C++

Utilities

bool LIEF::DEX::is_dex(const std::string &file)

Check if the given file is a DEX.

bool LIEF::DEX::is_dex(const std::vector<uint8_t> &raw)

Check if the given raw data is a DEX.

dex_version_t LIEF::DEX::version(const std::string &file)

Return the DEX version of the given file.

dex_version_t LIEF::DEX::version(const std::vector<uint8_t> &raw)

Return the DEX version of the raw data.

---

Parser

class Parser

Class which parses a DEX file to produce a DEX::File object.

Public Functions

Parser &operator=(const Parser &copy) = delete

Parser(const Parser &copy) = delete

Public Static Functions

static std::unique_ptr<File> parse(const std::string &file)

Parse the DEX file from the file path given in parameter.

static std::unique_ptr<File> parse(std::vector<uint8_t> data, const std::string &name = "")

---

File

class File : public LIEF::Object

Class that represents a DEX file.

Public Types

using classes_t = std::unordered_map<std::string, Class*>

using classes_list_t = std::vector<std::unique_ptr<Class>>

using it_classes = ref_iterator<classes_list_t&, Class*>

using it_const_classes = const_ref_iterator<const classes_list_t&, const Class*>

using methods_t = std::vector<std::unique_ptr<Method>>

using it_methods = ref_iterator<methods_t&, Method*>

using it_const_methods = const_ref_iterator<const methods_t&, const Method*>

using strings_t = std::vector<std::unique_ptr<std::string>>

using it_strings = ref_iterator<strings_t&, std::string*>

using it_const_strings = const_ref_iterator<const strings_t&, const std::string*>

using types_t = std::vector<std::unique_ptr<Type>>

using it_types = ref_iterator<types_t&, Type*>

using it_const_types = const_ref_iterator<const types_t&, const Type*>

using prototypes_t = std::vector<std::unique_ptr<Prototype>>

using it_prototypes = ref_iterator<prototypes_t&, Prototype*>

using it_const_prototypes = const_ref_iterator<const prototypes_t&, const Prototype*>

using fields_t = std::vector<std::unique_ptr<Field>>

using it_fields = ref_iterator<fields_t&, Field*>

using it_const_fields = const_ref_iterator<const fields_t&, const Field*>

Public Functions

File &operator=(const File &copy) = delete

File(const File &copy) = delete

dex_version_t version() const

Version of the current DEX file.

std::string_view name() const

Name of this file.

void name(const std::string &name)

std::string_view location() const

Location of this file.

void location(const std::string &location)

const Header &header() const

DEX header.

Header &header()

it_const_classes classes() const

All classes used in the DEX file

it_classes classes()

bool has_class(const std::string &class_name) const

Check if the given class name exists.

const Class *get_class(const std::string &class_name) const

Return the DEX::Class object associated with the given name.

Class *get_class(const std::string &class_name)

const Class *get_class(size_t index) const

Return the DEX::Class object associated with the given index.

Class *get_class(size_t index)

dex2dex_info_t dex2dex_info() const

De-optimize information.

std::string dex2dex_json_info() const

De-optimize information as JSON.

it_const_methods methods() const

Return an iterator over all the DEX::Method used in this DEX file.

it_methods methods()

it_const_fields fields() const

Return an iterator over all the DEX::Field used in this DEX file.

it_fields fields()

it_const_strings strings() const

String pool.

it_strings strings()

it_const_types types() const

Type pool.

it_types types()

it_prototypes prototypes()

Prototype pool.

it_const_prototypes prototypes() const

const MapList &map() const

DEX Map.

MapList &map()

std::string save(const std::string &path = "", bool deoptimize = true) const

Extract the current dex file and deoptimize it.

std::vector<uint8_t> raw(bool deoptimize = true) const

virtual void accept(Visitor &visitor) const override

~File() override

Friends

friend std::ostream &operator<<(std::ostream &os, const File &file)

---

Header

class Header : public LIEF::Object

Class which represents the DEX header. This is the first structure that begins the DEX format.

The official documentation is provided here: https://source.android.com/devices/tech/dalvik/dex-format#header-item

Public Types

using location_t = std::pair<uint32_t, uint32_t>

using magic_t = std::array<uint8_t, 8>

using signature_t = std::array<uint8_t, 20>

Public Functions

Header()

Header(const Header&)

Header &operator=(const Header&)

template<class T>
Header(const T &header)

magic_t magic() const

The DEX magic bytes (DEX\n followed by the DEX version).

uint32_t checksum() const

The file checksum.

signature_t signature() const

SHA-1 DEX signature (which is not really used as a signature).

uint32_t file_size() const

Size of the entire file (including the current the header).

uint32_t header_size() const

Size of this header. It should be 0x70.

uint32_t endian_tag() const

File endianness of the file.

uint32_t map() const

Offset from the start of the file to the map list (see: DEX::MapList).

location_t strings() const

Offset and size of the string pool.

location_t link() const

location_t types() const

location_t prototypes() const

location_t fields() const

location_t methods() const

location_t classes() const

location_t data() const

uint32_t nb_classes() const

uint32_t nb_methods() const

virtual void accept(Visitor &visitor) const override

~Header() override

Friends

friend std::ostream &operator<<(std::ostream &os, const Header &hdr)

---

Method

class Method : public LIEF::Object

Class which represents a DEX::Method.

Public Types

using access_flags_list_t = std::vector<ACCESS_FLAGS>

using bytecode_t = std::vector<uint8_t>

Public Functions

Method()

Method(std::string name, Class *parent = nullptr)

Method(const Method&)

Method &operator=(const Method&)

std::string_view name() const

Name of the Method.

bool has_class() const

True if a class is associated with this method.

const Class *cls() const

DEX::Class associated with this Method or a nullptr if not resolved.

Class *cls()

uint64_t code_offset() const

Offset to the Dalvik Bytecode.

const bytecode_t &bytecode() const

Dalvik Bytecode as bytes.

size_t index() const

Index in the DEX Methods pool.

bool is_virtual() const

True if this method is a virtual one. i.e. not static, private, final or constructor.

const Prototype *prototype() const

Method’s prototype or a nullptr if it is not resolved.

Prototype *prototype()

void insert_dex2dex_info(uint32_t pc, uint32_t index)

virtual void accept(Visitor &visitor) const override

const dex2dex_method_info_t &dex2dex_info() const

bool has(ACCESS_FLAGS f) const

Check if the current method has the given ACCESS_FLAGS.

access_flags_list_t access_flags() const

ACCESS_FLAGS as an std::set.

const CodeInfo &code_info() const

~Method() override

Friends

friend std::ostream &operator<<(std::ostream &os, const Method &mtd)

---

Class

class Class : public LIEF::Object

Class which represents a DEX Class (i.e. a Java/Kotlin class).

Public Types

using access_flags_list_t = std::vector<ACCESS_FLAGS>

using methods_t = std::vector<Method*>

using it_methods = ref_iterator<methods_t&>

using it_const_methods = const_ref_iterator<const methods_t&>

using fields_t = std::vector<Field*>

using it_fields = ref_iterator<fields_t&>

using it_const_fields = const_ref_iterator<const fields_t&>

using it_named_methods = filter_iterator<methods_t&>

using it_const_named_methods = const_filter_iterator<const methods_t&>

using it_named_fields = filter_iterator<fields_t&>

using it_const_named_fields = const_filter_iterator<const fields_t&>

Public Functions

Class()

Class(const Class&) = delete

Class &operator=(const Class&) = delete

Class(std::string fullname, uint32_t access_flags = ACCESS_FLAGS::ACC_UNKNOWN, Class *parent = nullptr, std::string source_filename = "")

std::string_view fullname() const

Mangled class name (e.g. Lcom/example/android/MyActivity;).

std::string package_name() const

Package Name.

std::string name() const

Class name.

std::string pretty_name() const

Demangled class name.

bool has(ACCESS_FLAGS f) const

Check if the class has the given access flag.

access_flags_list_t access_flags() const

Access flags used by this class.

std::string_view source_filename() const

Filename associated with this class (if any).

bool has_parent() const

True if the current class extends another one.

const Class *parent() const

Parent class.

Class *parent()

it_const_methods methods() const

Methods implemented in this class.

it_methods methods()

it_named_methods methods(const std::string &name)

Return Methods having the given name.

it_const_named_methods methods(const std::string &name) const

it_const_fields fields() const

Fields implemented in this class.

it_fields fields()

it_named_fields fields(const std::string &name)

Return Fields having the given name.

it_const_named_fields fields(const std::string &name) const

dex2dex_class_info_t dex2dex_info() const

De-optimize information.

size_t index() const

Original index in the DEX class pool.

virtual void accept(Visitor &visitor) const override

~Class() override

Public Static Functions

static std::string package_normalized(const std::string &pkg_name)

static std::string fullname_normalized(const std::string &pkg_cls)

static std::string fullname_normalized(const std::string &pkg, const std::string &cls_name)

Friends

friend std::ostream &operator<<(std::ostream &os, const Class &cls)

---

Field

class Field : public LIEF::Object

Class which represents a DEX Field.

Public Types

using access_flags_list_t = std::vector<ACCESS_FLAGS>

Public Functions

Field()

Field(std::string name, Class *parent = nullptr)

Field(const Field&)

Field &operator=(const Field&)

std::string_view name() const

Name of the Field.

bool has_class() const

True if a class is associated with this field (which should be the case).

const Class *cls() const

Class associated with this Field.

Class *cls()

size_t index() const

Index in the DEX Fields pool.

bool is_static() const

True if this field is a static one.

const Type *type() const

Field’s prototype.

Type *type()

virtual void accept(Visitor &visitor) const override

bool has(ACCESS_FLAGS f) const

Check if the field has the given ACCESS_FLAGS.

access_flags_list_t access_flags() const

ACCESS_FLAGS as a list.

~Field() override

Friends

friend std::ostream &operator<<(std::ostream &os, const Field &mtd)

---

Code Info

class CodeInfo : public LIEF::Object

Public Functions

CodeInfo()

CodeInfo(const details::code_item &codeitem)

CodeInfo(const CodeInfo&)

CodeInfo &operator=(const CodeInfo&)

virtual void accept(Visitor &visitor) const override

uint16_t nb_registers() const

~CodeInfo() override

Friends

friend std::ostream &operator<<(std::ostream &os, const CodeInfo &cinfo)

---

Prototype

class Prototype : public LIEF::Object

Class which represents a DEX method prototype.

Public Types

using parameters_type_t = std::vector<Type*>

using it_params = ref_iterator<parameters_type_t>

using it_const_params = const_ref_iterator<const parameters_type_t>

Public Functions

Prototype()

Prototype(const Prototype &other)

const Type *return_type() const

Type returned or a nullptr if not resolved.

Type *return_type()

it_const_params parameters_type() const

Types of the parameters.

it_params parameters_type()

virtual void accept(Visitor &visitor) const override

~Prototype() override

Friends

friend std::ostream &operator<<(std::ostream &os, const Prototype &type)

---

Type

class Type : public LIEF::Object

Class which represents a DEX type as described in the format specifications: https://source.android.com/devices/tech/dalvik/dex-format#typedescriptor.

Public Types

enum class TYPES

Values:

enumerator UNKNOWN = 0

enumerator PRIMITIVE = 1

enumerator CLASS = 2

enumerator ARRAY = 3

enum class PRIMITIVES

Values:

enumerator VOID_T = 0x01

enumerator BOOLEAN = 0x02

enumerator BYTE = 0x03

enumerator SHORT = 0x04

enumerator CHAR = 0x05

enumerator INT = 0x06

enumerator LONG = 0x07

enumerator FLOAT = 0x08

enumerator DOUBLE = 0x09

using array_t = std::vector<Type>

Public Functions

Type()

Type(const std::string &mangled)

Type(const Type &other)

TYPES type() const

Whether it is a primitive type, a class, …

const Class &cls() const

const array_t &array() const

const PRIMITIVES &primitive() const

Class &cls()

IF the current type is a TYPES::CLASS, return the associated DEX::CLASS. Otherwise the returned value is undefined.

array_t &array()

IF the current type is a TYPES::ARRAY, return the associated array. Otherwise the returned value is undefined.

PRIMITIVES &primitive()

IF the current type is a TYPES::PRIMITIVE, return the associated PRIMITIVES. Otherwise the returned value is undefined.

size_t dim() const

Return the array dimension if the current type is an array. Otherwise it returns 0.

const Type &underlying_array_type() const

In the case of a TYPES::ARRAY, return the array’s type.

Type &underlying_array_type()

virtual void accept(Visitor &visitor) const override

~Type() override

Public Members

Class *cls_ = {nullptr}

array_t *array_

PRIMITIVES *basic_

Public Static Functions

static std::string pretty_name(PRIMITIVES p)

Friends

friend std::ostream &operator<<(std::ostream &os, const Type &type)

---

MapList

class MapList : public LIEF::Object

Class which represents the map_list structure that follows the main DEX header.

This MapList aims at referencing the location of other DEX structures as described in https://source.android.com/devices/tech/dalvik/dex-format#map-item

Public Types

using items_t = std::map<MapItem::TYPES, MapItem>

using it_items_t = ref_iterator<std::vector<MapItem*>>

using it_const_items_t = const_ref_iterator<std::vector<MapItem*>>

Public Functions

MapList()

MapList(const MapList&)

MapList &operator=(const MapList&)

it_items_t items()

Iterator over LIEF::DEX::MapItem.

it_const_items_t items() const

bool has(MapItem::TYPES type) const

Check if the given type exists.

const MapItem &get(MapItem::TYPES type) const

Return the LIEF::DEX::MapItem associated with the given type.

MapItem &get(MapItem::TYPES type)

Return the LIEF::DEX::MapItem associated with the given type.

const MapItem &operator[](MapItem::TYPES type) const

Return the LIEF::DEX::MapItem associated with the given type.

MapItem &operator[](MapItem::TYPES type)

Return the LIEF::DEX::MapItem associated with the given type.

virtual void accept(Visitor &visitor) const override

~MapList() override

Friends

friend std::ostream &operator<<(std::ostream &os, const MapList &mtd)

---

MapItem

class MapItem : public LIEF::Object

Class which represents an element of the MapList object.

Public Types

enum class TYPES : uint16_t

Values:

enumerator HEADER = 0x0000

enumerator STRING_ID = 0x0001

enumerator TYPE_ID = 0x0002

enumerator PROTO_ID = 0x0003

enumerator FIELD_ID = 0x0004

enumerator METHOD_ID = 0x0005

enumerator CLASS_DEF = 0x0006

enumerator CALL_SITE_ID = 0x0007

enumerator METHOD_HANDLE = 0x0008

enumerator MAP_LIST = 0x1000

enumerator TYPE_LIST = 0x1001

enumerator ANNOTATION_SET_REF_LIST = 0x1002

enumerator ANNOTATION_SET = 0x1003

enumerator CLASS_DATA = 0x2000

enumerator CODE = 0x2001

enumerator STRING_DATA = 0x2002

enumerator DEBUG_INFO = 0x2003

enumerator ANNOTATION = 0x2004

enumerator ENCODED_ARRAY = 0x2005

enumerator ANNOTATIONS_DIRECTORY = 0x2006

Public Functions

MapItem()

MapItem(TYPES type, uint32_t offset, uint32_t size, uint16_t reserved = 0)

MapItem(const MapItem&)

MapItem &operator=(const MapItem&)

TYPES type() const

The type of the item.

uint16_t reserved() const

Reserved value (likely for alignment purpose).

uint32_t size() const

The number of elements (the real meaning depends on the type).

uint32_t offset() const

Offset from the start of the DEX file to the items associated with the underlying TYPES.

virtual void accept(Visitor &visitor) const override

~MapItem() override

Friends

friend std::ostream &operator<<(std::ostream &os, const MapItem &item)