Loading story…
Guardsquare published research and supporting code showing that reverse engineering Flutter applications is feasible despite Dart obfuscation and limited tooling. The work details methods for recovering meaning from compiled Flutter binaries, including renaming obfuscated Dart functions and improving decompilation workflows with reFlutter, Frida, and IDA Pro. Guardsquare also released a demonstration repository containing sample obfuscated and non-obfuscated app artifacts, memory-dump processing scripts, and IDA Python utilities to import data, create Dart objects, add cross-references, and improve decompiled output, while warning that some stack-pointer patching can produce incorrect code in functions using both X15 and SP.
The research aligns with the availability of Doldrums, an open-source Flutter/Dart reverse engineering tool for Android that parses the libapp.so binary and extracts class information from Dart isolate snapshots. Doldrums, described as beta software for Dart 2.10 releases, can dump class definitions and absolute code offsets for native functions, helping analysts inspect Flutter Android applications even though some deserialization routines and class metadata remain incomplete. Together, the publications and tools show a maturing ecosystem for analyzing Flutter binaries and reducing the barriers to inspecting protected mobile apps.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Guardsquare published a GitHub repository with scripts, sample files, and instructions to reproduce experiments on reverse engineering Flutter applications. The repository covers renaming obfuscated Dart functions and improving Dart decompilation workflows using tools such as reFlutter, Frida, and IDA Pro.
Guardsquare published a blog post on the current state and future of reversing Flutter apps. The reference identifies it as a Flutter reverse engineering and decompiler guide.
A GitHub repository for Doldrums was published, describing a beta tool that parses Flutter Android libapp.so files and dumps Dart classes from isolate snapshots. The repository states support for Dart 2.10 releases and notes missing deserialization routines and some class information.
A blog post titled "Reverse engineering Flutter for Android - A Moment of Insanity" was published, documenting work-in-progress research into reversing Flutter Android applications. It predates the existing 2022 timeline entries on Flutter reverse engineering tooling and guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceguardsquare.com
Open sourcegithub.com
Open sourcerloura.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **FlutterShell**, a macOS backdoor tied to **Operation FlutterBridge** and tracking cluster `CL-CRI-1089`, which was distributed through malicious Google and YouTube ads leading users to fake download sites for trojanized productivity apps. The malware arrived as digitally signed app bundles and used a two-part design: a lightweight launcher loaded a larger Flutter/Dart payload library, while a hidden `WKWebView` fetched attacker-controlled JavaScript from live command-and-control infrastructure to deliver commands at runtime. Analysis of ten Mach-O samples found three malware generations that changed certificates, lures, infrastructure, and command names, with the latest version adding full Dart symbol obfuscation to reduce static visibility. Despite those changes, researchers identified stable traits across payloads, including a shared exported-symbol fingerprint and consistent Flutter runtime behavior. Reported capabilities included hardware UUID fingerprinting, Chrome Secure Preferences modification to hijack browser search settings, persistence via `LaunchAgent`, and Sparkle-based silent replacement, indicating a financially motivated campaign that relied on behavioral stealth and server-side control.
Jun 29, 2026
Reverse-engineering researchers published tooling and documentation that expose the inner workings of **FinSpy**, including a static unpacker, VM disassembler, and deobfuscation components hosted in the `RolfRolles/FinSpyVM` repository. The work targets FinSpy's custom virtual machine protection and provides practical artifacts for analysts to reconstruct protected code, while separate public documentation from the Chaos Computer Club details analysis of FinSpy for Android and includes leaked files, samples, graphs, tables, and a report on the spyware's components. A technical walkthrough describing the devirtualization process said the analyzed FinSpy sample relied on a comparatively weak virtualization scheme in which much of the VM bytecode already contained raw `x86` machine code. The author outlined a four-stage method for simplifying bytecode, recovering virtualized function calls and pointers, and performing a second devirtualization pass to produce a complete `x86` code blob for loading into IDA, giving defenders and malware analysts a clearer path to inspect FinSpy behavior and internals.
Aug 15, 2026
Researchers published detailed reverse-engineering work on **FinFisher/FinSpy** spyware, showing how the surveillance tool hides its payload behind heavy anti-analysis protections and a proprietary virtual machine. ESET documented Windows samples that use complementary conditional-jump pairs after nearly every instruction to break disassembly, then decrypt and execute protected bytecode through a custom virtual CPU. The whitepaper describes how analysts can peel back those layers by reconstructing components such as `vm_start`, `vm_dispatcher`, `vm_context`, and `vm_handlers`, noting that the examined VM used **34 handlers** and could mix virtualized logic with native instructions when full virtualization was impractical. Additional reverse-engineering research expanded on that work by demonstrating how to simplify and devirtualize FinSpy bytecode into equivalent x86 logic. The analysis focused on removing instruction patterns tied to a dedicated **SCRATCH** register, replacing them with canonical VM forms or direct x86 operations, and decoding sequences that represented x86-style memory addressing and memory access. After those transformations, the remaining bytecode was reduced largely to branch and raw x86-related instructions, and the researcher also corrected an earlier interpretation of one opcode, concluding that a supposed `CRASH` instruction was actually an unconditional jump. Together, the findings show that FinFisher’s protections were built to frustrate reverse engineering and conceal configuration data and newer spyware capabilities.
Aug 14, 2026