How to check obfuscation results of flutter app?

Question

In native android development I could check whether my minifyEnabled had taken effect.

I used this script (in linux) which allows me to extract the apk and view the java files to see if my code is readable, or has been obfuscated :

#! /bin/bash
d2j=/work/installs/dex2jar-2.0
jdgui=/work/installs/jd-gui-1.4.0.jar
apk_loc=/work/projects/my_app/build/app/outputs/app-release.apk

mkdir -p /work/tmp/dex
rm -rf /work/tmp/dex/*
cd /work/tmp
cp $apk_loc ./app-release.zip
unzip app-release.zip -d dex
cd dex

chmod +x $d2j/*.sh
$d2j/d2j-dex2jar.sh classes.dex

java -jar $jdgui classes-dex2jar.jar

If I use this script on a flutter apk, I don't see any files containing anything related to my original code.

Solution

Flutter's dart code is compiled to native and embedded to flutter.so runtime, so decompiling flutter is not as easy as byte code of java/kotlin However decompiling .so file is possible. You can use the toolchains inside the android ndk to perform the type of disassembling you want to

./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "flutter.so | less

but this is just give you an objdump.

Comments

[creativecreatorormaybenot]

So there is nothing readable?

[Morrison Chang]

If OP is assuming Flutter compiles to Java classes - it doesn't. See: Flutter - How does it work behind the scenes?

[Rockvole]

thanks - but where does this come from? I don't see an arm-linux-androideabi-objdump installed on my system.

[Putra Ardiansyah]

have you downloaded the Android NDK? developer.android.com/ndk/downloads

[Rockvole]

I read this document relating to this : github.com/flutter/flutter/wiki/Obfuscating-Dart-Code - it states that "Code obfuscation hides function and class names in your compiled Dart code, making it difficult for an attacker to reverse engineer your proprietary app."

[Rockvole]

I tried the ndk download and viewed the output on libflutter.so, but it does not seem to relate to my original code in any way that I can discern ?