MG1937 / rust_ASC

# rust_ASC
**rust_ASC is a stateless Android APK and DEX decompiler with millisecond cross-reference search, written in Rust.** It queries the compiled artifact directly instead of building a global index, so there is no preprocessing step, no persistent cache, and no multi-gigabyte memory footprint.
It is the Rust implementation of MG1937/ASC, the Python reference project, and preserves the same source layout, data structures, control flow and runtime behavior. On the CLI workloads below it is approximately **10× faster** than the Python version.
Presented at Black Hat Europe Arsenal: Droid ASC: R8 Compiler Optimization as a DeCompiler Primitive.
Repository links:
- Python reference implementation: MG1937/ASC
- Rust implementation: MG1937/rust_ASC
- Full-APK pseudocode exporter: MG1937/radguard
https://github.com/user-attachments/assets/f1f71a75-1eca-4647-89ce-406ed2c63c6b
## Features
- Search code references for strings, types, methods, and fields across every DEX in an APK.
- Locate and decompile one class directly from an APK.
- List classes and decode `AndroidManifest.xml`.
- Export pseudocode for every class in an APK with the public API of MG1937/radguard.
- Handle multi-DEX APKs and DEX 041 logical containers.
- Use memory-mapped APK access and no on-disk cache.
- Expose CLI queries as MCP tools over stdio.
## Why it is fast
- Stateless by design: no preprocessing, no global index build, no disk cache.
- The APK is memory-mapped, and only the DEX entries a query needs are inflated.
- Cross-DEX scans run in parallel, so a search over dozens of DEX files stays in the millisecond range.
- R8 output is already highly structured. Searches jump to candidate offsets directly instead of rebuilding a bloated cross-reference database.
- On a hit, rust_ASC rebuilds a minimal self-consistent DEX in memory and decompiles it immediately.
## Build
`radguard` is a Git submodule. Clone it with the main repository:
 [code] 
For an existing checkout:
 [code] 
MCP is enabled by default. Build only the original CLI with:
 [code] 
The executable is written to:
 [code] 
On Windows, the executable name is `rust_ASC.exe`.
## Command Line Usage
Thread control is consistent across `getclass`, `listclass`, `findrefs`, and `export`:
- Use only `--thread `.
- Put `--thread` immediately after the subcommand.
- If omitted, the command uses the number returned by Rust's `available_parallelism()` API.
 [code] 
`export` writes one `.java` pseudocode file per class under package-relative paths in the output directory. Its multi-threaded APK export pipeline is supplied by MG1937/radguard. With `--debug`, it reports the APK export lifecycle and worker activity.
## MCP
`rust_ASC mcp` runs a stdio MCP server that exposes the CLI commands as tools: `getclass`, `listclass`, `getmanifest`, and `findrefs`. Each call spawns a fresh CLI process, so behavior always matches the command line.
Configure it in your MCP client:
 [code] 
## Benchmark
### rust_ASC vs JADX
Same workloads. JAD