After 5 releases, Google is preparing to update the Dalvik Executable Format (DEX) in Android 15 "Vanilla Ice Cream".

DEX v41 is in the works for Android 15. The last version, DEX v40, was released with Android 10.

DEX files contain the compiled code of Android applications. If you've ever opened up an APK file, I'm sure you've seen those classes.dex files before.

With version 41 of the DEX format, Google plans to "allow multiple dex files within [a] single 'container' (either a zip entry or a plain on-disk dex file). This allows sharing of string (and other) dex data, since the offsets can point to shared data payload."

It's a little confusing how the patch talks about multiple dex when "multidex" is already a thing, but what seems to be happening is that currently, "multidex" refers to splitting compiled code into multiple different individual DEX files (classesN.dex) whereas the new "multidex" refers to putting multiple DEX files in a single container.

How DEX files work under-the-hood is not my forte, so I asked
Anestis Bechtsoudis, a security researcher and creator of multiple open source DEX-related tools, what they thought of this change and whether the 64K method reference limit will be addressed by this. Here's what they had to say:

"From what is [sic] looks like they introduce the concept of container that can host one or more dex files. The shared data section(s) of the container become sharable and this will allow external DEX files to reference them*. This is because their offsets are no longer relative but directly accessible from header.

From what is [sic] looks like they want to make some concept of dynamic loadable shared data to deduplicate event more (across different Apps / Services) common resources (to save disk space and memory when all frameworks are loaded).

Of course compact dex is no longer possible because you need relative offsets, thus they disabled it. But at any case it shouldn't be needed any more.

(1/2)

Google Play has shared an article about the new features, tools, and updates they've been working on to keep the platform "safe and trustworthy". Here's a summary:

* The Google Play Console's App content page is adding more information to help you spot policy declaration deadlines through a new timeline view, help you understand why an app is in-scope for a particular declaration, and help find relevant policy issues alongside each declaration. Later this year, this page will not only show existing declarations but also upcoming declaration requirements and deadlines.

* A new notice on the Google Play SDK Index will help you "make more informed decisions about which version of an SDK may cause your app to violate Google Play policies." Also later this year, Google will inform you about SDK-related policy issues right on the Policy status page, in addition to Inbox messages and emails.

* You can go to the new Developer Help Community to ask about everything from Play Console changes to target API level requirements.

* The Google Play Strike Removal program is now available to all developers. This program "helps eligible developers get certain enforcement strikes removed after passing a related Play Academy training course."

* Google reiterates that the updated data safety form needs to be completed by Dec. 7, 2023. If your app allows users to create accounts, you'll need to provide a way for users to delete their account and/or data. Links to these forms should be submitted to Google Play so they can appear for users in the data safety section starting in early 2024.

* Lastly, Google Play is adding a new banner for the VPN app category that "emphasize[s] the importance of reviewing an app’s Data safety section before installing. When users search for 'VPN' apps in Google Play, they’ll see a banner that encourages them to look for a shield icon in the app’s Data safety section, which indicates that the app has completed an independent security review."

Really impressed by how Microsoft has taken tools that were super basic and often mocked - Paint, Snipping Tool, Photos - and improved upon them with useful AI features.

* Microsoft announced last week that Paint is rolling out background removal support to Windows Insiders in the Canary and Dev channels.

* Today, Microsoft announced the Photos app will get background blur, content search for OneDrive-backed photos, location search, support for viewing motion photos captured by Samsung Galaxy and Google Pixel phones, and other improvements.

* Also today, Microsoft announced that Snipping Tool can now detect text in captured screenshots (OCR, finally!) I've been using Google Lens on my phone for this for so long. You can also use Quick Redact to automatically hide emails and phone numbers.

* Phone Link is getting updated with a new remote capture feature. Whenever a new photo is captured on your linked Android device, that photo can immediately be accessed and edited on your PC through Snipping Tool.

Through the new FlaggedApi annotation, Android 15 will make certain APIs public or hidden based on the value of an "aconfig" flag at build time.

Google will use this annotation to hide APIs under development while preparing the release of Android 15.

For example, the battery state of health API that I said would become public in Android 15 the other day will be guarded by the new "state_of_health_public" flag under the "os" namespace.

aconfig, as I mentioned before, is a new way to define feature flags at build time. It's similar to the DeviceConfig API, which lets Play Services remotely toggle flags, but aconfig also allows configuring flag values based on the build ID as well as setting certain flags to be read-only.

And now, it seems Google's going to use aconfig to gate the availability of new APIs as well while they're under development.

Oddly, though, I was not able to replicate this on my Pixel 6a or Pixel 6 Pro running Beta 5.3, and even stranger was that Jason was also unable to replicate this on his Pixel 7a running Beta 5.3!

I don't know why there's a discrepancy between our devices, but there's some more evidence the work profile behavior may have been reverted. Google quietly scrubbed their page for what's new in enterprise in Android 14 to remove references to the work profile change.

I reached out to Google for comment last week, but I didn't hear back from them. If you have a Pixel running Android 14 Beta 5.3 and you use a work profile, let me know if you see the new or old pausing behavior!

The best way to check is through ADB (so your policy may not let you):

dumpsys user | grep -A 3 "Work profile"

If you see State: SHUTDOWN or State: -1 when the work profile is paused, then it's the old behavior. If you see State: RUNNING_UNLOCKED, then it's the new behavior.

(2/2)