morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3629] [Bug] inspect_dart_aot rejects libapp.so built after Dart renamed its snapshot symbols (_kDartSnapshotText/_kDartSnapshotData) #1355

New issue

Open

opened 2026-10-16 21:04:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:36 +00:00

Owner

Originally created by @Rinkia on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3629

Before submitting

I searched the open and closed issues for a related report (_kDartSnapshotText, Dart snapshot layout, inspect_dart_aot unsupported): none found.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

inspect_dart_aot refuses an APK built with a current Flutter toolchain:

code: unsupported_target
message: Unsupported target for inspect_dart_aot at /targets/saber.apk: No recognizable Dart snapshot symbols were found:
  symbol _kDartVmSnapshotData is not in the dynamic symbol table; symbol _kDartVmSnapshotInstructions is not in the dynamic symbol table;
  symbol _kDartIsolateSnapshotData is not in the dynamic symbol table; symbol _kDartIsolateSnapshotInstructions is not in the dynamic symbol table

The libapp.so dynamic symbol table holds exactly three symbols, all using the new names:

.dynsym: _kDartSnapshotText, _kDartSnapshotData, _kDartSnapshotBuildId
sections: .note.gnu.build-id .dynstr .dynsym .hash .rodata .eh_frame .text .dynamic .bss

identify_flutter_build on the same APK succeeds (flutter_detected: true, snapshot_hash: 0451907c2eaa8467e848c0067bfe8ed4, libflutter build_id: 132bfb8e399a170c02e5f577474dd0eed81ed2c3), so only the AOT inspection path is affected.

Cause

Dart SDK commit d36adbacaf ("[vm] Remove the VM isolate", 2026-05-18) changed the snapshot layout:

The snapshot symbols are renamed to kDartSnapshotData and kDartSnapshotText. There is no need to distinguish the VM isolate's snapshot, and snaphots are per isolate group not per isolate. Aliases with the old names are added to ease migration.

The aliases don't appear in this AOT ELF's .dynsym; only the new names are exported. src/flutter/FlutterBuildProvider.ts (around lines 974-977 on main @ efbc486b9) looks up only the four legacy names (_kDartVmSnapshotData, _kDartVmSnapshotInstructions, _kDartIsolateSnapshotData, _kDartIsolateSnapshotInstructions), and the string-pool scan reads the isolate data section.

Reproduction

Public APK: F-Droid Saber 1.36.1, x86_64 build (https://f-droid.org/repo/com.adilhanney.saber_1360103.apk, sha256 de4813f95bdd6ae54adc5a6142be0762c177a782caaed6ed51dae482f6acb720; lib/x86_64/libapp.so sha256 b54b19d243b6db78e27f9147b56dc0aa17ef6119fa905c2e2f7c72eb2f198feb, 16,778,120 bytes).

rea identify-flutter-build /targets/saber.apk --format json   # succeeds
rea inspect-dart-aot /targets/saber.apk --format json         # unsupported_target

Toolchain, from the app's source at tag v1.36.1: Flutter submodule d3b14c876900e553bc736ca19295fc09e3853e8e ("[flutter-3.47-candidate.0] Sync engine.version", 2026-08-26), engine a804b261645ef8c13eb3d5c44a5c2fb0340c5539; pubspec sdk: ^3.13.0, flutter: ">=3.47.0". The F-Droid build recipe is public (fdroiddata metadata/com.adilhanney.saber.yml).

Expected behavior

Recognise the new symbols: _kDartSnapshotData (single data snapshot, playing the role the isolate data snapshot had), _kDartSnapshotText (instructions) and _kDartSnapshotBuildId, alongside the legacy four, and report which layout was found.
When neither set is present, keep unsupported_target, but name both expected symbol sets in the message.

Impact and scope

Likely every Flutter app built with a toolchain that includes Dart commit d36adbacaf. Verified here for one current Flutter 3.47 build (x86_64). I haven't checked other ABIs or the exact first Dart release containing the change.
inspect_dart_aot is the step after identify_flutter_build in the documented Flutter triage, so current Flutter apps stop at triage.
Deterministic.

REA version

rea-agents@6.5.0; the symbol list is unchanged on main @ efbc486b9.

Runtime and platform

Linux x64 Docker container (Ubuntu 24.04) on Windows 11 / Docker Desktop, Node 24.21.0.

Target and artifact context

Public F-Droid APK above (open-source app, GPL-3.0).

Interface

CLI (MCP inspect_dart_aot shares the provider).

Relevant output or evidence

Reading the section headers and .dynsym of the extracted libapp.so directly (ELF64, 11 sections) gives the three symbols listed above. The old names appear nowhere in .dynstr.

Originally created by @Rinkia on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3629 ### Before submitting - [x] I searched the open and closed issues for a related report (`_kDartSnapshotText`, Dart snapshot layout, inspect_dart_aot unsupported): none found. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior `inspect_dart_aot` refuses an APK built with a current Flutter toolchain: ```text code: unsupported_target message: Unsupported target for inspect_dart_aot at /targets/saber.apk: No recognizable Dart snapshot symbols were found: symbol _kDartVmSnapshotData is not in the dynamic symbol table; symbol _kDartVmSnapshotInstructions is not in the dynamic symbol table; symbol _kDartIsolateSnapshotData is not in the dynamic symbol table; symbol _kDartIsolateSnapshotInstructions is not in the dynamic symbol table ``` The `libapp.so` dynamic symbol table holds exactly three symbols, all using the new names: ```text .dynsym: _kDartSnapshotText, _kDartSnapshotData, _kDartSnapshotBuildId sections: .note.gnu.build-id .dynstr .dynsym .hash .rodata .eh_frame .text .dynamic .bss ``` `identify_flutter_build` on the same APK succeeds (`flutter_detected: true`, `snapshot_hash: 0451907c2eaa8467e848c0067bfe8ed4`, libflutter `build_id: 132bfb8e399a170c02e5f577474dd0eed81ed2c3`), so only the AOT inspection path is affected. ### Cause Dart SDK commit [`d36adbacaf`](https://github.com/dart-lang/sdk/commit/d36adbacafee01d9852cf8e960cf2d8654d91e7e) ("[vm] Remove the VM isolate", 2026-05-18) changed the snapshot layout: > The snapshot symbols are renamed to kDartSnapshotData and kDartSnapshotText. There is no need to distinguish the VM isolate's snapshot, and snaphots are per isolate group not per isolate. Aliases with the old names are added to ease migration. The aliases don't appear in this AOT ELF's `.dynsym`; only the new names are exported. `src/flutter/FlutterBuildProvider.ts` (around lines 974-977 on `main` @ `efbc486b9`) looks up only the four legacy names (`_kDartVmSnapshotData`, `_kDartVmSnapshotInstructions`, `_kDartIsolateSnapshotData`, `_kDartIsolateSnapshotInstructions`), and the string-pool scan reads the isolate data section. ### Reproduction Public APK: F-Droid Saber 1.36.1, x86_64 build (`https://f-droid.org/repo/com.adilhanney.saber_1360103.apk`, sha256 `de4813f95bdd6ae54adc5a6142be0762c177a782caaed6ed51dae482f6acb720`; `lib/x86_64/libapp.so` sha256 `b54b19d243b6db78e27f9147b56dc0aa17ef6119fa905c2e2f7c72eb2f198feb`, 16,778,120 bytes). ```bash rea identify-flutter-build /targets/saber.apk --format json # succeeds rea inspect-dart-aot /targets/saber.apk --format json # unsupported_target ``` Toolchain, from the app's source at tag `v1.36.1`: Flutter submodule `d3b14c876900e553bc736ca19295fc09e3853e8e` ("[flutter-3.47-candidate.0] Sync engine.version", 2026-08-26), engine `a804b261645ef8c13eb3d5c44a5c2fb0340c5539`; pubspec `sdk: ^3.13.0`, `flutter: ">=3.47.0"`. The F-Droid build recipe is public (fdroiddata `metadata/com.adilhanney.saber.yml`). ### Expected behavior - Recognise the new symbols: `_kDartSnapshotData` (single data snapshot, playing the role the isolate data snapshot had), `_kDartSnapshotText` (instructions) and `_kDartSnapshotBuildId`, alongside the legacy four, and report which layout was found. - When neither set is present, keep `unsupported_target`, but name both expected symbol sets in the message. ### Impact and scope - Likely every Flutter app built with a toolchain that includes Dart commit `d36adbacaf`. Verified here for one current Flutter 3.47 build (x86_64). I haven't checked other ABIs or the exact first Dart release containing the change. - `inspect_dart_aot` is the step after `identify_flutter_build` in the documented Flutter triage, so current Flutter apps stop at triage. - Deterministic. ### REA version `rea-agents@6.5.0`; the symbol list is unchanged on `main` @ `efbc486b9`. ### Runtime and platform Linux x64 Docker container (Ubuntu 24.04) on Windows 11 / Docker Desktop, Node 24.21.0. ### Target and artifact context Public F-Droid APK above (open-source app, GPL-3.0). ### Interface CLI (MCP `inspect_dart_aot` shares the provider). ### Relevant output or evidence Reading the section headers and `.dynsym` of the extracted `libapp.so` directly (ELF64, 11 sections) gives the three symbols listed above. The old names appear nowhere in `.dynstr`.

bsakaguchi referenced this issue

2026-10-17 21:10:41 +00:00

[PR #1355] [CLOSED] docs: clarify README setup command, mention IDA, and update Node badge #2821

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1355

No description provided.

Rows
Columns