Who ASC is for#
Mobile security researchers doing targeted code analysis
ASC's `findrefs` command traces any string, type, method, or field across every DEX in an APK without loading the entire artifact. Researchers investigating a specific library or vulnerability pattern can get results in under 2 seconds on large APKs, then decompile only the relevant class with `getclass`.
Skip if:
Skip if you need an interactive code browser with call graphs, cross-reference navigation, and annotation support. ASC is a CLI query engine, not an exploration environment.
AI agents and automated security scanners
The `agentic-ai` topic and stateless design make ASC purpose-built for automated analysis pipelines. An agent can call `findrefs` to locate a class, then call `getclass` to decompile it, with each call completing in milliseconds and requiring no session state between calls.
Skip if:
Skip if your pipeline needs the full decompiled source tree of an APK in one pass. ASC is optimized for targeted extraction, not bulk decompilation of every class.
Android reverse engineers analyzing R8-compiled APKs
ASC exploits R8 compiler determinism to search obfuscated code efficiently. Since R8 produces predictable physical layouts regardless of obfuscation layer, ASC can locate method implementations in a few hundred milliseconds even when class names have been renamed.
Skip if:
Skip if the APK was compiled with a non-R8 compiler (older ProGuard-only builds or custom toolchains). ASC's speed optimizations are specific to R8 output.
Developers building Android analysis tooling
ASC provides a `pip install droidasc` entry point and a clean CLI surface that is straightforward to wrap in a Python subprocess call. Teams building scanners, auditors, or compliance tools on top of APK analysis can use it as a dependency without maintaining custom DEX parsing code.
Skip if:
Skip if you need a Python SDK with structured return values rather than CLI output. The current interface is command-line only with file-based or stdout output.
The problem it solves#
Android reverse engineering requires decompiling large APK files to inspect code, trace references, and analyze behavior. Traditional decompilers address this by inflating the artifact, parsing every class, and constructing a cross-reference database before returning any result. For large APKs (200MB and above), this preprocessing can take tens of minutes, consume gigabytes of RAM, and produce nothing useful until the full index is done.
Researchers doing one-off code searches, security scanners running automated analysis, and AI agents inspecting APKs on demand all pay this preprocessing cost whether or not they need the full index. The preprocessing model made sense when researchers explored a codebase interactively for days, but it is an obstacle when the goal is to locate one class or trace one reference in an automated pipeline.
How it solves it#
Stateless zero-preprocessing engine
Queries the APK's Deflate bitstream directly instead of inflating the whole artifact. No index is built before the first query, so the first search costs the same as the thousandth. A 352MB commercial APK yields cross-reference results in 1.79 seconds using 141MB of RAM.
Cross-DEX reference search
The `findrefs` command finds all references to a string, type, method, or field across every DEX entry in the APK in one pass. Supports exact matches and fuzzy class name matching. Results can be written to a file for downstream analysis or piped to other tools.
On-demand class decompilation
The `getclass` command locates a target class, extracts only its bytecode and dependencies into a minimal in-memory DEX, and decompiles it. Class decompilation on a 352MB APK takes 177 milliseconds. Supports multi-threaded execution via the `--threads` flag.
AndroidManifest.xml decoding
The `getmanifest` command decodes the binary-encoded AndroidManifest.xml from any APK and prints it as readable XML, with optional file output. No need to unpack the APK or run a separate decode step.
R8 compiler pattern exploitation
ASC exploits two deterministic R8 compiler behaviors. Constant relocation places numeric literals in predictable positions; instruction deduplication clusters identical bytecode blocks. These patterns let ASC narrow searches to small physical regions of the DEX instead of scanning the full artifact.
Strengths and trade-offs#
Strengths
- Millisecond response on large APKsBenchmark on a 352MB commercial APK: cross-reference search in 1.79 seconds, class decompilation in 177 milliseconds, peak RAM 141MB. Traditional decompilers allocate gigabytes and wait tens of minutes before returning any result.
- Apache-2.0 license with no usage restrictionsApache-2.0 permits commercial use, modification, and distribution without copyleft requirements. Security teams can integrate ASC into proprietary analysis pipelines and paid engagements without license friction or attribution requirements beyond the standard Apache-2.0 notice.
- Designed for agentic automationASC was built from the ground up as a decompilation primitive for AI agents and automated scanners, not as an interactive GUI tool. Every operation is a single CLI command with structured output options, which makes it straightforward to call from a Python script or an agent framework.
- Presented at Black Hat Europe ArsenalASC was presented at Black Hat Europe Arsenal, a curated showcase for offensive and defensive security tooling reviewed by the conference's security community. The paper explaining the R8 exploitation technique is publicly linked from the project README.
Trade-offs
- -CLI-only with no GUI or interactive analysis sessionASC provides `getclass`, `getmanifest`, and `findrefs` commands but no graphical code browser, call graph viewer, or interactive exploration session. Researchers who need to navigate unfamiliar codebases interactively will still reach for GUI tools like JEB or JADX alongside ASC.
- -New project with limited ecosystem documentationASC was created in June 2026. The README covers the core CLI commands but does not document error handling, edge cases for malformed APKs, or integration patterns for production pipelines. Teams integrating ASC into automated workflows will need to rely on the GitHub repository and issue tracker for support on non-obvious scenarios.
ASC vs alternatives#
ASC vs JEB Decompiler
Both tools analyze Android APKs, but they are built for different workflows. JEB Decompiler is a commercial tool that builds a persistent analysis database and provides an interactive GUI; ASC is an open source, stateless CLI optimized for millisecond-response targeted queries.
| Feature | ASC | JEB Decompiler |
|---|---|---|
| License | Apache-2.0 | Proprietary (commercial) |
| Price | Free | Paid license required |
| Self-hosting | Yes, pip install | N/A (desktop app) |
| Interface | CLI | GUI + scripting API |
| Preprocessing | None | Full index build |
| Cross-ref search (352MB APK) | 1.79 seconds | Minutes (after indexing) |
| Peak RAM (352MB APK) | 141MB | Gigabytes |
| Target use | Automated pipelines, agents | Interactive human analysis |
ASC is the better fit for automated and agentic workflows. If your work involves programmatic querying of APKs, a security scanner, or an AI agent inspecting code at scale, ASC's stateless design and sub-2-second response times make it the right choice. There are no licensing costs, no GUI to automate around, and each query is independent, so it composes easily into scripts.
JEB Decompiler is still the better choice for interactive exploration of unfamiliar codebases. JEB's persistent analysis database makes repeated cross-reference navigation fast after the initial index build, and its plugin SDK and GUI let a human researcher annotate, navigate, and comment code directly. Security consultants who spend days inside a single complex APK will get more from JEB's interactive environment than from ASC's query-and-exit model.
Quick start#
Install droidasc from PyPI; the droidasc CLI command becomes available globally after installation.
```bash
pip install droidasc
```What it's built on#
- Languages
- CPython
FAQ#
What makes ASC faster than traditional Android decompilers?
ASC queries the APK's Deflate bitstream directly instead of inflating the full artifact and building a cross-reference database. It exploits R8 compiler patterns to narrow searches to small DEX regions and uses an O(1) instruction locating primitive for constant-time method resolution. On a 352MB APK, cross-reference searches complete in 1.79 seconds and class decompilations in 177 milliseconds, using 141MB of RAM.
Is ASC free to use for commercial security work?
Yes. ASC is Apache-2.0 licensed, which permits commercial use, modification, and distribution without restriction. Security consultancies and enterprise teams can integrate it into paid engagements and proprietary pipelines without licensing fees or obligations beyond the Apache-2.0 attribution notice.
How does ASC compare to JEB Decompiler for Android analysis?
JEB is a commercial GUI-based reverse-engineering tool with a persistent analysis database, plugin SDK, and interactive code exploration. ASC is a stateless CLI tool optimized for automated, targeted queries. JEB is better for interactive investigation of an unfamiliar codebase; ASC is better for scripted analysis, agentic automation, and scenarios where response time per query matters more than a persistent workspace.
Which APK types does ASC support?
ASC is designed for DEX-based Android APKs compiled with the R8 compiler, which is the standard production compiler in Android Studio since Android Gradle Plugin 3.4. Its speed optimizations specifically exploit R8's deterministic constant relocation and instruction deduplication behaviors. APKs built with older ProGuard-only pipelines may not benefit from the same optimizations.
Can ASC decompile a full APK at once?
ASC is optimized for targeted extraction rather than full-APK batch decompilation. The getclass command extracts and decompiles one class at a time; findrefs locates references across all DEX entries. There is no single command to dump the full decompiled source tree. For full-APK decompilation, tools like JADX or apktool are better suited to that workflow.
Similar open-source tools#
reverse-skill
AI skill router for reverse engineering and penetration testing
Doberman-Core
Runtime guardrails that gate every AI agent tool call
repowise
Codebase intelligence: MCP tools for agents, health scores for teams.
Local Deep Research
Your AI research assistant, fully local and encrypted.
OpenFang
Open source Agent OS built in Rust with autonomous agents
Omnara
Open-source agent deployment API. Self-host or use Omnara Cloud.