Securing your app: Classic Android vs Other frameworks
summary
Flutter compiles Dart into a native libapp that embeds a serialized Dart snapshot, leaving plaintext strings in the read‑only data segment and only stripping method/class names with --split-debug-info obfuscation, so sensitive constants remain discoverable. Attackers extract strings with the strings tool, then substitute a modified libflutter tamper VM (recompile + resign) to expose runtime values and hook functions, then instrument with Frida or public repos like reflatter; defend with library signature checks, anti‑tamper and RASP measures.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:08Choosing frameworks
- 1:50Android compilation
- 2:54Attacking classic Android
- 4:46Reverse engineering React Native
- 5:30Flutter compilation
- 7:39Attacking Flutter apps
- 10:51Reversing Flutter code
- 12:16Tampering Flutter VM
- 14:01Flutter obfuscation limits
- 15:26Flutter attack tools
- 16:30Securing Flutter like Android
- 17:12Detecting tampered Flutter
related talks
36mSecuring Flutter Apps
42mHack My App: Learn Flutter Security by Breaking It
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
33mHacking and protection of Mobile Apps and backend APIs
43mDangerous Flutter... Or Not?
01h 07mHow to attack (and secure) an Android app: an introduction
38mAdvanced Techniques for Protecting Android Apps
32mSecurity in Flutter: Our Priority