How to Inspect classes.dex in Android Apps

How to Inspect classes.dex Inside an Android App
If you are analyzing an Android APK during reverse engineering or mobile security testing, classes.dex is one of the first files worth inspecting.
A quick look at the DEX file can tell you what Android bytecode it contains, reveal class and method names, and help you understand the app before moving to a full decompilation.

---

1. Identify the classes.dex File​

Start by checking the file type:

file classes.dex

A typical result looks like:

classes.dex: Dalvik dex file version 035

The 035 value identifies the DEX format version used by the file.

---

2. Inspect the DEX Header​

You can open classes.dex in a hex editor and inspect the first bytes of the file.
A DEX file using version 035 starts with the following magic value:

64 65 78 0a 30 33 35 00

This represents:

dex\n035\0

The header is useful because it immediately confirms that you are dealing with a Dalvik/DEX file rather than an ordinary binary.
💡 Important: DEX itself is not compressed in the same way as a ZIP archive. If you extracted classes.dex from an APK, the APK's ZIP compression is separate from the internal DEX format.

---

3. Search for Readable Strings​

One useful early step is searching the DEX file for readable strings.
You may find class names, method names, messages, URLs, configuration values, and other strings used by the application.
For example:

Button has not been started
com/example/app/MainActivity

You can also search for strings from the command line:

strings classes.dex | less

Finding readable strings does not mean that the entire application is unprotected. It simply means that those particular strings are stored in a form that can be recovered easily.
This can give you useful clues before performing a complete decompilation.

---

4. Disassemble the DEX File​

Android's SDK Build Tools include dexdump, which can display information and disassembled Dalvik bytecode from a DEX file.
For example:

dexdump -d classes.dex | less

This lets you inspect methods, registers, instructions, class information, and other details without having the original source code.
⚠️ Note: dexdump displays Dalvik bytecode in its own disassembly format. It is not exactly the same syntax produced by dedicated Smali disassembly tools.

---

5. What Is Smali?​

Smali is a human-readable assembly-like representation of Android's Dalvik bytecode.
It is commonly used when analyzing or modifying Android applications because it exposes instructions, registers, method calls, branches, and return values at a low level.
For example, this Java code:

if (isRooted()) {
return false;
}

can be represented in Smali as:

invoke-virtual {p0}, Lcom/example/app/MainActivity;->isRooted()Z
move-result v0
if-eqz v0, :cond_0
const/4 v0, 0x0
return v0

The exact output depends on the original application and the disassembler being used, but the important idea is that Smali exposes the low-level operations performed by the application.

---

Why Smali Matters for Mobile Pentesting​

For a mobile pentester, understanding DEX and Smali is useful because an Android application can often be analyzed without access to its original source code.

You can inspect things such as:

• Application logic and control flow.
• Class and method names.
• Security-related checks.
• Hardcoded configuration values.
• API endpoints and other strings.
• Root detection logic.
• Debugging or testing conditions.
• How different components interact.

In an authorized security assessment, Smali can also be used to understand how a particular check works and, when appropriate, test how the application behaves when that logic is changed.
🔎 The key advantage: you are working with the application's compiled bytecode rather than depending on the original source code being available.

---

A Simple DEX Analysis Workflow​

A practical starting workflow looks like this:

1. Identify the file with file.
2. Inspect the DEX magic and header.
3. Search for useful strings.
4. Disassemble the bytecode with dexdump.
5. Use a DEX-to-Smali tool when you need standard Smali syntax.
6. Trace interesting classes, methods, and security checks.
7. Analyze the application behavior in an authorized testing environment.

This approach lets you move from a basic file inspection to detailed bytecode analysis without immediately jumping into a full decompilation.

---

Why Start With classes.dex?​

An Android APK is essentially an archive containing application code, resources, metadata, and other files. The classes.dex file contains the compiled Android bytecode that runs on the device.
That makes it a valuable starting point during Android reverse engineering.
You do not need the original Java or Kotlin source code to begin understanding the application's behavior. With basic DEX inspection and Smali knowledge, you can follow the application's compiled logic and identify areas that deserve deeper analysis.

---

Frequently Asked Questions​

-------------------

Can I read classes.dex without the original source code?​

Yes. You can inspect the DEX bytecode and disassemble it even when the original Java or Kotlin source code is unavailable.

Is classes.dex encrypted by default?​

No. Android's normal DEX format is not an encrypted format. However, applications can use obfuscation, packing, encryption of selected data, or other protection mechanisms that make analysis harder.

Does dexdump convert DEX directly into Smali?​

Not exactly. dexdump disassembles and displays Dalvik bytecode. Tools designed specifically for DEX-to-Smali conversion can produce standard Smali source files.

Why is Smali useful for pentesting?​

Smali makes compiled Android logic easier to inspect at the bytecode level. It can help security testers understand application behavior, trace security checks, and investigate how specific functions work during an authorized assessment.

Do I need the APK source code to analyze an Android application?​

No. The compiled DEX files inside an APK can be analyzed independently, although having the original source code can make some investigations much easier.