a Dalvik arithmetic instruction whose regsCount is 0, 1, or >3. Indicates a corrupt DEX, an instruction that was incorrectly decoded (wrong opcode/unit size), or a manually-crafted instruction stream.

Common situations: Corrupted/truncated DEX files; obfuscators that emit non-standard instruction encodings; bugs in the instruction reader that miscompute register count; mismatched DexBackedInstruction versions.

Related errors

• Unknown array element width: {}
• Unknown type: {}, expected: {}
• Unexpected visibility flag:
• Unknown visibility flags: {}
• Incorrect negative register number in instruction: {}

AI-assisted analysis of skylot/jadx@e738a26571 (2026-08-14). Data as JSON: /api/errors/015e9f32a1cb7fa4. Report an issue: GitHub.