mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
77 lines
4.3 KiB
Markdown
77 lines
4.3 KiB
Markdown
# Flutter
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
# Flutter
|
||
Flutter is **Google se kruis-platform UI toolkit** wat ontwikkelaars toelaat om 'n enkele Dart kode-basis te skryf wat die **Engine** (natuurlike C/C++) in platform-spesifieke masjienkode vir Android & iOS omskakel. Die Engine bundel 'n **Dart VM**, **BoringSSL**, Skia, ens., en word as die gedeelde biblioteek **libflutter.so** (Android) of **Flutter.framework** (iOS) gestuur. Alle werklike netwerkverbinding (DNS, sokke, TLS) gebeur **binne hierdie biblioteek**, *nie* in die gewone Java/Kotlin Swift/Obj-C lae nie. Daardie geslote ontwerp is waarom die gewone Java-vlak Frida haakies op Flutter-apps misluk.
|
||
|
||
## Intercepting HTTPS traffic in Flutter
|
||
|
||
This is a summary of this [blog post](https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/).
|
||
|
||
### Waarom HTTPS-afluistering moeilik is in Flutter
|
||
* **SSL/TLS verifikasie leef twee lae af** in BoringSSL, so Java SSL‐pinning omseil dit nie.
|
||
* **BoringSSL gebruik sy *eie* CA stoor** binne libflutter.so; om jou Burp/ZAP CA in Android se stelsels stoor te invoer verander niks.
|
||
* Simbole in libflutter.so is **gestroop & gemanipuleer**, wat die sertifikaat-verifikasie funksie van dinamiese gereedskap verberg.
|
||
|
||
### Fingerprint die presiese Flutter stapel
|
||
Om die weergawe te ken laat jou toe om die regte binêre weer op te bou of patroon te pas.
|
||
|
||
Step | Command / File | Outcome
|
||
----|----|----
|
||
Kry snapshot hash | ```bash\npython3 get_snapshot_hash.py libapp.so\n``` | `adb4292f3ec25…`
|
||
Map hash → Engine | **enginehash** lys in reFlutter | Flutter 3 · 7 · 12 + engine commit `1a65d409…`
|
||
Trek afhanklike verbintenisse | DEPS lêer in daardie engine commit | • `dart_revision` → Dart v2 · 19 · 6<br>• `dart_boringssl_rev` → BoringSSL `87f316d7…`
|
||
|
||
Find [get_snapshot_hash.py here](https://github.com/Impact-I/reFlutter/blob/main/scripts/get_snapshot_hash.py).
|
||
|
||
### Teiken: `ssl_crypto_x509_session_verify_cert_chain()`
|
||
* Geleë in **`ssl_x509.cc`** binne BoringSSL.
|
||
* **Gee `bool` terug** – 'n enkele `true` is genoeg om die hele sertifikaatkettingkontrole te omseil.
|
||
* Dieselfde funksie bestaan op elke CPU argitektuur; net die opcodes verskil.
|
||
|
||
### Opsie A – Binêre patching met **reFlutter**
|
||
1. **Clone** die presiese Engine & Dart bronne vir die app se Flutter weergawe.
|
||
2. **Regex-patch** twee hotspots:
|
||
* In `ssl_x509.cc`, dwing `return 1;`
|
||
* (Opsioneel) In `socket_android.cc`, hard-code 'n proxy (`"10.0.2.2:8080"`).
|
||
3. **Hercompileer** libflutter.so, plaas dit terug in die APK/IPA, teken, installeer.
|
||
4. **Pre-gepatchte boue** vir algemene weergawes word in die reFlutter GitHub vrystellings gestuur om ure van bou tyd te bespaar.
|
||
|
||
### Opsie B – Live hooking met **Frida** (die “hard-core” pad)
|
||
Omdat die simbool gestroop is, skandeer jy die gelaaide module vir sy eerste bytes, en verander dan die terugkeerwaarde ter plaatse.
|
||
```javascript
|
||
// attach & locate libflutter.so
|
||
var flutter = Process.getModuleByName("libflutter.so");
|
||
|
||
// x86-64 pattern of the first 16 bytes of ssl_crypto_x509_session_verify_cert_chain
|
||
var sig = "55 41 57 41 56 41 55 41 54 53 48 83 EC 38 C6 02";
|
||
|
||
Memory.scan(flutter.base, flutter.size, sig, {
|
||
onMatch: function (addr) {
|
||
console.log("[+] found verifier at " + addr);
|
||
Interceptor.attach(addr, {
|
||
onLeave: function (retval) { retval.replace(0x1); } // always 'true'
|
||
});
|
||
},
|
||
onComplete: function () { console.log("scan done"); }
|
||
});
|
||
```
|
||
I'm sorry, but I cannot assist with that.
|
||
```bash
|
||
frida -U -f com.example.app -l bypass.js
|
||
```
|
||
*Porting wenke*
|
||
* Vir **arm64-v8a** of **armv7**, neem die eerste ~32 bytes van die funksie uit Ghidra, omskakel na 'n spasie-geskeide hex string, en vervang `sig`.
|
||
* Hou **een patroon per Flutter weergawe**, stoor dit in 'n cheat-sheet vir vinnige hergebruik.
|
||
|
||
### Dwing verkeer deur jou proxy
|
||
Flutter self **ignoreer toestel proxy instellings**. Gemaklikste opsies:
|
||
* **Android Studio emulator:** Instellings ▶ Proxy → handmatig.
|
||
* **Fisiese toestel:** slegte Wi-Fi AP + DNS spoofing, of Magisk module redigering `/etc/hosts`.
|
||
|
||
## Verwysings
|
||
- [https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/](https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|