I’m trying to analyse compiled Dalvik code, but I found a problem. Here is a specification of .dex format. I can get header of the file, but I couldn’t understand what is going on next – when I use dexdump I have classes right next to header:
class_defs_off : 61836 (0x00f18c)
data_size : 368612
data_off : 72312 (0x011a78)
Class #0 header:
class_idx : 62
access_flags : 1536 (0x0600)
But when I look at my bytecode there is something other. I can’t understand what going next to header. According to specification it is string_idi's, but I’m not sure. What is the real structure of .dex files?
The spec you refer to does in fact accurately portray how dex files are structured. (Note: I wrote that document.)
Dexdump doesn’t output the full contents of a dex file in order, which explains some of your confusion. The
dxtool can output an annotated listing of dex file contents when it generates a dex file. You might find this useful. Sorry, I don’t remember the options offhand, but it’ll be something like--dex --dump-to=file.txt --dump-bytes.I hope this helps.