asc_query_dex_session
Query immutable Android DEX sessions to inspect classes, methods, fields, strings, references, and call graphs with provenance and paginated results.
Instructions
Query an immutable DEX session in a supervised worker, with original provenance.
Native instruction/declaration queries need no JVM or JADX; Smali uses ASC. search_refs combines literal owner/name/prototype filters without global preprocessing. find_string_refs accepts a literal value and returns const-string/jumbo use sites. target_descriptor optionally filters exact prototypes/field types. find_method_refs/get_method_calls return declared instruction targets, not runtime dispatch. method_descriptor is the full DEX class->name(args)return identity. Or supply exact class_name and method_name for a declared method; target_descriptor optionally selects its prototype. Ambiguous names fail without choosing an overload. find_field_refs requires field_descriptor (Lpkg/C;->name:I). field_access filters reads/writes; inheritance and reflective accesses are not resolved. build_xref_index persists an atomic static index for this session's lifetime. get_call_graph uses bounded frontiers or an index for multi-hop static exploration. Inspect truncation_reasons and unresolved_sites; graph edges are declared operands. An optional configured durable cache restores matching indexes across server restarts. find_type_refs with type_relation=operand scans explicit type operands without an index, using exact or literal substring type_match. Other type scopes build/reuse the index. instruction includes member-type and catch relations; exact matching preserves arrays. search_members scans declarations or reuses an existing index; kind=method/field. value is a case-sensitive literal substring of the full descriptor, not regex. class_name restricts exact owner. search_strings scans DEX string-pool values using a case-sensitive literal value, not instruction use sites. Identical discovery and non-indexed reference pages reuse a bounded session cache. Reference pages can stop at the byte budget before limit; continue with next_offset. reference_format=grouped returns groups with matches/evidence for instruction references. In grouped format limit counts caller groups; total/offset/returned_sites count sites. Continue with next_cursor and identical selectors; a large caller may span pages. source_format=auto uses ASC exact-method Smali, never JADX. source_format=java explicitly selects the optional compatibility backend.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Reference category; search_members accepts method or field only | string |
| depth | No | Hop bound; bounded frontiers or an on-demand calls-only index. | |
| limit | No | Maximum result page size in rows or source lines, server-capped | |
| value | No | Literal value (classes: Dalvik or dotted); exact extends/impl parent | |
| cursor | No | Grouped next_cursor for the same session/query; leave offset at zero | |
| offset | No | Zero-based result offset; graph traversal requires zero | |
| prefix | No | Literal class/package prefix, case-sensitive | |
| threads | No | Positive ASC worker count; requested values above 32 are capped | |
| direction | No | Graph direction; edges retain caller-to-callee orientation. | both |
| max_edges | No | Graph call-site budget; repeated calls remain separate edges. | |
| max_nodes | No | Call-graph node budget including the root. | |
| operation | No | Session operation; graph frontiers and type indexes run on demand | info |
| class_name | No | Exact owner class; for legacy fuzzy references, a literal owner substring | |
| debug_info | No | Include debug line/local metadata for explicit method Smali only | |
| session_id | Yes | Immutable open DEX session ID returned by an open tool | |
| type_match | No | Case-sensitive type matching; substring requires type_relation=operand | exact |
| fuzzy_class | No | Legacy owner substring matching; exact member tools require false | |
| method_name | No | Exact declared method name with class_name, instead of method_descriptor; overloads require target_descriptor | |
| field_access | No | Instruction field-access filter, for find_field_refs | all |
| member_match | No | Literal identity or name; search_refs also accepts exact_name and prototype | descriptor |
| source_format | No | Exact method source; auto has explicit fallback diagnostics | auto |
| type_relation | No | operand selects explicit type operands without an index; instruction includes member types and catches | all |
| case_sensitive | No | Literal discovery matching case; false ignores case | |
| type_descriptor | No | DEX type including array dimensions; operand scope also accepts dotted names or literal substrings | |
| field_descriptor | No | Full field identity: Lpkg/C;->name:type | |
| reference_format | No | Reference rows or caller groups with complete evidence; default flat | flat |
| method_descriptor | No | Full method identity: Lpkg/C;->name(args)return; preserves overloads | |
| target_descriptor | No | Exact prototype for method_name selection; search_refs prototype or field-type filter |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | ||
| depth | No | ||
| edges | No | ||
| index | No | ||
| items | No | ||
| limit | No | ||
| nodes | No | ||
| total | No | ||
| format | No | ||
| groups | No | ||
| module | No | ||
| offset | No | ||
| source | No | ||
| status | Yes | ||
| backend | No | ||
| message | No | ||
| sources | No | ||
| apk_path | No | ||
| coverage | No | ||
| has_more | No | ||
| input_id | No | ||
| dex_entry | No | ||
| direction | No | ||
| max_edges | No | ||
| max_nodes | No | ||
| span_unit | No | ||
| truncated | No | ||
| apk_sha256 | No | ||
| class_name | No | ||
| edge_count | No | ||
| input_kind | No | ||
| limit_unit | No | ||
| node_count | No | ||
| session_id | No | ||
| source_end | No | ||
| superclass | No | ||
| total_unit | No | ||
| type_match | No | ||
| edge_counts | No | ||
| field_count | No | ||
| limitations | No | ||
| method_name | No | ||
| next_cursor | No | ||
| next_offset | No | ||
| query_cache | No | ||
| scan_errors | No | ||
| access_flags | No | ||
| has_manifest | No | ||
| method_count | No | ||
| source_start | No | ||
| stored_bytes | No | ||
| artifact_path | No | ||
| dynamic_sites | No | ||
| source_sha256 | No | ||
| type_relation | No | ||
| engine_version | No | ||
| returned_sites | No | ||
| artifact_sha256 | No | ||
| backend_version | No | ||
| candidate_count | No | ||
| cleanup_pending | No | ||
| page_limited_by | No | ||
| scanned_methods | No | ||
| type_descriptor | No | ||
| definition_count | No | ||
| field_descriptor | No | ||
| idle_ttl_seconds | No | ||
| reference_format | No | ||
| selected_modules | No | ||
| unresolved_sites | No | ||
| member_references | No | ||
| method_descriptor | No | ||
| truncation_reasons | No | ||
| unresolved_matches | No | ||
| reference_semantics | No | ||
| response_byte_limit | No | ||
| methods_without_code | No | ||
| reserved_index_bytes | No | ||
| runtime_completeness | No | ||
| scanned_instructions | No | ||
| hierarchy_cycle_detected | No | ||
| instruction_scan_complete | No | ||
| runtime_target_resolution | No | ||
| unresolved_sites_truncated | No | ||
| traversal_complete_within_depth | No |