dextk

Android dex file parser in Go

Features

• String, classes and code parsing
• Low memory usage
• Mmap support
• Designed to support stream processing (No requirement to load entire dex file into memory)

Example

go run ./cmd/example

package main

import (
	"fmt"
	"log"

	"github.com/csnewman/dextk"
	"golang.org/x/exp/mmap"
)

func main() {
	f, err := mmap.Open("classes.dex")
	if err != nil {
		log.Panicln(err)
	}

	defer f.Close()

	r, err := dextk.Read(f)
	if err != nil {
		log.Panicln(err)
	}

	ci := r.ClassIter()
	for ci.HasNext() {
		node, err := ci.Next()
		if err != nil {
			log.Panicln(err)
		}

		for _, method := range node.DirectMethods {
			fmt.Println(node.Name, ": ", method.Name)
			processMeth(r, method)
		}

		for _, method := range node.VirtualMethods {
			fmt.Println(node.Name, ": ", method.Name)
			processMeth(r, method)
		}
	}
}

func processMeth(r *dextk.Reader, m dextk.MethodNode) {
	if m.CodeOff == 0 {
		return
	}

	c, err := r.ReadCodeAndParse(m.CodeOff)
	if err != nil {
		log.Panic(err)
	}

	for _, o := range c.Ops {
		fmt.Println("  ", o)
	}
}

Output:

android/support/v4/app/INotificationSideChannel$_Parcel :  <init>
   invoke-direct method=java/lang/Object:<init>:([]):V args=[0]
   return-void value=-1
[...]
android/support/v4/app/INotificationSideChannel$_Parcel :  readTypedObject
   invoke-virtual method=android/os/Parcel:readInt:([]):I args=[1]
   move-result dst=0
   if-eqz a=0 b=-1 tgt=6
   invoke-interface method=android/os/Parcelable$Creator:createFromParcel:([Landroid/os/Parcel;]):Ljava/lang/Object; args=[2 1]
   move-result-object dst=0
   return-object value=0
   const/4 dst=0 value='0'
   return-object value=0
[...]