AwesomeREA.org

Tool

Droid ASC

Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. It probes compressed DEX entries in place, uses the layout that the R8 compiler’s constant relocation and instruction deduplication leave behind to search string, type, method and field references across DEX files, and for a requested class rebuilds a minimal, self-consistent DEX in memory that a bundled copy of Androguard’s decompiler turns into Java. The droidasc CLI and Tk GUI list classes, decompile single classes, decode AndroidManifest.xml and find subclasses or interface implementations; the README presents it as a lightweight back end for agents analyzing many APKs.

Requirements and limitations

  • Latest release at review: dev-0.1.2-post2, published 2026-10-14 without binary assets and matching PyPI’s droidasc 0.1.2.post2; the reviewed main commit adds only two README notes. The project began in June 2026. The README now says it has been rewritten 1:1 in Rust as the separate rust_ASC repository, which adds full-APK decompilation and is to be updated in sync; rust_ASC and the linked Black Hat Europe Arsenal listing were not reviewed.
  • Install with pip install droidasc or from source. pyproject.toml requires Python 3.10+ with axml and mutf8, and CI runs the unit, integration and GUI suites and gates performance regressions on Ubuntu with Python 3.11 and 3.12. APK and DEX inputs come from the user; the README’s benchmark APKs are not in the repository, and the DEX inside the test fixture holds only AndroidX, Kotlin and Material Components library classes.
  • Speed and memory figures are author-reported: on Telegram X, WhatsApp, Grab and Lark APKs of 59–352 MB with 10 threads, the README reports string-reference searches 62–302× and single-class decompilation 38–304× faster than JADX while using 36–141 MB, and says JADX ran out of memory on the largest. Java output comes from the bundled Androguard decompiler, one class at a time. The README targets agent workflows but describes no MCP server; agents call the CLI or Python package.
  • Apache-2.0; the bundled dadguard package carries Androguard code, which is also Apache-2.0. Decompiled code keeps the rights of the app’s owner. Nothing was installed or run, and no APK was analyzed.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · MG1937/ASC · Revision 60033d1
  2. README.md#L1-L13 GitHub · MG1937/ASC · Revision 60033d1
  3. README.md#L15-L66 GitHub · MG1937/ASC · Revision 60033d1
  4. pyproject.toml GitHub · MG1937/ASC · Revision 60033d1
  5. tests/TESTING.md GitHub · MG1937/ASC · Revision 60033d1
  6. .github/workflows/tests.yml GitHub · MG1937/ASC · Revision 60033d1
  7. dadguard/__init__.py GitHub · MG1937/ASC · Revision 60033d1
  8. LICENSE GitHub · MG1937/ASC · Revision 60033d1
  9. https://github.com/MG1937/ASC/releases/tag/dev-0.1.2-post2
  10. https://pypi.org/project/droidasc/0.1.2.post2/