search

rscloura / Doldrums

A Flutter/Dart reverse engineering tool
778 stars 117 forks source link

Hello. Can you tell me how to export complete code? #4

Closed BadDeveloper2022 closed 3 years ago

BadDeveloper2022 commented 3 years ago

Hello. Can you tell me how to export complete code?

rscloura commented 3 years ago

Hi! Getting the complete code is not a completely trivial task. Currently, Doldrums only parses VM snapshots, and tells you where to find the native code in the libapp.so file. The reason why Doldrums does not attempt to at least disassemble the code is because the code is virtualized, to some extent. In particular, references to resources are loaded into a table, and there is no easy way (as of yet) to reconstruct that table from a purely static point of view. Thus, unfortunately, there is still no way to have perfectly readable code without doing some doing some dynamic analysis.

To see some more details on how to do this, see my post over at https://rloura.wordpress.com/2020/12/04/reversing-flutter-for-android-wip/.

Happy reversing!

noraj commented 3 years ago

Hi,

I have debug APK of a Flutter app.

Unlike in Reverse engineering Flutter for Android I don't libapp.so in the lib folder, only libflutter.so.

But by reading this article Reverse Engineering Flutter Apps I was able to confirmed that the dart original source code is retrievable from resources/assets/flutter_assets/kernel_blob.bin.

Actually I can manually see the code or extract one file at a time, but a way to extract all files automatically would be very handy as the binary is several dozen of mega bytes.

This APK is confidential, I'm sorry I can't share it with you.

rscloura commented 3 years ago

Hi!

If your app does not have the libapp.so binary, and instead has the kernel_blob.bin, then your app was compiled in debug mode. Unfortunately, I am not aware of any tool that can help you "clean" the blob, although it's definitely an interesting project! :)