Reversing Flutter Apps

Flutter breaks both halves of the standard mobile workflow at once. Dart is AOT-compiled to a native snapshot, so there is no dex for jadx to decompile — and the Flutter engine ships its own BoringSSL with its own trust store, so it ignores the system proxy and the user CA store, and your interception proxy sees nothing. Neither failure is obvious from the symptoms, which is why people burn hours on this before recognizing what they are looking at.

When to Use

• jadx on the APK shows a near-empty MainActivity and little else
• The APK contains lib/arm64-v8a/libflutter.so and libapp.so, or assets/flutter_assets/
• An IPA contains Frameworks/App.framework and Frameworks/Flutter.framework
• Burp, mitmproxy, or Charles shows zero traffic from an app that is plainly making network calls
• You need to recover Dart class and method names, or find the API layer, in a release build