DexKit is a high-performance C++ library for runtime parsing and querying of Android DEX bytecode, primarily used by Xposed module developers to locate obfuscated classes, methods, and fields. It provides a rich DSL in Kotlin/Java for constructing structural queries based on annotations, opcodes, string usage, field/method references, and more. The core engine parses DEX files from APK archives, builds in-memory indexes, and uses algorithms like Aho-Corasick for substring matching and the Hungarian algorithm for unordered set matching. Communication between the native C++ layer and JVM is handled via FlatBuffers serialization. The library also includes an optional caching layer (`DexKitCacheBridge`) for persisting query results across app restarts. It is distributed as an Android AAR via Maven Central and includes a demo app and unit tests.
jadx is a production-grade Android DEX/APK to Java source decompiler, providing both a command-line tool (jadx-cli) and a feature-rich Swing GUI (jadx-gui). The architecture is a multi-module Gradle project with a plugin system for input formats (DEX, Java class files, Smali, AAB, XAPK), decompilation passes, resource handling, and deobfuscation. The core decompilation pipeline uses a visitor pattern over a custom intermediate representation (IR) with type inference, SSA construction, region-based control flow, finally block extraction, and code generation. The codebase is actively maintained with a large test suite, but exhibits technical drift through deprecated APIs, complex state machines, and some unmaintained code paths. The plugin system and zip reader module are well-isolated and potentially reusable.
Dexmaker is a set of libraries that enable runtime bytecode generation and mocking on Android, primarily to support Mockito test frameworks. It provides two mocking modes: a proxy-based approach (dexmaker-mockito) that generates subclasses via the Dalvik bytecode generation API, and an inline approach (dexmaker-mockito-inline) that uses a JVMTI agent to transform class bytecode at runtime, allowing mocking of final and static methods. The core module (dexmaker) offers a low-level, fluent API for constructing DEX files programmatically, including types, methods, fields, and bytecode instructions. This is complemented by a C++ library (slicer) that reads, writes, and instruments DEX files, used by the inline mock maker to inject hooks into methods. The project is deeply integrated with Android internals, using hidden APIs and native agents, and is actively maintained to keep up with Android platform changes. It serves as the primary mocking solution for Android instrumentation tests where Java bytecode-based mocks (like ByteBuddy) are not available.
dpt-shell is a sophisticated Android application protection framework that implements a 'hollow shell' obfuscation technique. It functions as a two-part system: a Java-based CLI processor (dpt) that analyzes and modifies target APK/AAB files, and a native Android shell (shell) that is injected into the target application. The processor extracts method bytecode (CodeItem) from the original Dex files, encrypts them, and replaces the original code with NOP instructions. At runtime, the injected shell hooks Android's class loading mechanisms (DefineClass/LoadClass) using native libraries (Dobby, bhook), decrypts the stored bytecode, and patches the memory of the loaded Dex file to restore the original code before execution. This architecture provides runtime code integrity verification and anti-tampering capabilities. The codebase demonstrates high craftsmanship in both Java and C++. The Java processor utilizes smali/dexlib2 for bytecode manipulation and implements a robust rule-based exclusion system for framework classes. The C++ shell implements low-level memory management, ELF parsing, and dynamic hooking to intercept Android Runtime (ART) operations. It includes anti-debugging, anti-Frida, and signature verification features. The project targets very recent Android SDK versions (36) and build tools (Gradle 8.14), indicating active development and forward-looking compatibility.
SushiSwap 2.0 is a multi-chain decentralized exchange (DEX) frontend built as a monorepo (pnpm, Turborepo) with Next.js App Router, React, and a shared UI library. It provides swap (simple, limit, DCA, TWAP), cross-chain swap (via LI.FI and Near Intents), perpetual futures (Hyperliquid-based), liquidity pools (V2/V3/Blade/Steer vaults), a token launchpad, staking (xSUSHI), and a developer portal (Zitadel auth, team management, API keys). The codebase supports EVM, SVM (Solana), Stellar, and Aptos chains, with namespace-aware wallet providers (Wagmi, Privy, Stellar Wallets Kit) and unified data fetching via TanStack Query and a custom GraphQL client. The architecture is heavily componentized, with reusable patterns like the Checker system (guards for connect/network/amounts), Provider composition (balance, price, trade state), and a design system in packages/ui. Testing includes Vitest unit tests and Playwright e2e with Anvil forks. The repo is actively maintained but carries moderate technical drift due to multi-chain duplication, hardcoded external API endpoints, and deprecated features (Blade pools, Arbitrum Nova minimization).