> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/fundamenteals/android-virtual-machine-avm.md).

# Android Virtual Machine (AVM)

**Android Virtual Machine** is a part of the Android system that runs Android apps. It allows apps written in **Java (or Kotlin)** to run on **any Android device**, regardless of its hardware. This VM serves as an intermediate layer between the application and the underlying Android Operating System (OS) and device hardware.

***

### Why Android Needs a Virtual Machine

Unlike a normal computer, Android phones and tablets use many different:

* **Processors (ARM, x86, etc.)**
* **Memory sizes**
* **Chipsets**

A **virtual machine (VM)** makes Android apps **portable** — the same app can run on any device because the VM handles the translation of app code into instructions the device can understand.

***

## **Types of Virtual Machines**

### **1. Dalvik Virtual Machine (DVM)**

* Used in **older Android versions** (before Android 5.0 Lollipop).
* Created by Google specifically for mobile devices (low memory & low CPU).
* Runs **Dalvik Executable (.dex)** files.
* Each app runs in its **own Dalvik instance**, providing process isolation (sandboxing).
* Uses **Just-In-Time (JIT)** compilation — it compiles parts of the code only when needed at runtime, saving space but using more CPU time.

### **2. Android Runtime (ART)**

* Replaced Dalvik in **Android 5.0 (Lollipop)** and later versions.
* Still runs `.dex` files, but faster and more efficiently.
* Uses **Ahead-Of-Time (AOT)** compilation — app code is compiled into native machine code **when installed**, not while running.
* Benefits:
  * Faster execution (less lag)
  * Better battery life
  * Less runtime overhead
  * Improved debugging and profiling

#### **Comparison: Dalvik vs ART**

| Feature          | Dalvik VM                       | ART (Android Runtime)            |
| ---------------- | ------------------------------- | -------------------------------- |
| Compilation type | Just-In-Time (JIT)              | Ahead-Of-Time (AOT)              |
| Performance      | Slower (compiles while running) | Faster (compiled during install) |
| Storage usage    | Smaller (no precompiled code)   | Larger (stores compiled code)    |
| Battery usage    | Higher                          | Lower                            |
| Introduced in    | Android 1.0                     | Android 5.0 (Lollipop)           |

#### **How It Works (Simplified Flow)**

1. You write an app in **Java/Kotlin**.
2. The code is compiled into **Java bytecode (.class)** files.
3. The Android build tools convert those into a **.dex** (Dalvik Executable) file.
4. The **Virtual Machine (Dalvik or ART)** runs the `.dex` file inside a sandboxed environment.
5. The VM translates this into native machine code that the CPU executes.

***

{% hint style="success" %}

* **DEX** → Standard bytecode format used by apps on the **Google Play Store**.
* **ODEX (Optimized DEX)** → Used by **OEMs (device manufacturers)** to pre-optimize system apps and speed up the device’s boot time.
* **OAT (Optimized Ahead-of-Time)** → Introduced with **Android Runtime (ART)** for further **performance optimization**.
  * OAT files are generated when an app is installed and offer **better performance and startup times** compared to ODEX files.
    {% endhint %}

### Reference

* <https://stackoverflow.com/questions/9913702/why-does-android-need-a-virtual-machinedvm>