{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/info/versions.md",
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/1-introduction.ipynb",
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/2-playground.ipynb",
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/darter/file.py",
    "https://github.com/mildsunrise/darter/tree/a6498786ed0f96b2b70635f008fee62dc07796da/samples",
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/utils/timemachine_pub.js",
    "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/LICENSE"
  ],
  "category": "android",
  "description_en": "Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. It reads old, AppJIT and AppAOT snapshots, usually autodetects flags and settings from the snapshot itself, extracts the snapshot blobs from app.so or .snapshot files, and its darter.asm module disassembles ARM and ARM64 code with Capstone to find references to VM objects. The README's examples include extracting an app's string table, finding where an object is used, generating call and library-dependency graphs, exporting metadata for Radare2 and deobfuscating a snapshot by matching it against a reference one.",
  "description_zh": "用于解析二进制 Dart VM 快照（例如 Flutter 发布版应用中的 libapp.so）的 Python 模块，可把快照内容还原为带反向引用、便于浏览的 VM 对象图，连同快照中转储的内存结构一并解析。它支持旧式、AppJIT 和 AppAOT 三类快照，通常能从快照本身自动识别编译标志和设置，可从 app.so 或 .snapshot 文件中自动提取快照数据块；其 darter.asm 模块借助 Capstone 反汇编 ARM 和 ARM64 代码，查找其中对 VM 对象的引用。README 列举的用法包括提取应用的字符串表、查找某个对象在何处被使用、生成调用图和库依赖图、为 Radare2 导出元数据，以及与参考快照比对来对快照去混淆。",
  "entry_url": "https://awesomerea.org/resources/darter/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/darter/",
  "evidence_url": "https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/README.md",
  "group": "tools",
  "id": "darter",
  "json_url": "https://awesomerea.org/resources/darter/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/darter/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/darter/index.md",
  "name": "darter",
  "name_zh": "darter Dart 快照解析器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The README warns that the project is outdated and that snapshots from a reasonably modern Dart or Flutter version probably will not parse correctly. The parser was written against Dart SDK commit 1ef83b86ae, and info/versions.md names snapshot hash c8562f0ee0ebc38ba217c7955956d1cb as the only supported version, which its Flutter table maps to the 2019 releases v1.9.1+hotfix.2 to v1.9.1+hotfix.6. Parser code last changed in 2021; the reviewed master commit of 2026-02-03 only extends that table, now through Flutter 3.38.9, and the repository has no releases or tags.",
    "darter is a library with no stand-alone program or CLI; the README recommends using it from Jupyter, starting with the 1-introduction and 2-playground notebooks. Most of the code has no dependencies, but parse_elf_snapshot needs pyelftools and darter.asm needs Capstone and its Python binding; no Python version or package metadata is given.",
    "The README reports heavy testing only on AppAOT product snapshots for ARM and ARM64 and light testing on x64 AppJIT release snapshots, and the disassembly analysis supports only ARM and ARM64. Kernel AST snapshots, such as .dill files, are not supported. The README recommends practicing on a snapshot one built oneself before analyzing another; users supply the libapp.so or snapshot to study.",
    "samples/ commits arm-app.so and arm64-app.so, which the introduction notebook describes as builds of the default Flutter app; the samples/appjit.snapshot path it shows for AppJIT input is not committed. utils/ adds Radare2-metadata and import generators and a Node script that replays the pub package registry as of a past date through a local HTTPS proxy, using a committed self-signed CA plus a pub.dartlang.org certificate and key; that certificate expired in 2022.",
    "AGPL-3.0."
  ],
  "requirements_zh": [
    "README 警告该项目已经过时，由较新版本 Dart 或 Flutter 生成的快照很可能无法正确解析。解析器依据 Dart SDK 提交 1ef83b86ae 编写，info/versions.md 称唯一受支持的快照哈希为 c8562f0ee0ebc38ba217c7955956d1cb，其 Flutter 版本表显示它对应 2019 年发布的 v1.9.1+hotfix.2 至 v1.9.1+hotfix.6。解析器代码最后一次修改是在 2021 年；所审阅的 2026-02-03 master 提交只扩充了该版本表（现已列到 Flutter 3.38.9），仓库也没有发行版或标签。",
    "darter 是一个库，没有独立程序或命令行界面；README 推荐在 Jupyter 中使用，先看 1-introduction，再看 2-playground 两个笔记本。大部分代码没有外部依赖，但 parse_elf_snapshot 需要 pyelftools，darter.asm 需要 Capstone 及其 Python 绑定；仓库未注明 Python 版本，也没有软件包元数据。",
    "README 称只在 ARM 和 ARM64 的 AppAOT 产品快照上做过大量测试，在 x64 的 AppJIT 发布快照上做过少量测试，反汇编分析也只支持 ARM 和 ARM64。不支持 .dill 等 Kernel AST 快照。README 建议先用自己构建的快照练习，再分析其他快照；要研究的 libapp.so 或快照需由用户自备。",
    "samples/ 目录提交了 arm-app.so 和 arm64-app.so，入门笔记本称它们是默认 Flutter 应用的构建产物；笔记本中用于演示 AppJIT 输入的 samples/appjit.snapshot 并未提交。utils/ 目录提供 Radare2 元数据生成器和导入文件生成器，以及一个 Node 脚本：它通过本地 HTTPS 代理模拟过去某一日期的 pub 包仓库，为此使用仓库中提交的自签名 CA 以及 pub.dartlang.org 证书和私钥，该证书已于 2022 年过期。",
    "采用 AGPL-3.0 许可。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/mildsunrise/darter",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}