Droid ASC: On-demand APK decompilation accelerated by R8 layouts
A decompiler front-end for mobile researchers analyzing large Android APKs on demand, without full inflation or global indexing first.
GitHub MG1937/ASC Updated 2026-09-16 Branch main Stars 1.2K Forks 196
Python C Android APK R8 DEX Mobile reverse engineering

🧭 Decision Guide

Try it if you

  • You need to analyze a large Android APK with multiple DEX files and find method or field references across DEX files.
    The README CLI section states that findrefs searches strings, types, methods, and fields across “all DEX entries in APK”.
  • You care about low-memory, on-demand decompilation performance on a 352MB APK.
    The README Benchmark section reports 1.79 seconds for global cross-reference search, 177 milliseconds for target-class decompilation, and 141MB of RAM on a 352MB commercial APK.
  • You need to extract one class, a Manifest, or code references directly from an APK.
    The README Install section provides the getclass, getmanifest, and findrefs subcommands.

Skip it if you

  • You need a stable published version or an explicit release history.
    Project metadata reports 0 releases and the latest version as “No releases”.
  • You need to select a tool based on multiple APKs, Android versions, or compression scenarios.
    The README provides only one 352MB commercial APK benchmark and no broader test matrix.
  • You depend on a complete prebuilt global index or a persistent cross-reference database.
    The README explicitly chooses “zero preprocessing” and queries the compiled artifact as a read-only database on demand.

Requirements

  • Install from PyPI: pip install droidasc
  • Or install from source: pip install .
  • Installation provides the global droidasc CLI command.
  • The README also states that python main.py can be used and delegates to the same entry point.

First step (verbatim from README)

pip install droidasc

Watch out

  • The getclass examples use both Lcom/poc/Main; and com.poc.Main class-name formats.
    The README CLI examples show both droidasc getclass app.apk Lcom/poc/Main; and droidasc getclass app.apk com.poc.Main.
  • Do not generalize large-APK performance beyond the 352MB Benchmark.
    The README provides only the 1.79-second, 177-millisecond, and 141MB figures for a 352MB commercial APK.
  • Fuzzy class matching for findrefs requires the explicit --fuzzy-class option.
    The README example for method notify uses --class MainActivity --fuzzy-class.

Alternatives

  • Standard Android decompiler:When you need the full inflate, global indexing, and cross-reference preprocessing workflow criticized in the README, a standard tool matches that operating model better.
    README body

Not stated in the README

  • The README does not specify supported Python versions, operating systems, or C-component build requirements.
  • The README does not identify the exact decompilation backend or its version.
  • The README does not state compatibility with obfuscated APKs, unusual DEX files, or compression formats.
  • The README provides no performance data beyond 352MB and does not clarify whether the 141MB figure includes all process overhead.
  • The README does not describe Java output fidelity, failure handling, or error codes for getclass.
  • The README does not define the feature scope of GUI mode; it only shows droidasc app.apk --gui.

💡 Deep Analysis

6
No I need to analyze a non-R8 APK and verify the runtime behavior of dynamically loaded code. Our current workflow relies on full extraction, global cross-references, and a traditional decompiler; can ASC replace it completely?
For: A mobile security team member maintaining a traditional full-decompilation workflow and analyzing non-R8 builds or dynamic-loading logic

No, not as a complete replacement. ASC focuses on on-demand static lookup and local decompilation, while both of your critical requirements fall outside the README’s explicit scope.

  • Its search optimization relies on R8 constant relocation, instruction deduplication, and concentrated layouts; the README does not promise equivalent behavior for non-R8 builds.
  • The public features are getclass, getmanifest, and findrefs, not dynamic debugging, runtime tracing, or complete resource analysis.
  • The project insights note that dynamically loaded and runtime-generated code may not be covered by static reference searches.

ASC can serve as a fast preliminary filter, but it should not justify removing the existing full-analysis or runtime-analysis paths.

  • README: “R8 Compiler Optimization as a DeCompiler Primitive,” including deterministic constant relocation and instruction deduplication.
  • README Usage: the public subcommands are getclass, getmanifest, and findrefs.
  • Project insights, usage limitations: static reference search is not equivalent to complete runtime behavior analysis.
Not stated in the README:The README does not define compatibility boundaries or failure modes for non-R8 APKs.;The README provides no dynamic-loading, runtime-generated-code, or resource-analysis functionality.
Yes I am analyzing a 352MB commercial APK and mainly need string, type, method, and field references. I do not want to fully inflate it and build a global index first; is ASC suitable for the first-pass investigation instead of a traditional decompiler?
For: An Android reverse engineer analyzing a 352MB commercial APK who needs fast cross-DEX code-reference searches

Yes, because ASC queries the APK as a read-only database instead of requiring full preprocessing first.

  • findrefs searches strings, types, methods, and fields across all DEX entries, with class filtering, fuzzy matching, and file output.
  • In the README benchmark on a 352MB commercial APK, a cross-reference search took 1.79 seconds and used 141MB of RAM.
  • Only the matched bytecode and dependencies are extracted, then rebuilt into a minimal in-memory DEX for local decompilation.

However, ASC is a front-end定位 tool; the README does not promise coverage of dynamically loaded or runtime-generated code, or complete behavioral analysis.

  • README: findrefs searches string/type/method/field references across all DEX entries in an APK.
  • README Benchmark: 352MB commercial APK; global cross-reference searches in 1.79 seconds; 141MB of RAM.
  • README: extracts only specific bytecodes and dependencies and reconstructs a minimal self-consistent DEX.
pip install droidasc
Not stated in the README:The README does not specify coverage for dynamically loaded code, runtime-generated code, or native code.;It does not provide performance ranges for different compression methods, storage media, or CPUs.
Yes I am new to Android APK static analysis and normally use Java package names such as `com.poc.Main`. I need to inspect the Manifest, locate a class, and search for `onCreate`; is ASC suitable for this CLI workflow?
For: An Android reverse-engineering beginner who needs the Manifest, target classes, and references and prefers Java package names over DEX notation

Yes, because the README’s three commands cover this workflow from APK metadata to local code extraction.

  • getmanifest decodes AndroidManifest.xml and prints it as XML.
  • getclass accepts both Lcom/poc/Main; and com.poc.Main notation and can write Java output directly.
  • findrefs can search onCreate as a method and restrict the search with --class; the README also distinguishes semantic reference types from ordinary text search.

The user must keep inner-class, obfuscated-name, and class-name notation consistent. The README does not explain every decompilation failure or missing dependency, so ASC is suitable for initial discovery, not guaranteed source recovery.

  • README Usage: getmanifest decodes AndroidManifest.xml from an APK and prints it as XML.
  • README examples: `droidasc getclass app.apk Lcom/poc/Main; -o Main.java` and `droidasc getclass app.apk com.poc.Main --threads 16`.
  • README example: `droidasc findrefs app.apk method onCreate --class com.poc.Main`.
droidasc getmanifest app.apk -o AndroidManifest.xml
Not stated in the README:The README does not specify the exact errors for corrupted Manifests, missing dependencies, or decompilation failures.;It does not state whether obfuscated class names can be restored to original Java names.
Yes I am building an Agent in Python and want to expose APK class lookup, Manifest decoding, and reference searches as tool calls. Is ASC's `droidasc` CLI more suitable than integrating a full decompiler?
For: A Python tool developer integrating Android APK analysis into an Agent through command-line calls and parsed outputs

Yes, particularly as a narrowly scoped CLI front end, but the Agent must implement orchestration and error handling itself.

  • The README exposes getclass, getmanifest, and findrefs for local decompilation, Manifest XML output, and four reference types.
  • The CLI supports output files for Java, XML, and reference results, making it practical to preserve raw artifacts after a tool call.
  • The project description explicitly says it is “designed for Agents/Mobile Researchers,” and python main.py delegates to the same entry point as the CLI.

The README does not define a JSON output contract, timeout behavior, error codes, or retry semantics, so it should not be treated as a complete Agent adapter.

  • Project description: “ASC is a super FAST Android decompiler front-end designed for Agents/Mobile Researchers.”
  • README Usage: the three subcommands `{getclass,getmanifest,findrefs}` and their stated functions.
  • README: “You can also use `python main.py` as before — it delegates to the same entry point.”
pip install droidasc
Not stated in the README:The README does not describe stderr formats, exit codes, or a machine-readable output protocol.;It does not state whether concurrent calls, process isolation, or cancellation by timeout are safe.
It depends I maintain an enterprise analysis environment and need version pinning, reproducible upgrades, and clarity on whether Apache License 2.0 permits arbitrary analysis of third-party commercial APKs. Is ASC mature enough for this?
For: A Python/C open-source tooling maintainer who needs version pinning and upgrade management in an enterprise environment

It depends: the technical entry point is easy to deploy, but enterprise-grade version governance and authorization to analyze third-party APKs cannot be confirmed from the project materials alone.

  • The project is primarily Python with some C, and the README provides both the PyPI command pip install droidasc and source installation.
  • Project data lists Apache License 2.0, but there is no formal release and release_count is 0; version pinning, change auditing, and upgrade management therefore require more internal work.
  • The license covers the project code and does not automatically authorize analysis of every commercial APK; the project insights require checking permission, privacy, and legal obligations.

It is suitable for a prototype or controlled internal toolchain, while production readiness depends on the organization’s packaging, validation, and compliance process.

  • README Install: `pip install droidasc` and `pip install .` from source.
  • Project data: main_language is Python; language_distribution includes Python and C.
  • Project data: license is Apache License 2.0; latest_release is empty; release_count is 0.
  • Project insights, usage limitations: commercial APK analysis still requires permission, privacy, and legal compliance.
pip install droidasc
Not stated in the README:The README and project data provide no version number, dependency lockfile, or formal release channel.;They do not describe enterprise compatibility policy, security-fix cadence, or API stability.
It depends I have a memory budget close to the 141MB in the README benchmark. The target APK contains multiple DEX files and is primarily built with R8; should I use ASC first for class and reference discovery?
For: A mobile security researcher analyzing large APKs in a memory-constrained environment with R8 optimization and multidex structure

It depends: ASC is attractive when the APK preserves the R8 layout properties it exploits, but 141MB is not a universal guarantee.

  • ASC uses the concentrated physical layouts produced by R8 constant relocation and instruction deduplication for cross-DEX searching.
  • It probes Deflate bitstreams directly, performs O(1) instruction location, and rebuilds only a minimal DEX on demand, reducing full inflation and large-index overhead.
  • The README benchmark reports 141MB of RAM for a 352MB APK, but that figure applies only to the stated sample and query.

For non-R8 artifacts, unusual structures, or different obfuscation patterns, the README does not state the compatibility or memory impact. The memory budget alone is therefore insufficient for a deployment commitment.

  • README: R8 compiler optimization, deterministic constant relocation, and instruction deduplication.
  • README: direct probing within the Deflate bitstream and an O(1) instruction locating primitive.
  • README Benchmark: 141MB of RAM for a 352MB commercial APK.
droidasc findrefs app.apk type com.poc.Main
Not stated in the README:The README provides no success rate or memory upper bound for non-R8, heavily obfuscated, or malformed APKs.;It does not quantify how the number or size of DEX files affects memory usage.

✨ Highlights

  • Cross-reference search on a 352MB APK takes 1.79 seconds
  • Target-class decompilation runs with 141MB of RAM
  • R8 layouts enable O(1) instruction locating
  • findrefs covers strings, types, methods, and fields

🔧 Engineering

  • getclass extracts a DEX on demand and decompiles the target class
  • findrefs searches code references across all DEX entries
  • getmanifest decodes AndroidManifest.xml into XML

⚠️ Risks

  • Performance evidence covers only one 352MB commercial APK example
  • The project has no releases; installation relies on PyPI or source
  • With 7 contributors and 10 recent commits, maintenance capacity is limited

👥 For who?

  • Mobile researchers analyzing large Android APKs
  • Developers needing an Agents interface or CLI for DEX reference searches