Locating Flutter's TLS certificate verifier in a stripped libflutter.so without byte signatureshttps://www.reddit.com/r/netsec/comments/1wext06/locating_flutters_tls_certificate_verifier_in_a
Author, and I work on the tool this came out of. Flutter bundles its own BoringSSL and never reads Android's network security config, so repackaging to trust a user CA does nothing. You have to patch ssl_crypto_x509_session_verify_cert_chain, and libflutter.so ships stripped. The usual answer is a byte signature copied from a build where someone already found it. It breaks on a new compiler, and it breaks silently: search returns nothing, the patched app installs and launches and never decrypts, which looks exactly like the app winning. Two properties come from the source rather than the comp…