What is frida-dexdump?

Frida-dexdump is a command-line tool for security researchers and malware analysts who work with Android applications. Its purpose is to extract compiled Android code from a running app's memory so that the analyst can inspect what the app is actually doing. Android apps are distributed in a format that includes compiled code files called DEX files. Some apps, particularly malicious ones, try to hide their real behavior by packing or encrypting these files so they look different on disk than they do at runtime. When the app runs, it unpacks the real code into memory. Frida-dexdump takes advantage of that moment by scanning the device's memory while the app is running and pulling out the DEX data it finds there, saving it to disk for analysis. The tool is built on top of Frida, which is an established framework for instrumenting running processes on Android and other platforms. Because it runs through Frida, it works on all Android versions that Frida supports and does not require modifying the device's system partition. Installation is a single pip command, and typical usage involves one short command to target the app currently in the foreground. A key feature is a deep search mode, enabled with a flag, that looks for DEX files even when their internal header information is damaged or incomplete. This is useful because some apps deliberately corrupt their DEX headers as an additional obfuscation measure. The deep search takes longer but finds more complete results. The output is saved to a folder named after the target app by default, and the output path can be changed with a command-line option.