The Complexity Of Reversing Flutter Applications
summary
Parses Dart AOT snapshots, runs the binary, disassembles with Radare2, locates the object pool accessed via a custom register and computes indexes (offset/8), decodes Dart small‑integer tagging (LSB 0 → value = raw/2), and reconstructs the GreHack CTF 2023 flag; demonstrates offset 0x1d87 → index 948 and small‑int 0x760 → 944. Uses Radare2, inspects JEB output for recovered function names, and maps object pool register R15 entries back to concrete strings.
AI-written summary · about
chapters (10)
- 0:00Introduction and CTF goal
- 2:10Overview of Dart language
- 4:52Flutter framework structure
- 7:24Challenges with disassemblers
- 9:11Core Dart reversing concepts
- 15:28CTF challenge walkthrough
- 24:21Reversing Android malware
- 28:34Static analysis techniques
- 31:41Using the Blutter tool
- 35:25Conclusion and Q&A
related talks
19mSecuring your app: Classic Android vs Other frameworks
42mHack My App: Learn Flutter Security by Breaking It
47mThe Art of Reverse Engineering Flash Exploits
02h 05mOvercoming Fear: Reversing With Radare2
45mImpact of Framework Choice on your Application: A Reverse Engineering Perspective
01h 46mTutorial: Introduction to Reverse Engineering
29mA day in the life of a mobile reverse engineer
40mIntroduction into Reverse Engineering and iOS Security