clsdumper

       _         _
   ___| |___  __| |_   _ _ __ ___  _ __   ___ _ __
  / __| / __|/ _` | | | | '_ ` _ \| '_ \ / _ \ '__|
 | (__| \__ \ (_| | |_| | | | | | | |_) |  __/ |
  \___|_|___/\__,_|\__,_|_| |_| |_| .__/ \___|_|
                                   |_|

Android Dynamic Class Dumper — dump all DEX files from running Android apps using Frida.

clsdumper hooks into a running (or freshly spawned) Android application and extracts every DEX file it can find using 9 different strategies. It works against apps with anti-Frida protections, packed/encrypted DEX files, and dynamically loaded code.

Features

• 9 extraction strategies — ART runtime walk, function hooking, memory scanning, OAT/VDEX parsing, and more
• Anti-Frida bypass — blocks signal-handler registration, filters /proc/self/maps, neutralizes watchdog threads
• Spawn & attach — start the app fresh or hook into an already running process
• Automatic deduplication — agent-side fast hash + host-side SHA-256
• Class extraction — optionally decompile DEX files into individual .smali classes via androguard
• Works without Java bridge — native strategies run outside Java.perform(), so they work even when the Java bridge crashes

Quick Start

# Install from PyPI
pip install clsdumper

# Dump DEX from a running app (USB-connected device)
clsdumper com.example.app

# Spawn the app and dump
clsdumper com.example.app --spawn

# Attach by PID
clsdumper 12345

Requirements

• Python 3.10+
• Rooted Android device with frida-server running
• USB debugging enabled (or use --host for TCP)

Usage

clsdumper [target] [options]

Examples

# Use specific strategies only
clsdumper com.example.app --strategies fart_dump,oat_extract

# Spawn with class extraction
clsdumper com.example.app --spawn --extract-classes

# Connect to remote frida-server
clsdumper com.example.app --host 192.168.1.100

# List all installed apps
clsdumper --list-apps

Strategies

Default set: all except mmap_hook (causes performance issues when combined with other hooks).

Building from Source

The Frida agent is pre-built and included as clsdumper/frida/scripts/agent.js. To modify the agent:

# Install agent dependencies
cd agent && npm install

# Build the TypeScript agent
npm run build

# Install the Python package
cd .. && pip install -e .

How It Works

clsdumper runs in three phases:

1. Phase 0 — Anti-Frida bypass: Hooks sigaction/signal to block anti-debugging signal handlers, replaces /proc/self/maps reads via memfd_create, and monitors pthread_create to neutralize watchdog threads.

2. Phase 1 — Native strategies: Runs outside Java.perform() using direct memory access and native function hooks. This works even when the Java bridge fails (common with heavily protected apps).

3. Phase 2 — Java strategies: Uses the Java bridge to inspect ClassLoaders and hook class loading. Falls back gracefully if the bridge is unavailable.

All found DEX files are deduplicated (fast djb2 hash on the agent, SHA-256 on the host) and saved with metadata including the strategy that found them.

Output

dump_com.example.app/
  dex/
    classes_001.dex    # Dumped DEX files
    classes_002.dex
    ...
  classes/             # Only with --extract-classes
    com/example/...
  metadata.json        # Dump metadata and per-file info

License

MIT