ejfkdev/ddc

English | 简体中文

ddc decompiles Android DEX bytecode back into readable Java — at real-world app scale, queryable like a database, and javac-verified: every one of the 909,689 files it emits across seven real-world APKs parses cleanly.

• Fast — a 226 MB / 20-dex APK (weibo, 98k classes) fully decompiles in ~13s at high quality, a 62 MB app (Telegram) in ~4.5s; pathological classes run on deadline-bounded monitored threads instead of hanging the run.
• Compiles — the full output of all seven benchmark APKs (reqable, Telegram, WhatsApp, weibo, weixin, qq, lark — 0.91M files) passes javac with zero syntax errors; every class of a case-variant name pair (X/Cua vs X/cua) is preserved as its own file instead of the last one silently overwriting.
• Progressive decompilation — 15 query subcommands (strings, cross-references, hierarchies, manifest, resources, per-method decompiles) answer in milliseconds: query metadata first, decompile on demand, skip the full run entirely.
• DEX 035–041, complete — multi-dex APKs, XAPK/APKS/APKM containers, invoke-custom; lambdas and string concats fold back into real Java ((a) -> …, Cls::name, a + b).
• Readable output — jadx-style local names (str, getName() → name, Kotlin Intrinsics parameter strings) instead of v12; IntDef literals render as their constants out of the box (setVisibility(8) → View.GONE; a built-in android-37 domain table, --symbols overrides); Kotlin null-check noise is elided and synthetic access$NNN bridges inline at their call sites.
• Reproducible output — no timestamps; two runs diff cleanly.
• Human-shaped output, by default (cure): every file goes through a semantic-preserving source-level pass that inlines register-copy chains, folds if/else assignments into ternaries, recovers for-each, drops dead stores and compiler artifacts — −15% output lines on real corpora with identical javac-gate results. The pass is exact, so it costs time: weibo (110k files) takes 23.4 s optimized vs 11.5 s with --fast (skip the simplification, keep formatting).
• HTTP REST + MCP, built in (xyz-rust): ddc serve exposes every query as a REST route (GET with query params or POST with a JSON body) plus GET /openapi.json and a streamable MCP endpoint at /mcp — point an MCP client at http://addr/mcp; ddc http is REST-only (no /mcp); ddc mcp stdio|http runs the same commands as MCP tools with input and output schemas. Query commands take --format auto|text|table|markdown|md|json|jsonl (auto: table on a terminal, the stable text form when piped).
• Bilingual CLI — messages localize automatically (DDC_LANG=zh|en forces; English fallback).
• Built on jdc-core, the machine-neutral core shared with jcdc.

macOS (Homebrew):

brew install ejfkdev/tap/ddc

Windows (Scoop) — add the bucket once, then install by name (scoop does not resolve a bare user/repo/app form — issue #3):

scoop bucket add ejfkdev https://github.com/ejfkdev/scoop-bucket
scoop install ddc

# or install straight from the manifest URL, no bucket needed:
scoop install https://raw.githubusercontent.com/ejfkdev/scoop-bucket/main/bucket/ddc.json

cargo-binstall (any platform — fetches the prebuilt release binary instead of compiling):

cargo binstall ddc-cli

Binaries: every release ships raw binaries (no archives) for linux-amd64, linux-arm64, windows-amd64, windows-arm64, macos-amd64 and macos-arm64 — non-macOS builds UPX-compressed.

From source (Rust stable):

git clone https://github.com/ejfkdev/ddc && cd ddc
cargo build --release

ddc app.apk                          # full decompile → app-out/
ddc app.apk -c com.example.Foo       # one class to stdout
ddc app.apk -o - | less              # everything to stdout

ddc info app.apk                      # app context (label via arsc, package,
                                      # version, md5) + per-dex counts
ddc mainactivity app.apk             # entry point: package + launcher
ddc findrefs app.apk string token    # every const-string "token" site
ddc getmethod app.apk Foo.toString   # one method, all overloads
ddc pkg app.apk --app -o own/        # the app's own code only

Full options and examples: ddc --help (subcommand menu grouped by workflow). The complete reference — every option's semantics, every subcommand's output format and behavior — lives in docs/cli.md (中文).

Seven real-world APKs, release build, measured after a cooldown (Apple Silicon, 6P+12E). The 39-APK validation corpus (4.08M decompiled files, per-APK wall time / peak RSS / javac parse gate) is in docs/validation.md (中文).

Query subcommands on the same APKs (cells: time / peak RSS; strings -f <package> --with-locations, findrefs on the package string and method onCreate, hierarchy/disasm/getclass on each app's launcher class):

Erased types (DEX has no Signature); d8-desugared -$$Lambda$ classes stay separate files; a few R8 monster methods degrade via timeout (and a handful of deadline-truncated ones can vary between runs); pattern-switch renders as desugared dispatch chains. The javac gate above is a SYNTAX gate — semantic diagnostics (missing Android classpath, and in rare register-heavy monster methods a type-confused local) remain in the output. For scale: a full-classpath javac battery over four corpora currently sits at ~7,500 ddc-attributable errors across 0.91M files (v0.1.19 measured 11,345 — see benchmarks); jadx on the same battery lands at roughly half that, the gap concentrated in type recovery. Details: architecture.

cargo test    # 74 tests

MIT © ejfkdev