asc_analyze_dex
Analyze up to 64 standard DEX files for static class, method, field, and string references, call graphs, and exact method source without unpacking an app.
Instructions
Analyze 1-64 standard DEX files with source hashes and per-DEX provenance.
Returns status=ok, error, or not_applicable. Errors carry a diagnostic code; duplicate class definitions are rejected. Manifest is not applicable to DEX. Coverage is limited to supplied files; this tool does not unpack applications. Native instruction/declaration queries need no JVM or JADX; Smali uses ASC. Explicit source_format=java alone selects the optional compatibility backend. find_method_refs/get_method_calls return declared instruction targets, not runtime dispatch. Use a full method_descriptor, e.g. Lpkg/C;->name(I)Ljava/lang/String;. Or supply exact class_name and method_name for a declared method; target_descriptor optionally selects its prototype. Ambiguous names fail without choosing an overload. find_field_refs requires field_descriptor (Lpkg/C;->name:I). field_access filters reads/writes; inheritance and reflective accesses are not resolved. find_type_refs reports static type relations. type_relation=operand selects explicit instruction type operands without an index; type_match optionally selects substrings. build_xref_index builds a bounded complete static index; one-shot indexes are temporary. get_call_graph uses bounded frontiers or an index for multi-hop static exploration. Graph depth/node/edge/byte boundaries and unresolved dynamic sites are explicit. search_members scans declarations without building an index; kind=method/field. find_string_refs accepts a literal value and returns const-string/jumbo use sites. value is a case-sensitive literal substring of the full descriptor, not regex. class_name restricts exact owner. search_strings scans DEX string-pool values using a case-sensitive literal value, not instruction use sites. source_format=auto uses ASC exact-method Smali without Java/JADX; source_format=java explicitly opts into the optional JADX compatibility backend. java never silently falls back, smali always disassembles that exact method.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Reference category; search_members accepts method or field only | string |
| depth | No | Graph hop bound; bounded frontiers or an on-demand calls-only index. | |
| limit | No | Maximum result page size in rows or source lines, server-capped | |
| value | No | Literal value (classes: Dalvik or dotted); exact extends/impl parent | |
| offset | No | Zero-based result offset; graph traversal requires zero | |
| prefix | No | Literal class/package prefix, case-sensitive | |
| threads | No | Positive ASC worker count; requested values above 32 are capped | |
| dex_paths | Yes | Ordered standard DEX file paths; combined bytes are server-bounded | |
| direction | No | Graph direction; edges retain caller-to-callee orientation. | both |
| max_edges | No | Graph call-site budget; repeated calls remain separate edges. | |
| max_nodes | No | Call-graph node budget including the root. | |
| operation | No | Static DEX operation; method selection preserves exact overload identity | info |
| class_name | No | Exact owner class; for legacy fuzzy references, a literal owner substring | |
| debug_info | No | Include debug line/local metadata for explicit method Smali only | |
| type_match | No | Case-sensitive type matching; substring requires type_relation=operand | exact |
| fuzzy_class | No | Legacy owner substring matching; exact member tools require false | |
| method_name | No | Exact declared method name with class_name, instead of method_descriptor; overloads require target_descriptor | |
| field_access | No | Instruction field-access filter, for find_field_refs | all |
| member_match | No | Literal identity or name; search_refs also accepts exact_name and prototype | descriptor |
| source_format | No | Exact method source; auto has explicit fallback diagnostics | auto |
| type_relation | No | operand selects explicit type operands without an index; instruction includes member types and catches | all |
| case_sensitive | No | Literal discovery matching case; false ignores case | |
| type_descriptor | No | DEX type including array dimensions; operand scope also accepts dotted names or literal substrings | |
| field_descriptor | No | Full field identity: Lpkg/C;->name:type | |
| method_descriptor | No | Full method identity: Lpkg/C;->name(args)return; preserves overloads | |
| target_descriptor | No | Exact prototype for method_name selection; search_refs prototype or field-type filter |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | ||
| depth | No | ||
| edges | No | ||
| index | No | ||
| items | No | ||
| limit | No | ||
| nodes | No | ||
| total | No | ||
| format | No | ||
| groups | No | ||
| module | No | ||
| offset | No | ||
| source | No | ||
| status | Yes | ||
| backend | No | ||
| message | No | ||
| sources | No | ||
| apk_path | No | ||
| coverage | No | ||
| has_more | No | ||
| input_id | No | ||
| dex_entry | No | ||
| direction | No | ||
| max_edges | No | ||
| max_nodes | No | ||
| span_unit | No | ||
| truncated | No | ||
| apk_sha256 | No | ||
| class_name | No | ||
| edge_count | No | ||
| input_kind | No | ||
| limit_unit | No | ||
| node_count | No | ||
| session_id | No | ||
| source_end | No | ||
| superclass | No | ||
| total_unit | No | ||
| type_match | No | ||
| edge_counts | No | ||
| field_count | No | ||
| limitations | No | ||
| method_name | No | ||
| next_cursor | No | ||
| next_offset | No | ||
| query_cache | No | ||
| scan_errors | No | ||
| access_flags | No | ||
| has_manifest | No | ||
| method_count | No | ||
| source_start | No | ||
| stored_bytes | No | ||
| artifact_path | No | ||
| dynamic_sites | No | ||
| source_sha256 | No | ||
| type_relation | No | ||
| engine_version | No | ||
| returned_sites | No | ||
| artifact_sha256 | No | ||
| backend_version | No | ||
| candidate_count | No | ||
| cleanup_pending | No | ||
| page_limited_by | No | ||
| scanned_methods | No | ||
| type_descriptor | No | ||
| definition_count | No | ||
| field_descriptor | No | ||
| idle_ttl_seconds | No | ||
| reference_format | No | ||
| selected_modules | No | ||
| unresolved_sites | No | ||
| member_references | No | ||
| method_descriptor | No | ||
| truncation_reasons | No | ||
| unresolved_matches | No | ||
| reference_semantics | No | ||
| response_byte_limit | No | ||
| methods_without_code | No | ||
| reserved_index_bytes | No | ||
| runtime_completeness | No | ||
| scanned_instructions | No | ||
| hierarchy_cycle_detected | No | ||
| instruction_scan_complete | No | ||
| runtime_target_resolution | No | ||
| unresolved_sites_truncated | No | ||
| traversal_complete_within_depth | No |