BlutterAndroid: In-App Reverse Engineering of Flutter/Dart AOT on Android

⚡ The Gist in 5 Seconds - BlutterAndroid is an Android app for on-device reverse engineering of Flutter/Dart AOT: disassembling libapp.so, dumping the object pool, and generating Frida scripts right on a smartphone. - The project is available on GitHub; the APK already bundles all 70 versions of the Blutter engine for Dart 2.14–3.13, and installation requires no root, chroot/proot/Termux, or other containers. - Limitation: Dart versions 3.0.x–3.3.x and 2.13.x/earlier are not supported; for some 2.14.x versions only no-analysis mode works, without code analysis. ### 🔍 What Was Discovered The AcE77505/BlutterAndroid project is an Android app integrating the blutter reverse engineering engine. The main executable is cross-compiled into a bionic-compatible PIE, placed in jniLibs/arm64-v8a, and invoked by the app via execve with LD_LIBRARY_PATH in a child process. The distribution includes precompiled libblutter_<version>.so files for all 70 supported Dart versions, so no on-device compilation is needed. Installation requires no root: files are extracted by PackageManager into an executable directory. No chroot/proot/Termux or environment setup is needed either. Version support is split into ranges: 2.14.1/2.14.2/2.14.4 are marked as no-analysis — only the object pool dump is available; 2.15.0/2.15.1, 2.16.0–2.18.6, 2.19.6, and 3.4.0–3.13.4 work, including the Dart 3.13 port. The 3.0.x–3.3.x branches and anything older than 2.14 are not supported: for early versions, structural incompatibility is cited due to the lack of pointer compression. The original repository does not host the binaries due to their size; they can be obtained separately via GitHub Releases. ### 💡 Why It Matters The main practical value is that Dart AOT code can be analyzed locally on an Android device without transferring libapp.so to a computer. The app performs disassembly, object pool dumping, and Frida script generation right on the smartphone. For those dissecting the internals of Flutter apps, this is a ready-made tool with broad Dart version coverage: after installing the APK, analysis can be run immediately, with no additional dependencies or build chains. ### 🧩 Context The project is based on the worawit/blutter engine under the MIT license, with fork changes preserved in blutter/patches/fork-local-changes.patch. It also includes third-party components: Dart SDK, Capstone, ICU, and Android NDK; their licenses and modifications are described in THIRD_PARTY_NOTICES.md. Building from source is intended mainly for those who want to compile the binaries themselves or extend the list of supported Dart versions: the scripts work on Linux and Windows, with the NDK toolchain switched automatically on Windows. For regular use, no build is required.

🔗 Read on github.com