Search code examples
dartflutterapkreverse-engineeringdecompiler

Decompiling .dart.snapshot into Dart source code

According to dart-lang/sdk:

Starting in 1.21, the Dart VM also supports application snapshots, which include all the parsed classes and compiled code generated during a training run of a program.

    $ dart --snapshot=hello.dart.snapshot --snapshot-kind=app-jit hello.dart arguments-for-training
    Hello, world!
    $ dart hello.dart.snapshot arguments-for-use
    Hello, world!

Now,how can i decompile this hello.dart.snapshot file to hello.dart?

In android Apk that written by java language we can decompile apk and get jar file from class.dex using dex2jar tools, but when application developed by flutter framework(written with dart)how can decompile this application and get application dart classes?

This image show snapshot files that generated in apk assets file.

Apk structure

Solution

  • In release mode, Flutter compiles the Dart code to machine code, currently only ARMv7 (this procedure is called AOT - Ahead-Of-Time compilation). Unlike native Android apps, in which the Java is compiled to byte-code named Smali, which can be (pretty easily) decompiled to Java back again.

    Most of the machine code is compiled to the file "isolate_snapshot_instr", which is written in a special format, and the flutter engine (flutterlib.so, also found inside the app), loads it into the app memory in run time. Therefore, you have 2 reasonable options:

    1. Reading the app code at runtime (the .text segment). You can use frida dump for that, and extract the compiled Dart code that you need
    2. Pacthing/Using the Flutter engine in order to deserialize the machine code

    If you have ipa (IOS app), that could be easier, because all of the code is found in App.Framework.