Disassemble ARM

Category: Shellcode

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: string → string

Background: https://wikipedia.org/wiki/ARM_architecture_family

What it does

Disassembles ARM machine code into assembly language. Supports ARM (32-bit), Thumb, and ARM64 (AArch64) architectures using the Capstone disassembly framework. Input should be in hexadecimal.

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Warning

This operation currently implements a documented compatibility subset.

Arguments and options

Arguments are positional. Keep their order when using bake() or Pipeline.then().

Index	Name	UI type	PyChef default	Accepted values / format
`0`	Architecture	`option`	`'ARM (32-bit)'`	`'ARM (32-bit)'`, `'ARM64 (AArch64)'`
`1`	Mode	`option`	`'ARM'`	`'ARM'`, `'Thumb'`, `'Thumb + Cortex-M'`, `'ARMv8'`
`2`	Endianness	`option`	`'Little Endian'`	`'Little Endian'`, `'Big Endian'`
`3`	Starting address (hex)	`number`	`0`	A Python integer or floating-point value
`4`	Show instruction hex	`boolean`	`True`	`True` or `False`
`5`	Show instruction position	`boolean`	`True`	`True` or `False`

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = "example"
args = ['ARM (32-bit)', 'ARM', 'Little Endian', 0, True, True]
result = bake(input_value, [{"op": 'Disassemble ARM', "args": args}])
print(result)

Pipeline example

from pychef import Pipeline

args = ['ARM (32-bit)', 'ARM', 'Little Endian', 0, True, True]
transform = Pipeline().then('Disassemble ARM', *args)
result = transform("example")

Direct call

pychef.ops.run_operation runs any registered operation as a plain function, under the active ExecutionPolicy (safe defaults, no network):

from pychef.ops import run_operation

args = ['ARM (32-bit)', 'ARM', 'Little Endian', 0, True, True]
result = run_operation('Disassemble ARM', "example", args=args)

Common operations also have typed helpers in Direct operations.

Low-level operation module

Warning

The module below is an internal implementation detail. It applies no execution policy, resource limits, or error sanitization; prefer bake(), Pipeline, or pychef.ops for application code.

The registered entry point lives in pychef.operations.by_operation.disassemble_arm. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.disassemble_arm import run

result = run("example", tuple(['ARM (32-bit)', 'ARM', 'Little Endian', 0, True, True]))

pychef.operations.by_operation.disassemble_arm.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes