Dalvik executable file
application/x-dex
Magic Bytes
Offset: 0
64 65 78 0A
The Dalvik Executable (DEX) format is a compiled bytecode specification developed by Google for the Android operating system. It aggregates multiple classes and associated data into a single binary file to optimize execution within the Android Runtime or the legacy Dalvik Virtual Machine. Although the format is fundamentally safe, security professionals frequently scrutinize these files during malware analysis because they contain the essential executable instructions that define an application's functional behavior.
Validation Code
How to validate .dex files in Python
Python
def is_dex(file_path: str) -> bool:
"""Check if file is a valid DEX by magic bytes."""
signature = bytes([0x64, 0x65, 0x78, 0x0A])
with open(file_path, "rb") as f:
return f.read(4) == signatureHow to validate .dex files in Node.js
Node.js
function isDEX(buffer: Buffer): boolean {
const signature = Buffer.from([0x64, 0x65, 0x78, 0x0A]);
return buffer.subarray(0, 4).equals(signature);
}
Go
func IsDEX(data []byte) bool {
signature := []byte{0x64, 0x65, 0x78, 0x0A}
if len(data) < 4 {
return false
}
return bytes.Equal(data[:4], signature)
}API Endpoint
GET
/api/v1/dex
curl https://filesignature.org/api/v1/dex