Android DEX Bytecode
| Format | Android DEX Bytecode |
|---|---|
| Short name | DEX |
| Category | execution |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Compiled Android application bytecode executed by the Android Runtime (ART). Found as classes.dex (and classes2.dex, classes3.dex in multi-DEX apps) inside APK packages, which are ZIP archives. Decompilation can recover app logic, hardcoded API keys, credentials, server endpoints, and encryption keys. OAT/ODEX/VDEX companions show the app was compiled for the device; they do not by themselves prove it was executed (preinstalled apps are compiled when the system image is built).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 64 65 78 0A | dex. | DEX magic ('dex\n'), followed by a 3-digit version and NUL |
Known extensions
.dex
References
- DEX format specification (AOSP) https://source.android.com/docs/core/runtime/dex-format
- jadx — DEX to Java decompiler https://github.com/skylot/jadx
- apktool — APK reverse engineering https://apktool.org/
Cite this entry
Crush Format Reference, “Android DEX Bytecode”. https://kalink0.github.io/crush-forensics/formats/dex/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction