rust_ASC

rust_ASC is a stateless Android APK and DEX decompiler with millisecond cross-reference search, written in Rust. It queries the compiled artifact directly instead of building a global index, so there is no preprocessing step, no persistent cache, and no multi-gigabyte memory footprint.

It is the Rust implementation of MG1937/ASC, the Python reference project, and preserves the same source layout, data structures, control flow and runtime behavior. On the CLI workloads below it is approximately 10× faster than the Python version.

Presented at Black Hat Europe Arsenal: Droid ASC: R8 Compiler Optimization as a DeCompiler Primitive.

Repository links:

• Python reference implementation: MG1937/ASC
• Rust implementation: MG1937/rust_ASC
• Full-APK pseudocode exporter: MG1937/radguard

https://github.com/user-attachments/assets/f1f71a75-1eca-4647-89ce-406ed2c63c6b

Features

• Search code references for strings, types, methods, and fields across every DEX in an APK.
• Locate and decompile one class directly from an APK.
• List classes and decode AndroidManifest.xml.
• Export pseudocode for every class in an APK with the public API of MG1937/radguard.
• Handle multi-DEX APKs and DEX 041 logical containers.
• Use memory-mapped APK access and no on-disk cache.
• Expose CLI queries as MCP tools over stdio.

Why it is fast

• Stateless by design: no preprocessing, no global index build, no disk cache.
• The APK is memory-mapped, and only the DEX entries a query needs are inflated.
• Cross-DEX scans run in parallel, so a search over dozens of DEX files stays in the millisecond range.
• R8 output is already highly structured. Searches jump to candidate offsets directly instead of rebuilding a bloated cross-reference database.
• On a hit, rust_ASC rebuilds a minimal self-consistent DEX in memory and decompiles it immediately.

Build

radguard is a Git submodule. Clone it with the main repository:

git clone --recurse-submodules https://github.com/MG1937/rust_ASC.git
cd rust_ASC
cargo build --release

For an existing checkout:

git submodule update --init --recursive
cargo build --release

MCP is enabled by default. Build only the original CLI with:

cargo build --release --no-default-features

The executable is written to:

target/release/rust_ASC

On Windows, the executable name is rust_ASC.exe.

Command Line Usage

Thread control is consistent across getclass, listclass, findrefs, and export:

• Use only --thread <N>.
• Put --thread immediately after the subcommand.
• If omitted, the command uses the number returned by Rust's available_parallelism() API.

# Search every code reference to a string.
rust_ASC findrefs --thread 10 --debug app.apk string https://

# Search a type, method, or field.
rust_ASC findrefs --thread 10 app.apk type com.example.Main
rust_ASC findrefs --thread 10 app.apk method onCreate --class com.example.Main
rust_ASC findrefs --thread 10 app.apk field apiKey --class com.example.Main

# Decompile one class from an APK.
rust_ASC getclass --thread 10 --debug app.apk com.example.Main
rust_ASC getclass --thread 10 app.apk com.example.Main -o Main.java

# List all classes, optionally filtered by package/class prefix.
rust_ASC listclass --thread 10 app.apk
rust_ASC listclass --thread 10 --prefix com.example app.apk

# Decode AndroidManifest.xml.
rust_ASC getmanifest app.apk -o AndroidManifest.xml

# Export pseudocode for every class to the required output directory.
rust_ASC export --thread 10 --debug app.apk output

export writes one .java pseudocode file per class under package-relative paths in the output directory. Its multi-threaded APK export pipeline is supplied by MG1937/radguard. With --debug, it reports the APK export lifecycle and worker activity.

MCP

rust_ASC mcp runs a stdio MCP server that exposes the CLI commands as tools: getclass, listclass, getmanifest, and findrefs. Each call spawns a fresh CLI process, so behavior always matches the command line.

Configure it in your MCP client:

{
  "mcpServers": {
    "asc": {
      "command": "/absolute/path/to/rust_ASC",
      "args": ["mcp"]
    }
  }
}

Benchmark

rust_ASC vs JADX

Same APKs, same workloads. JADX figures are from the ASC benchmark suite.

Global string cross-reference search

Single-class decompile

CLI peak memory

Disk cache

JADX spends seconds to minutes per operation and gigabytes of memory. rust_ASC answers in tens to low hundreds of milliseconds and keeps a small resident set. Because every query is cheap and stateless, a user or an AI agent can move across dozens or hundreds of APKs on a weak machine, where JADX would need several GB just to preload one.

rust_ASC CLI details

The following measurements use CLI commands with no cache, no preprocessing, and direct searches of every code reference to the string https://.

• CLI string-reference search: search all code references to https:// directly from the APK, without cache or preprocessing.
• CLI single-class decompile: locate and decompile the named class directly from the APK.
• Persistent cache: disk cache written by the tool after command completion.

Full APK Pseudocode Export Benchmark

Full-APK pseudocode export is provided through MG1937/radguard's public export_to_directory API and uses its shared parallel APK export pipeline. The following benchmark fully decompiles TencentQQ.apk (383 MB, 41 DEX files).

The worker count is a global export budget. The exporter overlaps APK/DEX processing with class decompilation while bounding per-DEX concurrent class work.

License

Licensed under the Apache License, Version 2.0.