Cross-platform APK/DEX method & field reference finder with call chain tracing, ProGuard/R8 deobfuscation, and Android hidden API detection. 5x faster than veridex.
A single tool that replaces multiple workflows for Android reverse engineering and compliance.
Search by Java class name, DEX/JNI signature, or simple keyword. dexfinder auto-detects the format and converts between them.
Trace callers up to N levels deep. Merged tree view or flat list (Java crash style). Automatic cycle detection.
Load mapping.txt to auto-deobfuscate. Query with original names, display both obfuscated and original side by side.
Load hiddenapi-flags.csv to detect blocked and unsupported Android APIs. Includes reflection-based detection via class/string cross-matching.
Text, JSON, HTML, SARIF — all orthogonal with tree/list layout and java/dex naming style. Perfect for humans and CI pipelines.
--fail-on blocked exits non-zero when restricted APIs are found. SARIF output integrates with GitHub Code Scanning.
Compare two APK versions side by side. Detect added, removed, and changed API references between releases.
Pure Go implementation with self-contained DEX parser. No external dependencies. Cross-platform: macOS, Linux, Windows.
Create .dexfinder.yaml for project defaults. Set mapping path, class filter, API flags once — CLI flags always override.
dexfinder builds a reverse index of all DEX bytecode references, enabling instant lookups and deep call chain tracing.
Read APK/DEX/JAR, extract all classes, methods, fields, and strings
Build reverse index mapping callees to callers for O(1) lookup
Match by keyword, Java name, or DEX signature with auto-detection
Walk call graph N levels deep with cycle detection
Render as text, JSON, HTML, or SARIF with deobfuscation
From simple lookups to deep call chain analysis.
# Trace who calls getDeviceId
dexfinder --dex-file app.apk \
--query "getDeviceId" --trace
TelephonyManager.getDeviceId()
└── aopsdk.TelephonyManager.getDeviceId()
├── PhoneInfo.getImei()
├── ClientIdHelper.initClientId()
│ └── ContextInfo.<init>()
│ ├── LogStrategyManager.getInstance()
│ └── LogContextImpl.<init>()
├── DeviceInfo.k()
│ └── DeviceInfo.getInstance()
└── WXEnvironment.getDevId()# Detect blocked & unsupported APIs
dexfinder --dex-file app.apk \
--api-flags hiddenapi-flags.csv
#1: Linking unsupported
Unsafe.allocateInstance()
UnsafeAllocator.create()
#2: Reflection blocked
ILocationManager.getCurrentLocation
LocationMonitor.hookSystemLocation()
# CI gate — fail on blocked APIs
dexfinder --dex-file app.apk \
--api-flags hiddenapi-flags.csv \
--fail-on blocked
# Exit: 0 = clean, 2 = violations# Query with original names
dexfinder --dex-file app.apk \
--query "KotlinCases" \
--mapping mapping.txt \
--show-obf --trace
KotlinCases.fetchLocationAsync()
└── KotlinCases$testCoroutines$3
.invokeSuspend() [obf: G7.e]
└── KotlinCases$testCoroutines$3
.create() [obf: G7.b]# Compare two APK versions
dexfinder --dex-file new.apk \
--diff old.apk \
--query "getDeviceId"
+ 1 added method(s)
+ Feature.trackDevice()
- 1 removed method(s)
- Legacy.getIMEI()
Summary: +1 added, -1 removed, ~0 changedFive formats, two layouts, two naming styles — all orthogonal and freely combinable.
Colored terminal output with tree connectors
Structured data for scripting and automation
Full MethodInfo types for IDE & CI integration
Interactive report with search & dark theme
GitHub Code Scanning & VS Code integration
Reverse-index optimization makes dexfinder 5x faster than veridex on large APKs.
| APK Size | DEX Files | Classes | Method Refs | Scan Time |
|---|---|---|---|---|
| ~1 MB | 1 | ~2K | ~18K | 24ms |
| ~10 MB | 2 | ~25K | ~100K | 335ms |
| ~300 MB | 30+ | ~180K | ~1.2M | 3.9s |
Lower is better
Control what kind of references to match — callees, callers, strings, or everything.
Choose your preferred installation method.
brew install junelegency/tap/dexfindercurl -sSL https://raw.githubusercontent.com/JuneLeGency/dexfinder/main/install.sh | bashgo install github.com/JuneLeGency/dexfinder/cmd/dexfinder@latestStart analyzing your APK in one command.
# Show APK overview
dexfinder --dex-file app.apk --stats
# Find all calls to a method
dexfinder --dex-file app.apk --query "getDeviceId"
# Trace call chains as merged tree
dexfinder --dex-file app.apk --query "getDeviceId" --trace
# Hidden API detection
dexfinder --dex-file app.apk --api-flags hiddenapi-flags.csv
# Generate HTML report
dexfinder --dex-file app.apk --query "getDeviceId" \
--trace --format html --output report.htmlOpen source, zero dependencies, and fast. Get started now.