dpt-shell is an Android application protection tool that implements a 'method extraction shell' for dex files. It consists of two main components: a Java-based processor (dpt.jar) that transforms Android APK/AAB packages, and a native C++ shell library that runs inside the protected app at runtime. The processor extracts bytecode from all dex methods, encrypts it with RC4, and replaces the original instructions with minimal return stubs. The encrypted bytecode and a configuration blob are stored as assets in the package. At runtime, the shell hooks into Android's class loading mechanism (via Dobby/bhook) to intercept DefineClass or LoadClass calls, decrypts the original bytecode on-the-fly, and writes it back into the dex memory region before the class is fully initialized. The tool also includes anti-tamper features such as Frida detection, libc .text CRC verification, debugger detection, and optional app signature verification. The processor supports both APK and AAB formats, handles multi-dex packages, and can optionally split classes into keep/extract sets for performance. The shell is compatible with Android 5.0+ and adapts to different Android API levels (21, 28, 35+).