Dextra*

The dextra utility began its life as an alternative to the AOSP's dexdump and dx --dump, both of which are rather basic, and produce copious, but unstructured output. In addition to supporting all their features, it also supports various output modes, specific class, method and field lookup, as well as determining static field values. I later updated it to support ART (which is also one of the reasons why the tool was renamed).

The dextra tool is provided as one of the free downloads provided for the "Android Internals" book (http://NewAndroidBook.com/). You are welcome to use it even if you don't buy the book (though naturally you're even more welcome to buy the book :-). Its method of operation and a lot more about Dalvik internals is covered in detail, in Chapters 10 and 11. Its latest version, as a tar file with binaries for OS X, Linux/Android x86_64 or Linux/Android ARMv7, can always be obtained at this page right here.


You might want to check back frequently, as I'm currently updating the tool, and adding features, specifically in the decompilation department. Latest compilation date (Mar 24rd 2017) supports significant improvements to the disassembler and decompiler engine.

And no, I haven't forgotten about this tool or about Volume II. Just got bigger fish to fry with MOXiI Volume I and iOS 11

For updates, you might want to check out the RSS feed, or follow my company's feed, @Technologeeks, which (aside from the occasional OS X/iOS related stuff) tweets about updates to this and other tools.

If you want to learn how Dextra actually works - DEX and ART get almost a full day in the Android Internals & Reverse Engineering Training course my company, Technologeeks, offers. Come join us!

Examples

dextra is designed to be fairly easy to use either independently or as a scriptable component. Some examples follow:

  1. With no arguments, dextra will try to explain itself as clearly as possible: 
    morpheus@Zephyr (~)$ dextra
Usage: ./dextra [...] _file_
Where: _file_ = DEX or ART/OAT file to open
And [...] can be any combination of:
       -l List contents of file (classes is in dex, oat, or ART)
       -c: Only process this class
       -m: show methods for processed classes (implies -c *)
       -f: show fields for processed classes (implies -c *)
       -p: Only process classes in this package

Disassembly/Decompilation:
       -d: Disassemble DEX code sections (like dexdump does - implies -m)
       -D: Decompile to Java (new feature, still working on it. Implies -j -m)
       -noindent: Disable indentation of code

DEX specific options:
       -h: Just dump file header
       -M [_index_]: Dump Method at _index_, or dump all methods
       -F [_index_]: Dump Field at _index_, or dump all fields
       -S [_index_]: Dump String at _index_, or dump all strings
       -T [_index_]: Dump Type  at _index_, or dump all types

OAT specific options:
       -h: Just dump file header
       -dextract     Extract embedded DEX content from an OAT files
       -o            Display addresses as offsets (useful for file editing/fuzzing)
       -delta 0x...   Apply Patch delta
       -begin 0x...   Set image beginning to value (auto-delta)

ART specific options:
       -delta 0x...   Apply Patch delta
       -begin 0x...   Set image beginning to value (auto-delta)
       -deep         Deep dump (go into object arrays)

And you can always use any of these output Modifiers:
       -j: Java style output (default is JNI, but this is much better)
       -v: verbose output
       -color: Color output (can also set JCOLOR=1 environment variable)

This is DEXTRA, version 1.29.79 (N,PR3), compiled on May 24 2016.

For more details and the latest version of this tool: http://NewAndroidBook.com/tools/dextra.html
Please let me know you're using it- by visiting http://NewAndroidBook.com/tools/counter?dextra once
  2. In its basic usage, dextra with just a DEX, ODEX, ART or OAT argument will display the classes: 
    morpheus@Zephyr (~)$ dextra dalvik-cache/data@app@com.skype.raider-1.apk@classes.dex  | more


        Class 0: abstract android.support.v4.accessibilityservice.AccessibilityServiceInfoCompat$AccessibilityServiceInfoVersionImpl            
           File: AccessibilityServiceInfoCompat.java
                5 Virtual Methods
        Class 1: android.support.v4.accessibilityservice.AccessibilityServiceInfoCompat$AccessibilityServiceInfoStubImpl
           implements Landroid/support/v4/accessibilityservice/AccessibilityServiceInfoCompat$AccessibilityServiceInfoVersionImpl;              
	  File: AccessibilityServiceInfoCompat.java
                1 Direct Methods
                5 Virtual Methods
		..
  3. Things get more interesting when you use -m (to display methods), -f (to display fields) and -j (for Java-style output). -v (verbose) is optional, and will print out class, field, method and string indices as Java comments. Since classes.dex normally contains hundreds of classes, a good idea is to use "-c ..." to filter for the class you want. 
    morpheus@Zephyr (~)$ dextra  -v -j -m -c android.support.v4.content.IntentCompat -f  data@app@com.skype.raider-1.apk@classes.dex
/* 112 */ public class   android.support.v4.content.IntentCompat        {
         /** 8 Static Fields  **/
 /* 360:497 */ public final static  java.lang.String     ACTION_EXTERNAL_APPLICATIONS_AVAILABLE= "android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE" // (String #17188);
 /* 360:498 */ public final static  java.lang.String     ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE= "android.intent.action.EXTERNAL_APPLICATIONS_UNAVAILABLE" // (String #17189);
 /* 360:499 */ public final static  java.lang.String     EXTRA_CHANGED_PACKAGE_LIST= "android.intent.extra.changed_package_list" // (String #17212);
 /* 360:500 */ public final static  java.lang.String     EXTRA_CHANGED_UID_LIST= "android.intent.extra.changed_uid_list" // (String #17213);
 /* 360:501 */ public final static  java.lang.String     EXTRA_HTML_TEXT= "android.intent.extra.HTML_TEXT" // (String #17206);
 /* 360:502 */ public final static  int  FLAG_ACTIVITY_CLEAR_TASK = 32768 // 0x8000;
 /* 360:503 */ public final static  int  FLAG_ACTIVITY_TASK_ON_HOME = 16384 // 0x4000;
 /* 360:504 */ private final static  android.support.v4.content.IntentCompat$IntentCompatImpl    IMPL;
         /** 5 Direct Methods  **/
 /* 360:2125 */   static  void  (); // Class Constructor
 /* 360:2126 */   private  void  (); // Constructor
 /* 360:2127 */   public static  android.content.Intent makeMainActivity (android.content.ComponentName);
 /* 360:2128 */   public static  android.content.Intent makeMainSelectorActivity (java.lang.String, java.lang.String);
 /* 360:2129 */   public static  android.content.Intent makeRestartActivityTask (android.content.ComponentName);
        }  // end class android.support.v4.content.IntentCompat

    The x:y notation is for the class index and field/method index. As the above shows, dextra will automatically determine static values for Java primitive types, if found in the static values of the class.

  4. You can lookup specific fields, method, or strings, with -F, -M, and -S respectively - like so: 
    morpheus@Zephyr (~)$ dextra -S 17213  data@app@com.skype.raider-1.apk@classes.dex            
android.intent.extra.changed_uid_list
  5. Things are even better in color, which you can use with --color or by setting the environment variable of JCOLOR to 1. This produces this nice output:


New features in 1.2

New features in 1.3

New features in 1.5

New features in 1.17.64 (new versioning scheme)

New features in 1.27.75

  • 03/16/2016 Changes: Shame on you, GOOGLers. Changing ART/OAT again without so much as a comment. Won't work, though - Dextra can now handle N Preview Release 1. See you next PR..
  • 05/23/2016 Changes: $%#$%$#%$#. NPR3 Now supported. NPR2 support (025/077) discontinued

    • New features in 1.29.79

  • Supports N final, OAT Multi-Dexes (Thanks Albert!!!) and better decompilation

    • New features in 1.30.88

  • Supports N 7.1 ..

    • New features in 1.38.114

    03/24/2017 Changes
  • Supports O (for now, i.e. Pr1 - you can rest assured Google will mess the format again by final)
  • Works with new .vdex files - as of O, .oat no longer embed the .dex in them.
  • Now has DEX 037 support - with invoke-polymorphic (0xfa/0xfb) and other instructions
  • New OAT/ART format support still in progress

    • Notes

    Known bugs

    (No need to report any of these)

    Please report any other bug - especially crashes - so I can improve dextra

    I've tested dextra extensively, and also people have been nice enough to send me dumps aplenty. That said, with all the devices out there (and myriad versions of ART), the tool may crash. If you encounter any bug I don't know about, you've run into a use case I didn't consider. So, please shoot me a line. The only way I can fix bugs is by first knowing they exist.

    QnA

    etc

  • Dextra shares no code with any other sources, open or closed, Android's, Google's or otherwise, save for the DEX structure definitions, which were ported from libdex.h
  • If you find this useful, pointing your browser to http://NewAndroidBook.com/tools/counter?dextra - if I can ask you to cut/paste this (so bots don't auto-follow and I get a human count :-). would be appreciated.

    • * - The tool was originally named "dexter", but was renamed because of A) conflict with another tool (not mine) with different functionality and B) support for ART.