Expand description
The asc-rs engine: stateless, zero-preprocessing queries against an APK.
Engine::get_class_dexinflates the DEX entries in parallel (smallest first) and stops as soon as one defines the requested class.Engine::find_refsruns a reference search over every DEX entry in parallel and streams results back as each DEX completes.Engine::get_classrebuilds a minimal DEX containing only the target class and renders it as smali.Engine::list_classeslists the classes of every DEX entry in order.Engine::manifest_xmldecodes the binaryAndroidManifest.xml.
Optionally the engine keeps inflated DEX entries in an on-disk cache
(shared across processes) and/or an in-memory LRU together with the locator
tables built for them, so repeated queries skip inflation and table builds.
The disk cache also keeps the locator tables (L2, mapped by later
processes instead of rebuilt) and find_refs results (L3); see
asc_cache for the tiers.
Disk writes happen on a background thread so a query never waits on them;
Engine::flush_cache_writes waits for them to land and Engine::close_cache_writes
(run on drop) additionally stops queueing new ones.
Re-exports§
Modules§
- condition
- The condition language of findrefs rules and callgraph endpoints.
- config
- The user’s configuration of threads, memory and the disk cache: one
table of settings (
Config::KEYS), each taken from (first wins) a command-line flag, its environment variable, the config file (Config::file_path), or its default.autodefaults follow the machine (Device) and the user’s other busy processes. - hints
- What to tell an agent when a lookup comes up empty: that a class belongs to the framework, the classes or members it probably meant, why a search found nothing. Only computed on those paths, so it may scan the APK.
- names
- Class-name normalisation shared by the CLI and MCP.
- text
- The text form shared by every tool: one record per line,
|between columns, strings quoted and escaped as JSON does (asc_arsc::quote).
Structs§
- Application
- Busy
- Marks this process busy in the user’s process registry while a request
(an MCP tool call, a daemon command) runs, so the others split the CPUs
with it from its first moment (
auto_threads) and take them back as soon as it ends. Nested and concurrent requests count once. - Cache
Config - Cache configuration for an
Engine. - Cache
Stats - Cache activity counters.
- Cached
Entry - A cached inflated entry.
- Call
Query - A call graph query.
- CallRow
- One line of the tree, in depth-first order.
- Call
Tree - Result of
Engine::call_graph. - Claim
- One entry’s part in a
DexDedup. - Class
Hit - A DEX (possibly one logical DEX of a 041 container) that defines a class.
- Class
Listing - A class definition and the (logical) DEX that defines it.
- Class
Query - Class part of a member query.
- Class
Source - Result of a full
getclass. - Compiled
Query - A
Querywith every regular expression it needs compiled up front. - Component
- Data
Spec - Device
- The machine’s memory and CPUs, as the automatic budgets see them.
- DexClasses
- The classes one logical DEX defines, in
class_deforder. - DexDedup
- Content keys claimed by the entries of one sweep.
- Engine
- Engine over one APK.
- Entry
Classes - The classes of one DEX entry: its logical DEXes, or why it could not be read.
- Find
Options - Options of
Engine::find_refs_opts. - Hierarchy
Query - A hierarchy query.
- Hierarchy
Row - One line of the tree, in depth-first order.
- Hierarchy
Tree - Result of
Engine::hierarchy. - Inflate
Limits - Caps on what reading an APK may inflate, against zip bombs. The default
only rejects what Deflate cannot produce;
Limits::guardedis for sweeping untrusted APKs in bulk. - Intent
Filter - Logical
Dex - One logical DEX of a cached entry with its lazily built locator tables. The tables are shared with the entry that replaces this one once its bytes are remapped from the disk cache (same bytes, so still valid).
- Manifest
Summary - Matching
Methods - The methods whose code matches each query of a
Engine::matching_methodscall, and its notes. - Member
Query - Method or field query: at least one of
class/namemust be set. - Memory
Policy - How a memory cache follows the machine: a share of the memory the user’s resident hosts could hold together, split between them.
- Permission
- Prebuild
Report - What
Engine::prebuilddid. - RefBatch
- Results for one DEX, delivered as soon as its search completes.
- RefResult
- One aggregated reference result: a method and what it references.
- RefSite
- One instruction behind a
RefResult. - RefSummary
- Summary of a whole
find_refsrun. - Resource
Row - One resource matching a
Engine::search_resourcesquery. - Search
Target - An APK opened for a search whose DEX entries are scheduled by the caller,
e.g. across many APKs at once (
Engine::search_target). - Shared
Cache - A cache several
Engines share, so a process serving many APKs keeps one memory budget (the LRU is keyed by APK) and one disk-writer thread. Engines attached withEngine::with_shared_cacheleave queued disk writes alone when dropped; dropping theSharedCacheflushes them and stops queueing (as dropping a private engine does). - Smali
Options - Rendering options.
- Text
Rows - Rows of one DEX entry as text, one per line, each ending in
\n: whatRefResult::linewould print for them, in the same order.
Enums§
- Call
Roots - Where a call graph starts.
- Class
Relation - How a class relates to the target of an
Extends/Implementsquery. - Direction
- Which way to walk.
- Engine
Error - Field
Access - How a Dalvik field instruction uses its referenced field.
- Lineage
- Which way to walk the hierarchy.
- Matched
- A constant a
RefResultmatched. - RefContext
- How much code to return with each
findrefsrow. - Resource
Field - What
Engine::search_resourcesmatches against. - Threads
- Worker threads of a search.
Constants§
- DEFAULT_
FAN_ OUT - Most classes of the program that may define a supertype’s method for a
dispatch set to follow the calls naming it (
Query::Virtual’sfan_out). An AIDL interface has itsStub,Stub.Proxy,Defaultand a service or two; an abstract base a handful of subclasses. A functional interface (Runnable, Kotlin’sFunctionN) or a lifecycle callback has hundreds to thousands, and its calls say nothing about which of them runs. - MAPPED_
CHARGE_ DIVISOR - The memory cache charges file-backed bytes (mapped from the disk cache or the APK) at this fraction of their size, heap bytes in full.
Functions§
- archive_
of - The archive of a program a DEX of it comes from, by the DEX’s name
(
app/Tele.apkforapp/Tele.apk/classes2.dex, also as a logical DEX...classes2.dex!classes1.dex);Nonefor a lone archive’s. - auto_
threads - Worker threads of a search whose caller fixed none: this machine’s CPUs
split between this process and the user’s other busy registered ones
(
auto_threads_for). Re-read at most once per [THREADS_EVERY], so a sweep follows the others starting and finishing their scans (crate::Threads::wait_turn). - auto_
threads_ for - [
OVERSUBSCRIBE] xcpusworkers split evenly between this process andbusy_others, at mostcpusand at least 2 (where there are 2): a scan on one thread gives up its overlap of inflating one entry while searching another. Up to 4 busy processes each keep every CPU. - available_
memory - Bytes of memory available to this process: on Linux
MemAvailable, lowered to the headroom left under a cgroup v2memory.max; on Apple systems the free, speculative and inactive pages.Noneelsewhere. - compile_
rules - Compile every rule; the first invalid one fails them all.
- decompile_
dex_ class - Rebuild
descriptorout ofbufand disassemble it. - decompile_
dex_ class_ method decompile_dex_classrendering onlymethod(name(params)ret) when given.- dex_
classes - Enumerate the classes of one logical DEX whose descriptor starts with
prefix(a descriptor prefix, used as is;Nonekeeps every class). Unreadableclass_defs are counted and skipped. - find_
refs_ in_ dex - Run a reference search over one DEX buffer and return structured results.
- find_
refs_ in_ dex_ opts find_refs_in_dexwith a context.- find_
refs_ lines - Python
AscHandler.findrefsequivalent: formatted lines for one DEX. - parse_
id 0x7f0d0001/7f0d0001/@0x7f0d0001.- protection_
level_ name android:protectionLevelflags as text (signature|privileged).- results_
from_ hits - Turn raw hits into display results (grouped per method when
aggregate). - total_
memory - Physical memory, lowered to a cgroup v2
memory.max.Nonewhere it cannot be read.