Droid ASC probes APKs directly, claiming 269x faster search and 125x less memory than jadx

A zero-index take on APK analysis

Anyone who has pointed jadx at a few-hundred-megabyte APK knows the routine: memory climbs into the gigabytes, the progress bar crawls for tens of minutes, and the run sometimes ends in an out-of-memory failure. According to a post on dev.to, an open-source tool called Droid ASC, unveiled in the Black Hat Europe 2026 Arsenal, is built to eliminate that wait.

Its central premise is that a decompiler does not need to unpack an APK and build a global index before anything can be searched. Droid ASC instead treats the APK as a database that is queried on demand: strings, types, methods and fields are located directly inside the compressed artefact, and only relevant code is ever decompiled.

The claimed numbers

The dev.to post reports the project's own benchmarks, run against four commercial APKs with ten threads and jadx as the control. On a 59 MB TelegramX build, a global string search took 493 ms against 20 seconds for jadx, and memory use was 36 MB against 1,016 MB. On the 352 MB Douyin package, jadx's global search failed with an out-of-memory error at 49 percent progress after roughly eight minutes, while Droid ASC returned results in 1.79 seconds using 141 MB.

Across the test set, the post claims search speeds up to 269 times faster, single-class decompilation up to 222 times faster, and memory use up to 125 times lower than jadx. Droid ASC also writes no disk cache, where jadx was measured writing between 119 MB and 322 MB of index data. These figures come from the tool's author rather than an independent review, and jadx may fare differently on other workloads.

How the zero-index design works

The post describes four techniques behind the performance:

• Direct probing of the Deflate stream: a dense Huffman lookup table lets the tool read only the metadata blocks it needs, without fully decompressing the APK.
• Leveraging R8 compiler behaviour: R8's deterministic constant propagation and instruction de-duplication physically concentrate code in DEX files, which Droid ASC exploits for fast searching.
• Constant-time instruction-to-method mapping, achieved without building any map table.
• Minimal DEX reconstruction: on a hit, only the target class and its dependent bytecode are assembled into a small, self-consistent DEX in memory and decompiled immediately.

The whole process is stateless, with no preprocessing and no disk caching, and leaves nothing on the machine after it exits.

Installation and everyday use

The project is pure Python and lives on GitHub under MG1937/ASC. It depends on androguard as its decompilation backend, mutf8 for Dalvik string encoding, and Tkinter for the interface, with no heavyweight requirements beyond those.

A GUI mode offers package browsing, global search across strings, types, methods and fields, decompiled source viewing, identifier renaming and a Manifest viewer, which the post likens to a second-generation jadx-gui. On the command line, getclass extracts a single class to source, accepting either dotted names such as com.poc.Main or Dalvik descriptors, and findrefs performs global reference searches with fuzzy matching, optional class filters, file output and per-stage timing. Both commands expose a thread count for concurrency.

Why it matters

For red teams, bug bounty hunters and security response centre work, the post argues that time is the real budget: faster triage of large APKs converts directly into broader coverage, and hardcoded secrets or API surfaces that once took minutes to surface now appear in seconds. The tiny memory footprint makes very large targets practical on modest hardware, and the absence of any disk cache suits emergency response situations where leaving artefacts behind is undesirable. Two caveats are worth holding onto: the benchmarks are author-run and compare against jadx only, and the tool decompiles on demand rather than producing a full project tree, so workflows built around jadx's complete output may still want both tools within reach. The author recommends Droid ASC for authorised testing only.