reverse-flutter

Case-based workflow for authorized Flutter APK reverse engineering and runtime security analysis.

This repo wires together the tools already installed on this machine:

• apktool for manifest, resources, assets, and google-services.json
• MobSF and mobsfscan for automated mobile security scanning
• jadx for Java/Kotlin decompilation
• Blutter for Dart AOT classes, functions, hardcoded values, and blutter_frida.js
• reFlutter for patched Flutter APKs and Burp traffic routing
• Burp Suite on port 8083
• Frida and objection for runtime hooks, SSL pinning checks, and root bypass testing
• Android build-tools for signing, alignment, install, and device proxy setup

Use only for apps you own or are explicitly authorized to test.

Quick Start

cd /Users/kickavenue/Dev/KickAvenue/reverse-flutter
make check
make new CASE=my-app APK=/absolute/path/to/app.apk
make static CASE=my-app
make blutter CASE=my-app

For dynamic analysis:

make reflutter CASE=my-app BURP_HOST=<your-computer-lan-ip>
make sign CASE=my-app
adb install -r cases/my-app/patched/reflutter/*.signed.apk

Then configure Burp and runtime hooks:

make proxy-set BURP_HOST=<your-computer-lan-ip> BURP_PORT=8083
make frida-server
make hook-ssl CASE=my-app
make objection-explore CASE=my-app

Repo Layout

scripts/    automation entrypoints
docs/       step-by-step CLI and GUI workflows
hooks/      generic Frida templates
prompts/    AI analyst prompts and report template
skills/     bundled Codex skill for this workflow
cases/      ignored case workspaces
reports/    ignored aggregate reports

Main Commands

make check
make new CASE=<case> APK=<apk>
make static CASE=<case>
make mobsf-upload CASE=<case>
make blutter CASE=<case>
make reflutter CASE=<case> BURP_HOST=<ip>
make sign CASE=<case>
make proxy-set BURP_HOST=<ip> BURP_PORT=8083
make proxy-clear
make frida-server
make hook-ssl CASE=<case>
make hook-root CASE=<case>
make objection-explore CASE=<case>
make objection-ssl CASE=<case>
make objection-root CASE=<case>
make report CASE=<case>

Install shortcuts:

make install-shortcuts
rf check
reverse-flutter help

GUI Steps

Some steps require GUI operation:

• Burp Suite listener setup: see docs/BURP.md
• MobSF upload/review/export: see docs/MOBSF.md

Reports

Create a report draft:

make report CASE=<case>

Then fill:

cases/<case>/reports/reverse-report.md

Use prompts/analyst-prompt.md and prompts/evidence-checklist.md when asking an AI agent to summarize the case.

Notes

• Case data is ignored by git because it may contain proprietary code, secrets, tokens, and traffic captures.
• Device-side frida-server requires a matching device ABI and usually root access.
• Blutter support is best for Android Flutter release APKs with arm64-v8a/libapp.so.