DexSQL schema reference

This reference describes each built-in relation: what one row means, its keys, columns and nullability. Use resolved views for ordinary analysis and base tables for DEX structure.

? marks a nullable column. Utf8, Utf8View and string dictionaries are text in SQL; Dynamic can hold different SQL value types. Indices are scoped by file_id, except strings, whose key is (string_pool_id, string_idx). Ordinals start at zero. Byte offsets end in _off; instruction addresses use 16-bit code units.

Text is stored as raw MUTF-8 and decoded at the output boundary; see text values. The catalog’s Utf8 type names describe SQL text, not its internal byte encoding.

For the schema in your executable, use dexsql tables --input app.apk or MCP list_tables / describe_table.

Choose a relation

Entity views

types

One row per type the current dex references (one type_ids entry).

protos

One row per method prototype the current dex references (one proto_ids entry).

Parameters follow DEX order. No parameters means param_count = 0 and param_descriptors = ''.

fields

One row per field the current dex references (one field_ids entry). This is a reference relation, not a definition relation — see References and definitions; for the fields a class itself declares, use class_fields.

methods

One row per method ID referenced by a DEX, whether or not that DEX defines the method. The key is (file_id, method_idx). The same descriptor can occur in multiple DEX files.

access_flags, method_kind, opcode_count and opcode_hex are NULL on reference-only rows: the DEX does not declare the method, so its bytecode, if any, lives in another file. A declared method without a code item (abstract or native) has opcode_count = 0 and opcode_hex = ''. Use class_methods for definitions.

classes

One row per class definition. A type that is only referenced appears in types, not here. superclass_descriptor and source_file are optional. interface_count counts directly declared interfaces; their names are in class_interfaces.

Reference and member views

method_strings

One row per string-referencing instruction: one string constant used inside one method. A method that references the same string twice has two rows.

method_calls

One row per call instruction. Unprefixed columns describe the caller; callee* columns describe the target referenced by the instruction. Repeated calls remain separate rows. Overrides and runtime dispatch are not expanded. See call queries.

method_field_accesses

One row per field-access instruction. using_type is lowercase get for reads or put for writes. The method columns identify the caller; the field columns identify the referenced field.

method_used_types

One row per type-referencing instruction (check-cast, new-instance, and so on).

method_using_numbers

One row per instruction that loads an immediate numeric constant. long_value contains a sign-extended integer or the raw floating-point bits; double_value contains the numeric floating value and is NULL for byte/short constants.

proto_params

One row per parameter of a prototype. Same data as protos.param_descriptors in a different shape: one row per parameter here, one joined string there.

class_methods

One row per method definition in class data, keyed by (file_id, method_idx). Includes direct and virtual methods, including abstract/native declarations. Additional prototype and opcode columns are available in methods with the same key.

class_interfaces

One row per interface directly declared by a class or interface. Inherited interfaces are not expanded. A type with no directly declared interfaces has no rows here.

annotation_elements_resolved

One row per owner, annotation and top-level element. A marker annotation with no elements still produces a row with NULL element columns. An annotation shared by several owners produces rows for each owner.

retention_policy maps visibility 0/1/2 to class/runtime/system. owner_kind is class, field, method or parameter. Use annotation_values to inspect nested elements.

annotation_values

One row per owner and encoded-value node at any nesting depth. Marker annotations with no elements produce no rows. The owner-free value tree is in annotation_elements; use that table for byte ranges and raw value_index references. See annotation queries.

Strings and annotations

strings

One row per string-pool entry, including constants, names and descriptors. value retains raw MUTF-8 and is filterable directly with WHERE value = '…' or WHERE value LIKE '%needle%'.

class_fields

One row per field definition (a class's class-data member). This is the definition-side counterpart to fields, the same relationship class_methods has to methods — see References and definitions. The columns carry a field_ prefix: field_name / field_descriptor correspond to fields' name / descriptor.

annotations

One row per DEX annotation_item, uniquely keyed by (file_id, annotation_off). It has no owner columns: several owners can reference the same item through annotation sets. Use the resolved annotation views for ownership and annotation_elements for values.

annotation_elements

One row per encoded-value node, uniquely keyed by (file_id, annotation_off, value_off). depth = 0 identifies top-level elements. A direct child has depth one greater and lies inside the parent byte range [value_off, value_end_off). Shared items are stored once here.

DEX layout

dex_files

One row per LOGICAL dex; each classes*.dex in an APK/ZIP becomes a separate row, and so does each logical dex inside a DEX 041 container.

map_items

Exposes the dex map_list; it describes the type, size, and start offset of each section in the current dex.

id_items

Uniformly exposes the raw item offsets of the various id sections; suited to low-level layout inspection.

IDs and class data

type_ids

The raw type_ids section: one row per type, holding only the string id of its descriptor. The readable types view is built over this.

type_lists

Summary of raw type_list structures; both proto parameter lists and class interface lists reference them.

type_list_entries

Splits each type_list into per-entry rows.

Lists are shared by offset. Both prototype parameters and class interfaces can reference the same list.

proto_ids

Raw DEX proto_id_item rows. Readable text and parameter aggregation live in the protos view.

field_ids

The raw field_ids section: one row per field id, holding only the three indices DEX stores. The readable fields view is built over this.

method_ids

The raw method_ids section: one row per method id, holding only the three indices DEX stores. The readable methods view is built over this.

class_defs

The raw class_def_item records — DEX INDICES only, one row per declared class, in class-def record order. Every readable spelling of these indices lives in the classes view; this is where the offsets that address the class's other structures live.

class_data_items

Summary of a class class_data_item, recording field/method group counts and byte range.

class_data_methods

One row per method definition in class-data, carrying its access flags and which encoded list held it (direct / virtual). A method_id this dex only references has no row here — that is the source of the NULLs in methods.access_flags and methods.method_kind; see References and definitions. For a readable form with class and method names, use the class_methods view.

class_static_values

Initial values of class static fields; maps the static_values_off encoded array back onto static fields in order.

Method handles and call sites

method_handles

The DEX 038+ method_handle_item table: the handle type and the member index it addresses.

call_sites

Summary of DEX 038+ call_site_id_item; resolves bootstrap info for invoke-custom.

call_site_args

Splits each encoded value of a call site encoded array into per-entry rows.

Only top-level values are listed. The nested tree is in encoded_array_values at encoded_array_off = call_site_off.

Encoded values

encoded_arrays

Summary of all discovered encoded_array_items.

encoded_array_values

One row per encoded-value node within an encoded array. depth = 0 identifies top-level entries; depth and byte-range containment describe nested arrays and annotations. Decode referenced names using the domain indicated by value_kind.

encoded_array_owners

Links encoded array offsets back to known owners, e.g. class static values or a call site.

hiddenapi_flags

Android hidden API metadata; only has rows when the dex carries the matching hiddenapi data.

Code and exceptions

code_items

code_item header and layout info for method implementations.

try_items

Protected instruction ranges inside a method code_item.

catch_handlers

Expands the typed catch and catch-all entries in an encoded_catch_handler_list.

Debug information

debug_info

Method-level debug_info_item summary.

debug_parameters

Method parameter names from the debug header.

debug_positions

Source position mappings produced by the debug state machine.

debug_locals

Local variable events from the debug state machine.

debug_opcodes

Exposes the debug state machine bytecode one opcode at a time, along with the state after executing each opcode.

Annotation structure

annotation_directories

Summary of a class annotation directory.

annotation_directory_entries

Unified expansion of the field, method, and parameter entries in an annotation directory.

annotation_sets

Summary of a raw annotation_set_item.

annotation_set_entries

Splits an annotation set into per-annotation-reference rows.

annotation_set_ref_lists

Summary of the annotation_set_ref_list used by parameter annotations.

annotation_set_refs

Splits a parameter annotation ref list into per-parameter-position rows.

Bytecode references and summaries

method_refs

A low-level sparse reference table over method bytecode. Each row is one instruction in some method that carries a dex-index reference. It keeps the reference kind and the raw index, and does not resolve the target into a string, field, or method descriptor. For ordinary feature queries prefer the higher-level semantic views (method_strings for string kind, method_calls for method kind, method_field_accesses for field kind, method_used_types for type kind).

method_numbers

A low-level per-instruction table of the immediate numeric constants loaded in method bytecode — the raw backing for the method_using_numbers view. Each row is one const-loading instruction; unlike method_refs the value is intrinsic, not a dex-index reference. For feature queries prefer the method_using_numbers view, which resolves the using method's descriptor.

method_opcodes

Per-method opcode summaries, one row per method_ids row, keyed by (file_id, method_idx), backing the opcode columns of methods. Rows require opcode data to have been prepared. Both opcode columns are NULL for a method this dex only references, and 0 / '' for a declared method without a code item.

Copyright (c) 2026 LSPosed Developers. Documentation licensed under MIT.