ReFlutter Tutorial: Flutter App Reverse Engineering Framework

Reverse engineering applications built on the Flutter framework presents unique challenges. Because Flutter compiles Dart code directly into native ARM libraries rather than Java bytecode or standard Objective-C, conventional decompilers often fail to extract meaningful logic. ReFlutter is a reverse engineering framework that solves this by repacking Flutter apps with a custom, modified Flutter engine. Security analysts frequently combine dynamic analysis techniques on repacked apps with HTTP proxy interception, which you can explore further in our comprehensive Burp Suite tutorial, to identify logic flaws and bypass modern security controls.

What Is ReFlutter?

Maintained on the official ReFlutter GitHub repository, the framework automates the process of injecting a patched Flutter engine into a target Android APK or iOS IPA file. The patched engine alters how the target app executes and handles its networking logic, allowing analysts to perform dynamic analysis that would normally be obstructed.

The core modifications in the patched engine include:

• Traffic Interception: The socket.cc library is patched to bypass Flutter’s native certificate pinning and route all HTTP/HTTPS traffic through a specified proxy server.
• Snapshot Deserialization: The dart.cc library is modified to dump Dart classes, functions, and specific application fields during the Dart VM snapshot deserialization process, exposing internal structure.
• Custom Compilation: Support for manually patching the engine using a customized Dockerfile for specific vulnerability research needs.

The framework currently supports arm32 and arm64 architectures on Android, and arm64 on iOS, across both Stable and Beta Flutter engine releases.

Installing ReFlutter

ReFlutter is built in Python and runs seamlessly across Linux, macOS, and Windows environments. Install the framework using pip:

pip3 install reflutter

Patching and Repacking an Application

To patch an application, run ReFlutter against your target APK or IPA. The tool will identify the exact Flutter engine hash used by the application, download the matching patched engine, and inject it securely.

reflutter main.apk

During execution, the prompt will ask for your Burp Suite proxy IP address. Once the process is complete, ReFlutter generates a repacked Android file named release.RE.apk.

Signing the Repacked APK

Android requires all APKs to be cryptographically signed before installation. You can use tools like uber-apk-signer to quickly align and sign the resulting package before deploying it to your physical test device or emulator:

java -jar uber-apk-signer.jar --allowResign -a release.RE.apk

Configuring Burp Suite for Invisible Proxying

Flutter applications ignore system-level proxy settings by default. Because ReFlutter patches the engine to route traffic directly to the IP address you specified during the patching process, you must configure Burp Suite to accept these incoming connections directly using invisible proxying.

1. Open Burp Suite and navigate to Proxy -> Options -> Proxy Listeners.
2. Click Edit on an existing listener or add a new one.
3. Under the Binding tab, set the listening port to 8083 and bind to All interfaces.
4. Under the Request Handling tab, check the box for Support invisible proxying.

Because the patched engine bypasses certificate validation internally, you do not need to install the Burp Suite root CA certificate on the Android device, nor do you require a rooted device to intercept the traffic successfully.

Extracting Dart Code Signatures

When the repacked app runs on the target device, the modified dart.cc engine prints the loaded Dart classes, functions, and internal structures to the device logs. Mobile analysts can extract this output to map the application’s internal API surface.

On Android, use ADB to filter the Logcat output specifically for the reflutter tag and format the results into a readable text file:

adb logcat -e reflutter | sed 's/.*DartVM//' >> reflutter.txt

On iOS, the framework outputs the same Dart class and function signatures directly to the console logs visible within Xcode when the repacked IPA is executed on a provisioned Apple device.

Building Custom Patched Engines

If you need to implement custom patches to the Flutter engine beyond the standard ReFlutter payload, the project provides a Docker-based build environment. Pull the official image to begin your custom compilations:

sudo docker pull ptswarm/reflutter

You can compile the engine by passing environment variables defining the exact architecture, the specific commit hash of the engine, and the target snapshot hash:

sudo docker run -e WAIT=300 -e x64=0 -e arm=0 -e HASH_PATCH=[Snapshot_Hash] -e COMMIT=[Engine_commit] --rm -iv${PWD}:/t ptswarm/reflutter