AwesomeREA.org

Tool

darter

Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. It reads old, AppJIT and AppAOT snapshots, usually autodetects flags and settings from the snapshot itself, extracts the snapshot blobs from app.so or .snapshot files, and its darter.asm module disassembles ARM and ARM64 code with Capstone to find references to VM objects. The README's examples include extracting an app's string table, finding where an object is used, generating call and library-dependency graphs, exporting metadata for Radare2 and deobfuscating a snapshot by matching it against a reference one.

Targets
App · Binary
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The README warns that the project is outdated and that snapshots from a reasonably modern Dart or Flutter version probably will not parse correctly. The parser was written against Dart SDK commit 1ef83b86ae, and info/versions.md names snapshot hash c8562f0ee0ebc38ba217c7955956d1cb as the only supported version, which its Flutter table maps to the 2019 releases v1.9.1+hotfix.2 to v1.9.1+hotfix.6. Parser code last changed in 2021; the reviewed master commit of 2026-02-03 only extends that table, now through Flutter 3.38.9, and the repository has no releases or tags.
  • darter is a library with no stand-alone program or CLI; the README recommends using it from Jupyter, starting with the 1-introduction and 2-playground notebooks. Most of the code has no dependencies, but parse_elf_snapshot needs pyelftools and darter.asm needs Capstone and its Python binding; no Python version or package metadata is given.
  • The README reports heavy testing only on AppAOT product snapshots for ARM and ARM64 and light testing on x64 AppJIT release snapshots, and the disassembly analysis supports only ARM and ARM64. Kernel AST snapshots, such as .dill files, are not supported. The README recommends practicing on a snapshot one built oneself before analyzing another; users supply the libapp.so or snapshot to study.
  • samples/ commits arm-app.so and arm64-app.so, which the introduction notebook describes as builds of the default Flutter app; the samples/appjit.snapshot path it shows for AppJIT input is not committed. utils/ adds Radare2-metadata and import generators and a Node script that replays the pub package registry as of a past date through a local HTTPS proxy, using a committed self-signed CA plus a pub.dartlang.org certificate and key; that certificate expired in 2022.
  • AGPL-3.0. No snapshot was parsed for this entry, and the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mildsunrise/darter · Revision a649878
  2. info/versions.md GitHub · mildsunrise/darter · Revision a649878
  3. 1-introduction.ipynb GitHub · mildsunrise/darter · Revision a649878
  4. 2-playground.ipynb GitHub · mildsunrise/darter · Revision a649878
  5. darter/file.py GitHub · mildsunrise/darter · Revision a649878
  6. samples GitHub · mildsunrise/darter · Revision a649878
  7. utils/timemachine_pub.js GitHub · mildsunrise/darter · Revision a649878
  8. LICENSE GitHub · mildsunrise/darter · Revision a649878

More in Apps

All 136 entries in Apps