public class Example {
  public void find(String apkPath) {
    // Suppose we want to find a class that contains the string "Hello Dex".

    // Create a class filter to locate the desired class.
    ClassFilter classFilter = new ClassFilter.Builder()
            // To narrow down the search, limit it to string references only.
            .setReferenceTypes(ReferenceTypes.STRINGS_ONLY)
            // Check if the class contains the string "Hello Dex" in its reference pool.
            .setReferenceFilter(pool ->
                    pool.contains("Hello Dex")
            ).build();

    // Load the apk into Dexplore
    Dexplore dexplore = DexFactory.load(apkPath);

    // Perform a dex search
    MethodData result = dexplore.findClass(classFilter);

    // This is our target class
    if (result != null) Util.log("Found: " + result.clazz);  // Print the class name
  }
}

public class Sample {
  static final String TAG = "AppInit";  // String literal
  Context context;
  public void init(Activiy activiy) {
    context = (Context) activiy;        // Type: Context
    if (Build.VERSION.SDK_INT >= 30) {  // Field: SDK_INT
      Util.log(getMessage());           // Method: log() and getMessage()
    }
  }
  public static String getMessage() { 
    return "Congratulations";           // String literal
  }
}

package xy.z;  // obfuscated package
public final class ObfClassAaa {  // obfuscated class
  public void A0X() {
    Processor.process("appx_unique_token");  // Assuming no other classes have this exact string.
    // ... ... ...
  }
}

public class Example {
  public void find(String apkPath) {
    // Create a ClassFilter to match the ObfClassAaa class
    ClassFilter classFilter = new ClassFilter.Builder()
            // Since we will check String references only
            .setReferenceTypes(ReferenceTypes.STRINGS_ONLY)
            // Check whether the reference pool contains the unique string
            .setReferenceFilter(pool -> pool.stringsContain("appx_unique_token"))
            // Search in public final classes only (our target class is 'public final')
            .setModifiers(Modifier.PUBLIC | Modifier.FINAL)
            // It doesn't have any interfaces (skip all classes with interfaces)
            .setInterfaces(Collections.emptyList())
            // It doesn't have an explicit super class, which means 'Object' is the super class.
            .setSuperClass(Object.class.getName())
            // To make the filter more precise, you can specify additional conditions.
            .build();

    // Load the apk into Dexplore
    Dexplore dexplore = DexFactory.load(apkPath);

    // We will talk about 'DexFilter' later
    ClassData result = dexplore.findClass(DexFilter.MATCH_ALL, classFilter);

    // This is our target class
    if (result != null) Util.log("Found: " + result.clazz);  // In this case: xy.z.ObfClassAaa


    // -------------------------- Additional -------------------------- //

    // If you want to find all the classes that match the filter
    List<ClassData> results = dexplore.findClasses(DexFilter.MATCH_ALL, classFilter, -1);  // find all

    // If you want to ensure that only one class has the string "appx_unique_token".
    List<ClassData> results = dexplore.findClasses(DexFilter.MATCH_ALL, classFilter, 2);  // find the first 2 matches
    if (results.size() > 1) Util.log("Not unique");  // not unique
  }
}

package xy.z;
public final class ObfClassAaa {  // obfuscated class
  public void A0X() {
    Processor.process("appx_unique_token");  // Assuming no other classes have this exact string.
  }
  public static int BtZ(ActivityManager am, boolean flag) {  // obfuscated method
    if (am.isLowRamDevice()) {  // A method reference: 'isLowRamDevice'
      return Something.get();
    }
    return 0;
  }
}

public class Example {
  public void find(String apkPath) {
    // Create a ClassFilter to match ObfClassAaa
    ClassFilter classFilter = new ClassFilter.Builder()
            // Check in string and method references from the reference pool
            .setReferenceTypes(ReferenceTypes.builder().addString().addMethod().build())
            .setReferenceFilter(pool ->
                    // Check whether the reference pool contains the unique string
                    pool.stringsContain("appx_unique_token") &&
                    // Check whether it contains 'isLowRamDevice' method reference too (to search more accurately)
                    pool.methodsContain("isLowRamDevice")
            )
            // Search in public final classes only (our class is 'public final')
            .setModifiers(Modifier.PUBLIC | Modifier.FINAL)
            // It doesn't have any interfaces (skip all classes with interface)
            .setInterfaces(Collections.emptyList())
            // It doesn't have an explicit super class, which means 'Object' is the super class.
            .setSuperClass(Object.class.getName())
            // Build
            .build();

    // Create a MethodFilter to match BtZ() method
    MethodFilter methodFilter = new MethodFilter.Builder()
            // Check in method references only
            .setReferenceTypes(ReferenceTypes.builder().addMethod().build())
            // Check whether the target method contains this reference
            .setReferenceFilter(pool -> pool.contains("isLowRamDevice"))
            // Method return type is "int"
            .setReturnType(int.class.getName())
            // We know the parameters of BtZ()
            .setParamList(Arrays.asList("android.app.ActivityManager", "boolean"))
            // OR set parameter size instead (in case parameters are also obfuscated)
            .setParamSize(2)
            // Search in public static methods only (our method is 'public static')
            .setModifiers(Modifier.PUBLIC | Modifier.STATIC)
            // Build
            .build();
    //  If you are confused, take a look at ReferencePool section again.

    // Load the apk into Dexplore
    Dexplore dexplore = DexFactory.load(apkPath);

    // Search method
    MethodData result = dexplore.findMethod(DexFilter.MATCH_ALL, classFilter, methodFilter);

    // This is our target method
    if (result != null) {
      Util.log("Method: " + result.method);  // In this case: BtZ
      Util.log("Declaring class: " + result.clazz);  // xy.z.ObfClassAaa
      Util.log("Parameters: " + result.params[0] + result.params[1]);
    }

    // Read javadocs of all filter methods
  }
}

public class Example {
  public void find(String apkPath) {
    // If the input apk has multiple dex files, we can provide a dex filter to speed up the search
    DexFilter dexFilter = new DexFilter.Builder()
            // Check string references only
            .setReferenceTypes(ReferenceTypes.STRINGS_ONLY)
            // Analyze only the dex file that contains this string in its reference pool.
            // Checking whether a dex file contains a reference is much faster than checking each classes.
            .setReferenceFilter(ReferenceFilter.contains("appx_unique_token"))
            // If we know which dex file contains the class, we can specify it. (it doesn't change often)
            // Setting a preferred dex file will analyze it first. 
            .setPreferredDexNames("classes4.dex") // Analyze classes4.dex first.
            // Build
            .build();

    // Additionally, we can specify to load root dex files only. (classes.dex, classes2.dex, ...)
    // This will avoid verifying (dex or not) thousands of non-dex file from the apk. 
    DexOptions options = new DexOptions();
    options.rootDexOnly = true;
    DexFactory.load(apkPath, options).findClass(dexFilter, classFilter);
  }
}

package xy.z;
public class ObfClassAaa { // a random obfuscated class
  public ObfClassAaa(ObfClassBBB param) {  // ObfClassBBB: our target class
    // ...
  }
  public void A0X() {
    Processor.process("appx_unique_token");
    ObfClassBBB obj = new ObfClassBBB("id", 1);  // ObfClassBBB() our target class constructor
  }
}

public class Example {
  public void find(String apkPath) {
    // Our goal is to find ObfClassBBB, but it doesn't have any unique properties.
    // So, let's find the ObfClassAaa first.

    Dexplore dexplore = DexFactory.load(apkPath);

    // Create a ClassFilter to find ObfClassAaa
    ClassFilter classFilter = new ClassFilter.Builder()
            .setReferenceTypes(ReferenceTypes.STRINGS_ONLY)
            .setReferenceFilter(pool -> pool.stringsContain("appx_unique_token"))
            .build();

    // helperClass: ObfClassAaa 
    ClassData helperClass = dexplore.findClass(DexFilter.MATCH_ALL, classFilter);
    if (helperClass == null) return; // failed

    // First approach, the parameter of ObfClassAaa constructor is the target class (ObfClassBBB)
    List<MethodData> constructors = helperClass.getConstructors() // find the constructor 
            .stream().filter(m ->
                    m.params.length == 1  // in case there are multiple constructors
            ).collect(Collectors.toList());
    if (constructors.size() != 1) return; // further confirmation

    // target: ObfClassBBB
    Util.log("Result: " + constructors.get(0).params[0]);  // the parameter of the constructor is the target class (ObfClassBBB)

    // ------------------------------------------------------------------------------------- //

    // Alternative approach: (This one is little confusing, read carefully)
    // A0X() method creates an instance of ObfClassBBB class, 
    // which means A0X() ReferencePool contains the constructor of ObfClassBBB.

    // A0X() is also obfuscated, so extract the A0X() method by checking its reference pool
    MethodData A0X = helperClass.getMethods()
            .stream().filter(m ->
                    m.getReferencePool().contains("appx_unique_token") // A0X() contains this string
            ).findFirst().orElse(null);
    if (A0X == null) return; // failed

    // Now extract the target class (ObfClassBBB) from the reference pool of A0X()

    // new ObfClassBBB("id", 1);   
    // This is a constructor, which means A0X() ReferencePool contains it in the form of a method reference.

    // Extract the method reference of the constructor first.
    List<MethodRefData> mRefs = A0X.getReferencePool() // ReferencePool of A0X() method
            .getConstructorSection().stream()  // find in method references (constructors only)
            .filter(ref ->
                    // match only if it has 'String' and 'int' parameters. (target class constructor has these two params)
                    ref.getParameterTypes().equals(Arrays.asList("java.lang.String", "int"))
            ).collect(Collectors.toList());
    // let's hope there is only one constructor with such signature
    if (mRefs.size() != 1) return; // assumption failed

    // Target: ObfClassBBB
    // Declaring class of the constructor 'ObfClassBBB()' is the target class 'ObfClassBBB'
    Util.log("Result: " + mRefs.get(0).getDeclaringClass());  
  }
}

public class Example {
  public void find(String apkPath) {
    // Create a batch of queries
    QueryBatch batch = new QueryBatch.Builder()
            // A class query with 'item1' id
            // (id is just an arbitrary string to identify it later)
            .addClassQuery("item1", dexFilter1, classFilter1)
            // Another class query with 'item2' id
            .addClassQuery("item2", dexFilter2, classFilter2)
            // A method query with 'itemX' id
            .addMethodQuery("itemX", dexFilter3, classFilter3, methodFilter3)
            // To speed up the process
            .setParallel(true)
            // Build
            .build();

    Dexplore dexplore = DexFactory.load(apkPath);

    // Example #1: Store the first result from each query
    Map<String> results = new ConcurrentHashMap<>();  // for thread safety (since parallel flag is enabled)
    dexplore.onQueryResult(batch, (key, result) -> {
      results.put(key, result);  // 'key' is the unique id used to create the query.
      // If you only need the first result from each query, return true for each callback.
      return true; // stop further search for the given key.
    });

    // Example #2: Examine each result manually
    dexplore.onQueryResult(batch, (key, result) -> {
      if (key.equals("item1")) {  // a result from the 'item1' query
        ClassData cls = (ClassData) result;  // 'item1' was a class query
        if (cls /* is your desired result? */) {
          store = cls; // store it
          return true; // found?  stop further search for 'item1'
        } else {
          return false; // not the result you expected? continue searching for 'item1'
        }
        // Handle others ...
        // ................
      }
    });
  }
}

public class XposedModule implements IXposedHookLoadPackage {
  @Override
  public void handleLoadPackage(XC_LoadPackage.LoadPackageParam param) {
    if (!param.packageName.equals("com.pkg.app")) return;

    // First, find all the necessary classes/methods using Dexplore.
    String apk = param.appInfo.sourceDir;
    Dexplore dexplore = DexFactory.load(apk);
    MethodData result = dexplore.findMethod(/* query */); // for example: find an obfuscated method

    // Write it to Preferences
    preferences.edit()
            .putString("obfMethod", result.serialize()) // the obfuscated method
            .putLong("appVersion", currentVersionCode) // app version code (NOT version name).
            .apply();

    // Load the method
    ClassLoader cl = param.classLoader;
    // Either load directly (easy)
    Method method = result.loadMethod(cl);
    // Or load with xposed (if you want)
    XposedHelpers.findMethodExact(result.clazz, cl, result.method, (Object[]) result.params);
    // Hook with xposed
    XposedBridge.hookMethod(method /* , hook */);
    // ------------------------ . ------------------------ //

    // Next time, retrieve it from Preferences
    long code = preferences.getLong("appVersion", 0);
    if (code == currentVersionCode) {
      String raw = preferences.getString("obfMethod", null);
      MethodData retrieved = MethodData.deserialize(raw);  // deserialize
      // Load and hook with xposed
      // .........
    } else {
      // App version code changed, find your necessary classes/methods again
      dexplore.findMethod(/* query */); // find again using the same query
      // Save new data to Preferences and ...................
    }
  }
}