Deep Dive into the Android Dex File Format

The article begins with an introduction to the Dex (Dalvik Executable) format, explaining its purpose as the bytecode format for the Android platform, highlighting its advantages over traditional class files in terms of reduced size and I/O operations.

It then describes the generation process of Dex files using the d8 (or dx) command, providing an example command line:

d8 Demo.class Demo1.class --debug --file-per-class --lib SDK\platforms\android-29\android.jar --classpath ./ --output Demo

and explains the meaning of flags such as --debug, --file-per-class, --lib, --classpath, and --output.

The core of the article details the Dex file structure, breaking down each section: the file header (including magic, checksum, version, sizes and offsets of various tables), string IDs table, type IDs table, prototype IDs table, field IDs table, method IDs table, class definitions, class data, map list, and bytecode. For each section, it explains the relevant fields and provides illustrative hex dumps from a sample DexDemo.dex file, such as the header occupying 112 bytes, and an example bytecode sequence 6201 01 00 1A 00 02 00 6E 20 03 00 01 00 0E 00 which disassembles to a series of Dalvik instructions.

The article further explains encoding formats used in Dex, namely ULEB128, SLEB128, and ULEB128p1, with diagrams showing how values are encoded in little-endian base‑128 format, and includes references to the Android source code (e.g., art/libartbase/base/leb128.h) for implementation details.

It also covers endianness, describing big‑endian and little‑endian byte order with the example 0x12345678 stored as 0x12345678 (big‑endian) versus 0x78563412 (little‑endian).

Finally, the article introduces the dexdump tool as a utility for inspecting Dex files, noting the -d flag that disassembles bytecode to aid in understanding execution flow, and concludes with a summary of how mastering Dex format helps in learning the ART virtual machine.