Deep dive into DEX files byte-by-byte

on YouTube ↗42m

" summary

Explains DEX internals: header magic and checksums, string/type/proto/field/method tables stored as indices into shared pools, and code items holding register‑based instructions. Shows javac + d8 output and how debug builds place filenames and constructors in string and type tables. Demonstrates LEB128 encoding and that method_id.proto_idx is a 16‑bit ushort causing the 65,536 prototype limit, and how multidex classloader reflection appends secondary DEX tables to work around it.

AI-written summary · about

" chapters (12)

1. 0:00Introduction and contest
2. 1:17DEX file overview
3. 9:10DEX file header structure
4. 13:08Strings and type IDs tables
5. 15:41Prototypes and field IDs
6. 18:33Class definitions and encoded values
7. 24:02Class data and executable code
8. 28:19Exception handling in DEX
9. 32:37The 64K problem and multidex
10. 35:56DEX vs JAR and class files
11. 40:27Uncovered structures and resources
12. 41:11Q&A and closing

" related talks

• 41mDigging into D8 and R8Jake Wharton · droidCon NYC 2018
• 29mBytecode analysis for everyone!Konstantin Zolotov · AndroidMakers by droidcon 2024
• 33mReverse - Engineering apps on the device - how far can we go?Jeb Ware · droidcon London 2019
• 35mUnderstanding the Kotlin to Dalvik bytecode translationRuben Pieters · droidcon Berlin 2025
• 27mClojure and AndroidDaniel Solano Gómez · Clojure/conj 2011
• 42mUnderstanding the Kotlin to Dalvik bytecode translationRuben Pieters · droidcon London 2025
• 31mDABiD: The Powerful Interactive Android Debugger for Android Malware AnalysisJin-hyuk Jung, Jieun Lee · Black Hat Asia 2015
• 37mPack your Android: Everything you need to know about Android BoxingSwapna Deshmukh · OWASP AppSec California 2018