🧭 Decision Guide
Why trending now: Cannot be determined from the provided material
Try it if you
-
You need to analyze a large Android APK with multiple DEX files and find method or field references across DEX files.The README CLI section states that findrefs searches strings, types, methods, and fields across “all DEX entries in APK”.
-
You care about low-memory, on-demand decompilation performance on a 352MB APK.The README Benchmark section reports 1.79 seconds for global cross-reference search, 177 milliseconds for target-class decompilation, and 141MB of RAM on a 352MB commercial APK.
-
You need to extract one class, a Manifest, or code references directly from an APK.The README Install section provides the getclass, getmanifest, and findrefs subcommands.
Skip it if you
-
You need a stable published version or an explicit release history.Project metadata reports 0 releases and the latest version as “No releases”.
-
You need to select a tool based on multiple APKs, Android versions, or compression scenarios.The README provides only one 352MB commercial APK benchmark and no broader test matrix.
-
You depend on a complete prebuilt global index or a persistent cross-reference database.The README explicitly chooses “zero preprocessing” and queries the compiled artifact as a read-only database on demand.
Requirements
- Install from PyPI: pip install droidasc
- Or install from source: pip install .
- Installation provides the global droidasc CLI command.
- The README also states that python main.py can be used and delegates to the same entry point.
First step (verbatim from README)
pip install droidasc
Watch out
-
The getclass examples use both Lcom/poc/Main; and com.poc.Main class-name formats.The README CLI examples show both droidasc getclass app.apk Lcom/poc/Main; and droidasc getclass app.apk com.poc.Main.
-
Do not generalize large-APK performance beyond the 352MB Benchmark.The README provides only the 1.79-second, 177-millisecond, and 141MB figures for a 352MB commercial APK.
-
Fuzzy class matching for findrefs requires the explicit --fuzzy-class option.The README example for method notify uses --class MainActivity --fuzzy-class.
Alternatives
-
Standard Android decompiler:When you need the full inflate, global indexing, and cross-reference preprocessing workflow criticized in the README, a standard tool matches that operating model better.README body
Not stated in the README
- The README does not specify supported Python versions, operating systems, or C-component build requirements.
- The README does not identify the exact decompilation backend or its version.
- The README does not state compatibility with obfuscated APKs, unusual DEX files, or compression formats.
- The README provides no performance data beyond 352MB and does not clarify whether the 141MB figure includes all process overhead.
- The README does not describe Java output fidelity, failure handling, or error codes for getclass.
- The README does not define the feature scope of GUI mode; it only shows droidasc app.apk --gui.
💡 Deep Analysis
6
No
I need to analyze a non-R8 APK and verify the runtime behavior of dynamically loaded code. Our current workflow relies on full extraction, global cross-references, and a traditional decompiler; can ASC replace it completely?
No, not as a complete replacement. ASC focuses on on-demand static lookup and local decompilation, while both of your critical requirements fall outside the README’s explicit scope.
- Its search optimization relies on R8 constant relocation, instruction deduplication, and concentrated layouts; the README does not promise equivalent behavior for non-R8 builds.
- The public features are
getclass,getmanifest, andfindrefs, not dynamic debugging, runtime tracing, or complete resource analysis. - The project insights note that dynamically loaded and runtime-generated code may not be covered by static reference searches.
ASC can serve as a fast preliminary filter, but it should not justify removing the existing full-analysis or runtime-analysis paths.
- README: “R8 Compiler Optimization as a DeCompiler Primitive,” including deterministic constant relocation and instruction deduplication.
- README Usage: the public subcommands are getclass, getmanifest, and findrefs.
- Project insights, usage limitations: static reference search is not equivalent to complete runtime behavior analysis.
Yes
I am analyzing a 352MB commercial APK and mainly need string, type, method, and field references. I do not want to fully inflate it and build a global index first; is ASC suitable for the first-pass investigation instead of a traditional decompiler?
Yes, because ASC queries the APK as a read-only database instead of requiring full preprocessing first.
findrefssearches strings, types, methods, and fields across all DEX entries, with class filtering, fuzzy matching, and file output.- In the README benchmark on a 352MB commercial APK, a cross-reference search took 1.79 seconds and used 141MB of RAM.
- Only the matched bytecode and dependencies are extracted, then rebuilt into a minimal in-memory DEX for local decompilation.
However, ASC is a front-end定位 tool; the README does not promise coverage of dynamically loaded or runtime-generated code, or complete behavioral analysis.
- README: findrefs searches string/type/method/field references across all DEX entries in an APK.
- README Benchmark: 352MB commercial APK; global cross-reference searches in 1.79 seconds; 141MB of RAM.
- README: extracts only specific bytecodes and dependencies and reconstructs a minimal self-consistent DEX.
pip install droidasc
Yes
I am new to Android APK static analysis and normally use Java package names such as `com.poc.Main`. I need to inspect the Manifest, locate a class, and search for `onCreate`; is ASC suitable for this CLI workflow?
Yes, because the README’s three commands cover this workflow from APK metadata to local code extraction.
getmanifestdecodes AndroidManifest.xml and prints it as XML.getclassaccepts bothLcom/poc/Main;andcom.poc.Mainnotation and can write Java output directly.findrefscan searchonCreateas a method and restrict the search with--class; the README also distinguishes semantic reference types from ordinary text search.
The user must keep inner-class, obfuscated-name, and class-name notation consistent. The README does not explain every decompilation failure or missing dependency, so ASC is suitable for initial discovery, not guaranteed source recovery.
- README Usage: getmanifest decodes AndroidManifest.xml from an APK and prints it as XML.
- README examples: `droidasc getclass app.apk Lcom/poc/Main; -o Main.java` and `droidasc getclass app.apk com.poc.Main --threads 16`.
- README example: `droidasc findrefs app.apk method onCreate --class com.poc.Main`.
droidasc getmanifest app.apk -o AndroidManifest.xml
Yes
I am building an Agent in Python and want to expose APK class lookup, Manifest decoding, and reference searches as tool calls. Is ASC's `droidasc` CLI more suitable than integrating a full decompiler?
Yes, particularly as a narrowly scoped CLI front end, but the Agent must implement orchestration and error handling itself.
- The README exposes
getclass,getmanifest, andfindrefsfor local decompilation, Manifest XML output, and four reference types. - The CLI supports output files for Java, XML, and reference results, making it practical to preserve raw artifacts after a tool call.
- The project description explicitly says it is “designed for Agents/Mobile Researchers,” and
python main.pydelegates to the same entry point as the CLI.
The README does not define a JSON output contract, timeout behavior, error codes, or retry semantics, so it should not be treated as a complete Agent adapter.
- Project description: “ASC is a super FAST Android decompiler front-end designed for Agents/Mobile Researchers.”
- README Usage: the three subcommands `{getclass,getmanifest,findrefs}` and their stated functions.
- README: “You can also use `python main.py` as before — it delegates to the same entry point.”
pip install droidasc
It depends
I maintain an enterprise analysis environment and need version pinning, reproducible upgrades, and clarity on whether Apache License 2.0 permits arbitrary analysis of third-party commercial APKs. Is ASC mature enough for this?
It depends: the technical entry point is easy to deploy, but enterprise-grade version governance and authorization to analyze third-party APKs cannot be confirmed from the project materials alone.
- The project is primarily Python with some C, and the README provides both the PyPI command
pip install droidascand source installation. - Project data lists Apache License 2.0, but there is no formal release and
release_countis 0; version pinning, change auditing, and upgrade management therefore require more internal work. - The license covers the project code and does not automatically authorize analysis of every commercial APK; the project insights require checking permission, privacy, and legal obligations.
It is suitable for a prototype or controlled internal toolchain, while production readiness depends on the organization’s packaging, validation, and compliance process.
- README Install: `pip install droidasc` and `pip install .` from source.
- Project data: main_language is Python; language_distribution includes Python and C.
- Project data: license is Apache License 2.0; latest_release is empty; release_count is 0.
- Project insights, usage limitations: commercial APK analysis still requires permission, privacy, and legal compliance.
pip install droidasc
It depends
I have a memory budget close to the 141MB in the README benchmark. The target APK contains multiple DEX files and is primarily built with R8; should I use ASC first for class and reference discovery?
It depends: ASC is attractive when the APK preserves the R8 layout properties it exploits, but 141MB is not a universal guarantee.
- ASC uses the concentrated physical layouts produced by R8 constant relocation and instruction deduplication for cross-DEX searching.
- It probes Deflate bitstreams directly, performs O(1) instruction location, and rebuilds only a minimal DEX on demand, reducing full inflation and large-index overhead.
- The README benchmark reports 141MB of RAM for a 352MB APK, but that figure applies only to the stated sample and query.
For non-R8 artifacts, unusual structures, or different obfuscation patterns, the README does not state the compatibility or memory impact. The memory budget alone is therefore insufficient for a deployment commitment.
- README: R8 compiler optimization, deterministic constant relocation, and instruction deduplication.
- README: direct probing within the Deflate bitstream and an O(1) instruction locating primitive.
- README Benchmark: 141MB of RAM for a 352MB commercial APK.
droidasc findrefs app.apk type com.poc.Main
✨ Highlights
-
Cross-reference search on a 352MB APK takes 1.79 seconds
-
Target-class decompilation runs with 141MB of RAM
-
R8 layouts enable O(1) instruction locating
-
findrefs covers strings, types, methods, and fields
🔧 Engineering
-
getclass extracts a DEX on demand and decompiles the target class
-
findrefs searches code references across all DEX entries
-
getmanifest decodes AndroidManifest.xml into XML
⚠️ Risks
-
Performance evidence covers only one 352MB commercial APK example
-
The project has no releases; installation relies on PyPI or source
-
With 7 contributors and 10 recent commits, maintenance capacity is limited
👥 For who?
-
Mobile researchers analyzing large Android APKs
-
Developers needing an Agents interface or CLI for DEX reference searches