> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/fundamenteals/dex-odex-and-oat-files.md).

# DEX, ODEX and OAT Files

Android apps don’t run directly from Java source code — they are **compiled into bytecode** that the Android system can execute. This bytecode is stored in **DEX (Dalvik Executable)** files and sometimes in **ODEX (Optimized Dalvik Executable)** files.

***

### **What is a DEX File?**

**DEX** stands for **Dalvik Executable**. It contains the **compiled bytecode** for an Android application.

* When you build an Android app (from Java/Kotlin), it’s first compiled into **.class** files.
* Then, all `.class` files are combined and converted into a **single `.dex` (Dalvik Executable)** file.
* The `.dex` file is optimized to run on the **Dalvik Virtual Machine (DVM)** or **Android Runtime (ART)**.

***

### **What is an ODEX File?**

**ODEX** stands for **Optimized Dalvik Executable**. It’s a **pre-optimized version of a DEX file**, created by the system to **speed up app startup time**.

#### How it Works:

* Before Android Lollipop (5.0), apps were compiled **just-in-time (JIT)** during runtime.
* To make this faster, the system would **pre-optimize** the DEX file into an ODEX file and store it separately.
* This way, the app could load faster since part of the work was already done.

***

### **Difference Between DEX and ODEX**

| Feature           | **DEX (Dalvik Executable)**                        | **ODEX (Optimized DEX)**                      |
| ----------------- | -------------------------------------------------- | --------------------------------------------- |
| **Purpose**       | Main executable code of an Android app             | Optimized version for faster loading          |
| **Location**      | Inside APK (`classes.dex`)                         | Outside APK (`/system/app/*.odex`)            |
| **Creation Time** | During app build (by developer)                    | During installation or system optimization    |
| **Editable?**     | Yes, can be decompiled (e.g., using jadx, apktool) | Harder to edit or reverse-engineer            |
| **Used In**       | All Android apps                                   | Pre-installed or system apps (older versions) |

***

### MultiDex

* Needed for apps exceeding **65,536 method limit**.
* Splits the app code into multiple DEX files:
  * `classes.dex` → primary classes
  * `classes2.dex`, `classes3.dex` → remaining classes
* **Android build system** & **MultiDex library** manage loading of multiple DEX files at runtime.

#### How MultiDex Works

1. **Splitting Code**
   * Core classes → `classes.dex`
   * Additional methods → secondary DEX files
2. **Class Loading**
   * Runtime automatically merges & loads classes as needed
3. **Manifest Changes**
   * AndroidManifest.xml updated to include MultiDex support
   * MultiDex library included in build for proper class loading

***

### **Transition to ART and OAT Files**

From **Android 5.0 (Lollipop)** onward:

* The **Dalvik VM** was replaced by **ART (Android Runtime)**.
* ART uses **Ahead-of-Time (AOT)** compilation instead of JIT.
* Instead of ODEX files, ART creates **OAT (Optimized Ahead-of-Time)** files.

***

#### **Summary**

* **DEX** → main bytecode format for Android apps.
* **ODEX** → pre-optimized DEX for older Android versions.
* **MultiDex** → solves method limit problem by splitting DEX files.
* **ART** → converts DEX to native code at installation for performance.

***

#### Resource:

* <https://developer.android.com/build/multidex>