Report server, engine, path-scope, and pagination configuration.

Inventory v1/v2/v3 containers and certificate fingerprints; detect v3.1 block presence.

Container presence is independent of cryptographic validity. APK digests, signatures, trust, rotation lineage and v4 sidecars remain unverified. Malformed containers produce explicit diagnostics. v1 certificates are a PKCS7 bag, not resolved signer identities.

Inspect container capabilities before selecting a DEX analysis workflow.

JVM classes and nested APK splits are inventory-only. First-level JAR class names are included. compare_to compares JVM identities; DEX declarations use session diff. AAB selects base, an exact module, an explicit list or * for all modules. Nested APKs are not reconstructed. include_summary describes the input artifact, including when compare_to is set. Manifest diagnostics are separate from inventory status; AAB protobuf XML is not decoded.

Snapshot selected direct DEX into an immutable reusable session with container hashes.

Direct DEX at arbitrary archive paths, AAR classes.jar DEX and selected AAB modules are supported. Pure JVM classes and nested split APKs stay inventory-only. Duplicate classes are rejected. Query and close the resulting ID with the existing DEX session tools.

Compare class/member identities with full descriptors and old/new source hashes.

Uses native DEX declarations without Java or an instruction index. Unchanged identities say nothing about changed behavior, access flags, annotations or bodies. Inventory is bounded to 1M identities and 64 MiB of cumulative declaration records.

Find redacted candidate secrets in DEX strings with exact pool indices and fingerprints.

Uses native DEX string pools without Java/JADX. Values are redacted unless include_values=true. Candidate validity and instruction use sites remain untested. Strings over 64K UTF-16 units are skipped explicitly; per-pattern/string matches cap at 20, total strings at 2M. Assets, native code, runtime values and arbitrary encodings are outside this scan.

Inspect APK size, SHA-256, manifest presence, and top-level DEX entries.

List archive contents or a standalone DEX file without extracting files.

SHA-256 binds this page to the input. Standalone DEX entries use the original basename and bytes, without code validation or ZIP CRC metadata. Archive CRCs are declarations. Native rows are an archive inventory, not ELF analysis. Follow next_offset for more.

Read bounded entry bytes as UTF-8 or base64, with input hash and entry provenance.

Binary XML decoding and returned-content truncation are separate statuses. Partial raw reads do not verify CRC. Resource IDs are not resolved; no filesystem extraction occurs. Standalone DEX bytes remain original, including 041 headers; code validation is separate.

Read structured Manifest components, filters, metadata and permission inheritance.

Raw declarations are preserved separately. Unspecified exported defaults and resource values remain unresolved. Provider path rules and URI grants need separate review; permission inheritance is static triage, not a runtime accessibility or vulnerability test.

Decode AndroidManifest.xml and return a bounded page of XML lines.

List class descriptors, optionally filtered by package or class prefix.

Locate and decompile one class, returning a bounded page of source lines.

Find cross-DEX references or direct subclasses/interface implementors.

extends/impl use an exact class in value and return direct declarations only. Optional rust_asc supports string/type/method/field only and has unverified coverage.

Analyze 1-64 standard DEX files with source hashes and per-DEX provenance.

Returns status=ok, error, or not_applicable. Errors carry a diagnostic code; duplicate class definitions are rejected. Manifest is not applicable to DEX. Coverage is limited to supplied files; this tool does not unpack applications. Native instruction/declaration queries need no JVM or JADX; Smali uses ASC. Explicit source_format=java alone selects the optional compatibility backend. find_method_refs/get_method_calls return declared instruction targets, not runtime dispatch. Use a full method_descriptor, e.g. Lpkg/C;->name(I)Ljava/lang/String;. Or supply exact class_name and method_name for a declared method; target_descriptor optionally selects its prototype. Ambiguous names fail without choosing an overload. find_field_refs requires field_descriptor (Lpkg/C;->name:I). field_access filters reads/writes; inheritance and reflective accesses are not resolved. find_type_refs reports static type relations. type_relation=operand selects explicit instruction type operands without an index; type_match optionally selects substrings. build_xref_index builds a bounded complete static index; one-shot indexes are temporary. get_call_graph uses bounded frontiers or an index for multi-hop static exploration. Graph depth/node/edge/byte boundaries and unresolved dynamic sites are explicit. search_members scans declarations without building an index; kind=method/field. find_string_refs accepts a literal value and returns const-string/jumbo use sites. value is a case-sensitive literal substring of the full descriptor, not regex. class_name restricts exact owner. search_strings scans DEX string-pool values using a case-sensitive literal value, not instruction use sites. source_format=auto uses ASC exact-method Smali without Java/JADX; source_format=java explicitly opts into the optional JADX compatibility backend. java never silently falls back, smali always disassembles that exact method.

Validate and snapshot DEX inputs once; return an immutable hash-bound session.

Reuses the validated bundle, not a resident engine. Idle sessions expire and may be evicted at capacity. Source file changes require opening a new session.

Close a DEX session; active queries finish before its stored files are removed.

Query an immutable DEX session in a supervised worker, with original provenance.

Native instruction/declaration queries need no JVM or JADX; Smali uses ASC. search_refs combines literal owner/name/prototype filters without global preprocessing. find_string_refs accepts a literal value and returns const-string/jumbo use sites. target_descriptor optionally filters exact prototypes/field types. find_method_refs/get_method_calls return declared instruction targets, not runtime dispatch. method_descriptor is the full DEX class->name(args)return identity. Or supply exact class_name and method_name for a declared method; target_descriptor optionally selects its prototype. Ambiguous names fail without choosing an overload. find_field_refs requires field_descriptor (Lpkg/C;->name:I). field_access filters reads/writes; inheritance and reflective accesses are not resolved. build_xref_index persists an atomic static index for this session's lifetime. get_call_graph uses bounded frontiers or an index for multi-hop static exploration. Inspect truncation_reasons and unresolved_sites; graph edges are declared operands. An optional configured durable cache restores matching indexes across server restarts. find_type_refs with type_relation=operand scans explicit type operands without an index, using exact or literal substring type_match. Other type scopes build/reuse the index. instruction includes member-type and catch relations; exact matching preserves arrays. search_members scans declarations or reuses an existing index; kind=method/field. value is a case-sensitive literal substring of the full descriptor, not regex. class_name restricts exact owner. search_strings scans DEX string-pool values using a case-sensitive literal value, not instruction use sites. Identical discovery and non-indexed reference pages reuse a bounded session cache. Reference pages can stop at the byte budget before limit; continue with next_offset. reference_format=grouped returns groups with matches/evidence for instruction references. In grouped format limit counts caller groups; total/offset/returned_sites count sites. Continue with next_cursor and identical selectors; a large caller may span pages. source_format=auto uses ASC exact-method Smali, never JADX. source_format=java explicitly selects the optional compatibility backend.