Analyze a Flutter APK with REA

Unofficial guide. This site is an independent community guide and is not affiliated with the REA project. For authoritative docs see the official REA website and the morluto/rea GitHub repository. Commands here are taken from the official README/docs (checked 2026-10-19); REA changes quickly, so verify against the official docs.

REA has two Flutter commands. identify-flutter-build tells you which Dart/Flutter build an APK uses. inspect-dart-aot reads the compiled Dart code (libapp.so): package URIs, SDK libraries and strings. We tested both on a real open-source app: Saber v1.36.1, FOSS APK from its GitHub release. The first worked. The second failed with unsupported_target, which is a known problem with apps built by current Flutter toolchains (issue #3629).

Step 1: identify the Flutter build (works)

No extra tools needed. Per the official Flutter guide, REA reads the APK "by pure parsing": no engine, no execution, no external lookups.

$ npx -y [email protected] identify-flutter-build /abs/Saber_FOSS_v1.36.1.apk
evidence_id: ev_52940a62601d66ea180946f8faa53af206770d953f2d6f35c4787a6b545f1eb6
…
normalized_result:
  target:
    bytes: 110269134
    sha256: 45d2fe921ea19e01b10ae2f58ca340fe0490daf7f5cadfba07e50da259dadd9e
  flutter_detected: true
  abis[3]:
    - abi: arm64-v8a
      libapp:
        present: true
        bytes: 16712584
        elf_header_valid: true
        snapshot_hash_sources: 1
        snapshot_hash: 0451907c2eaa8467e848c0067bfe8ed4
      libflutter:
        present: true
        bytes: 11747864
        build_id: fdf0a0a6f673cdcfc6c0e5f8dc7c8828d63fb3b6
        dart_version: null
        toolchain_lines[1]: "Android (13624864, +pgo, +bolt, +lto, +mlgo, based on r530567e) clang version 19.0.1 (…)"
    - abi: armeabi-v7a
…
  coverage: partial
limitations[9]: …,"lib/arm64-v8a/libapp.so carries 1 snapshot section(s); a complete AOT payload carries two, so the library is truncated or nonstandard",…
real	0m2.127s

What the fields mean

• flutter_detected: true: at least one lib/<abi>/libapp.so exists.
• snapshot_hash: the Dart build hash. The docs say it maps to a Dart SDK release only "through an external dataset (such as the one reFlutter maintains)". REA doesn't do that lookup itself.
• libflutter.build_id: the engine's GNU build ID, different for each ABI.
• dart_version: null is normal. Release engines often strip the version string, and REA reports it missing instead of guessing.
• coverage: partial: on this APK every ABI's libapp.so has one snapshot section instead of the two REA expects, so REA flags it as "truncated or nonstandard". That's the first sign of the newer layout (see step 2).

Step 2: inspect the Dart AOT snapshot (fails on new builds)

$ npx -y [email protected] inspect-dart-aot /abs/Saber_FOSS_v1.36.1.apk
code: unsupported_target
category: unsupported_target
message: "Unsupported target for inspect_dart_aot at …/Saber_FOSS_v1.36.1.apk: No recognizable Dart snapshot symbols were found:
  symbol _kDartVmSnapshotData is not in the dynamic symbol table; symbol _kDartVmSnapshotInstructions is not in the dynamic symbol table;
  symbol _kDartIsolateSnapshotData is not in the dynamic symbol table; symbol _kDartIsolateSnapshotInstructions is not in the dynamic symbol table"
retryable: false
(exit code 1)

Why it fails

REA 6.5.0 looks up the four older snapshot symbol names. This APK's libapp.so only exports the new names, as you can check yourself:

$ unzip -q Saber_FOSS_v1.36.1.apk lib/arm64-v8a/libapp.so -d saber
$ readelf --dyn-syms -W saber/lib/arm64-v8a/libapp.so
   Num:    Value          Size Type    Bind   Vis      Ndx Name
     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND
     1: 00000000006e0000 0x902180 OBJECT  GLOBAL DEFAULT    7 _kDartSnapshotText
     2: 00000000000002c0 0x6d2ab0 OBJECT  GLOBAL DEFAULT    5 _kDartSnapshotData
     3: 00000000000001c8    32 OBJECT  GLOBAL DEFAULT    1 _kDartSnapshotBuildId

The reporter of #3629 traced this to Dart SDK commit d36adbacaf ("[vm] Remove the VM isolate", 2026-05-18), which renamed the symbols to kDartSnapshotData/kDartSnapshotText. They saw the same snapshot hash (0451907c…) on Saber as we did. The issue was still open when we checked on 2026-10-17. The latest release on npm is still 6.5.0.

What you can do now

• Use identify-flutter-build for triage. It works on these APKs.
• Run readelf --dyn-syms on libapp.so first. If you see _kDartSnapshotText/_kDartSnapshotData, inspect-dart-aot in 6.5.0 will refuse it.
• Older Flutter apps that export _kDartVmSnapshotData etc. are what the command currently supports. Per the docs, complete structural coverage currently means the Dart 2.14 layout.
• Follow #3629, then run rea update or npx rea-agents@latest when a fix ships. There's also an open proposal for a Blutter-based provider (#2809).

Other parts of a Flutter APK

The Java/Kotlin side, the manifest and resources are normal Android. Use the Android APK guide (JADX/apktool). Only analyze apps you're allowed to: Saber is GPL-licensed open source.

Related guides

• Analyze Android APKs with REA
• Use cases
• REA CLI command cheat sheet

Sources: flutter-analysis.md · issue #3629 · issue #2809 · Saber releases

FAQ