dextk

Android dex file parser in Go

Features

• String, classes and code parsing
• Low memory usage
• Mmap support
• Designed to support stream processing (No requirement to load entire dex file into memory)

Example

go run ./cmd/example

package main

import (
    "fmt"
    "log"

    "github.com/csnewman/dextk"
    "golang.org/x/exp/mmap"
)

func main() {
    f, err := mmap.Open("classes.dex")
    if err != nil {
        log.Panicln(err)
    }

    defer f.Close()

    r, err := dextk.Read(f)
    if err != nil {
        log.Panicln(err)
    }

    ci := r.ClassIter()
    for ci.HasNext() {
        node, err := ci.Next()
        if err != nil {
            log.Panicln(err)
        }

        for _, method := range node.DirectMethods {
            fmt.Println(node.Name, ": ", method.Name)
            processMeth(r, method)
        }

        for _, method := range node.VirtualMethods {
            fmt.Println(node.Name, ": ", method.Name)
            processMeth(r, method)
        }
    }
}

func processMeth(r *dextk.Reader, m dextk.MethodNode) {
    if m.CodeOff == 0 {
        return
    }

    c, err := r.ReadCodeAndParse(m.CodeOff)
    if err != nil {
        log.Panic(err)
    }

    for _, o := range c.Ops {
        fmt.Println("  ", o)
    }
}

Output:

android/support/v4/app/INotificationSideChannel$_Parcel :  <init>
   invoke-direct method=java/lang/Object:<init>:([]):V args=[0]
   return-void value=-1
[...]
android/support/v4/app/INotificationSideChannel$_Parcel :  readTypedObject
   invoke-virtual method=android/os/Parcel:readInt:([]):I args=[1]
   move-result dst=0
   if-eqz a=0 b=-1 tgt=6
   invoke-interface method=android/os/Parcelable$Creator:createFromParcel:([Landroid/os/Parcel;]):Ljava/lang/Object; args=[2 1]
   move-result-object dst=0
   return-object value=0
   const/4 dst=0 value='0'
   return-object value=0
[...]