ddc — DEX → Java decompiler in Rust

English | 简体中文

ddc decompiles Android DEX bytecode back into readable Java — at real-world app scale, queryable like a database, and javac-verified: every one of the 909,689 files it emits across seven real-world APKs parses cleanly.

• Fast — a 226 MB / 20-dex APK (weibo, 98k classes) fully decompiles in 5.0s, a 398 MB bundle (Lark) in 5.5s; pathological classes run on deadline-bounded monitored threads instead of hanging the run.
• Compiles — the full output of all seven benchmark APKs (reqable, Telegram, WhatsApp, weibo, weixin, qq, lark — 0.91M files) passes javac with zero syntax errors; every class of a case-variant name pair (X/Cua vs X/cua) is preserved as its own file instead of the last one silently overwriting.
• Progressive decompilation — 20+ query subcommands (strings, cross-references, hierarchies, manifest, resources, per-method decompiles) answer in milliseconds: query metadata first, decompile on demand, skip the full run entirely.
• DEX 035–041, complete — multi-dex APKs, XAPK/APKS/APKM containers, invoke-custom; lambdas and string concats fold back into real Java ((a) -> …, Cls::name, a + b).
• Readable output — jadx-style local names (str, getName() → name, Kotlin Intrinsics parameter strings) instead of v12; IntDef literals render as their constants out of the box (setVisibility(8) → View.GONE; a built-in android-37 domain table, --symbols overrides); Kotlin null-check noise is elided and synthetic access$NNN bridges inline at their call sites.
• Reproducible output — no timestamps; two runs diff cleanly.
• Bilingual CLI — messages localize automatically (DDC_LANG=zh|en forces; English fallback).
• Built on jdc-core, the machine-neutral core shared with jcdc.

macOS (Homebrew):

brew install ejfkdev/tap/ddc

Windows (Scoop):

scoop install ejfkdev/scoop-bucket/ddc

cargo-binstall (any platform — fetches the prebuilt release binary instead of compiling):

cargo binstall ddc-cli

Binaries: every release ships raw binaries (no archives) for linux-amd64, linux-arm64, windows-amd64, windows-arm64, macos-amd64 and macos-arm64 — non-macOS builds UPX-compressed.

From source (Rust stable):

git clone https://github.com/ejfkdev/ddc && cd ddc
cargo build --release

ddc app.apk                          # full decompile → app-out/
ddc app.apk -c com.example.Foo       # one class to stdout
ddc app.apk -o - | less              # everything to stdout

ddc info app.apk                      # app context (label via arsc, package,
                                      # version, md5) + per-dex counts
ddc mainactivity app.apk             # entry point: package + launcher
ddc findrefs app.apk string token    # every const-string "token" site
ddc getmethod app.apk Foo.toString   # one method, all overloads
ddc pkg app.apk --app -o own/        # the app's own code only

Full options and examples: ddc --help (subcommand menu grouped by workflow). The complete reference — every option's semantics, every subcommand's output format and behavior — lives in docs/cli.md (中文).

Seven real-world APKs, release build, 3-run averages (Apple Silicon, 6P+12E). The 39-APK validation corpus (4.08M decompiled files, per-APK wall time / peak RSS / javac parse gate) is in docs/validation.md (中文).

Query subcommands on the same APKs (cells: time / peak RSS; strings -f <package> --with-locations, findrefs on the package string and method onCreate, hierarchy/disasm/getclass on each app's launcher class):

Erased types (DEX has no Signature); d8-desugared -$$Lambda$ classes stay separate files; a few R8 monster methods degrade via timeout (and a handful of deadline-truncated ones can vary between runs); pattern-switch renders as desugared dispatch chains. The javac gate above is a SYNTAX gate — semantic diagnostics (missing Android classpath, and in rare register-heavy monster methods a type-confused local) remain in the output. Details: architecture.

cargo test    # 56 tests

MIT © ejfkdev