---
name: rt-cross-platform-mobile
description: "Cross-platform mobile app testing — React Native (JS bundle extraction, hermes bytecode), Flutter (libflutter.so reverse engineering, reFlutter), Xamarin (DLL extraction, IL2CPP), Ionic/Cordova (WebView injection), Unity mobile games. Each framework has unique reverse engineering and bypass techniques completely different from native Android/iOS."
---

> 🐳 **Docker Environment (Recommended):** `docker exec -it rtexit-kali bash`

# rt-cross-platform-mobile — React Native, Flutter, Xamarin, Cordova

## Overview

Cross-platform frameworks compile differently than native apps — standard Android/iOS testing approaches often fail. Each framework requires specific tools and techniques.

**Identify framework:**
```bash
docker exec rtexit-kali bash -c "
unzip -l target.apk | grep -iE 'flutter|hermes|xamarin|cordova|react|unity'
# hermes.bytecode → React Native (Hermes engine)
# libflutter.so → Flutter
# assemblies/*.dll → Xamarin
# www/index.html → Cordova/Ionic
# libunity.so → Unity
"
```

---

## React Native

### Detect & Extract JS Bundle

```bash
docker exec rtexit-kali bash -c "
# Unzip APK
unzip target.apk -d /tmp/target_apk

# Find JS bundle
find /tmp/target_apk -name '*.bundle' -o -name '*.js' | head -20
# Common paths:
# assets/index.android.bundle
# assets/App.bundle
# res/raw/*.bundle

# Check if Hermes bytecode (compiled) or plain JS
file /tmp/target_apk/assets/index.android.bundle
# 'Hermes bytecode' = compiled
# 'ASCII text' or 'data' = plain JS (just read it!)
"
```

### Plain JS Bundle — Read Directly

```bash
docker exec rtexit-kali bash -c "
# Plain JS bundle = goldmine of secrets, API endpoints, logic
cat /tmp/target_apk/assets/index.android.bundle | \
  python3 -c \"import sys; import jsbeautifier; print(jsbeautifier.beautify(sys.stdin.read()))\" > /tmp/bundle_pretty.js

# Hunt secrets
grep -iE 'api_key|apikey|secret|password|token|endpoint|https?://' /tmp/bundle_pretty.js | sort -u | head -50

# Find all hardcoded URLs
grep -oE 'https?://[^\"]+' /tmp/bundle_pretty.js | sort -u
"
```

### Hermes Bytecode — Decompile

```bash
docker exec rtexit-kali bash -c "
# Install hermes-dec
pip3 install hermes-dec

# Decompile Hermes bytecode to JS
hermes-dec /tmp/target_apk/assets/index.android.bundle > /tmp/decompiled.js

# Alternative: hbctool
pip3 install hbctool
hbctool disasm /tmp/target_apk/assets/index.android.bundle /tmp/hbc_out/
cat /tmp/hbc_out/instruction.hasm | grep -i 'secret\|key\|token'
"
```

### React Native SSL Pinning Bypass

```javascript
// rn-ssl-bypass.js
Java.perform(() => {
  // OkHttp (RN Android uses this)
  try {
    const CertPinner = Java.use('okhttp3.CertificatePinner');
    CertPinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
      console.log('[*] RN OkHttp CertificatePinner bypassed');
    };
  } catch(e) {}

  // react-native-ssl-pinning package bypass
  try {
    const OkHttpClientProvider = Java.use('com.facebook.react.modules.network.OkHttpClientProvider');
    OkHttpClientProvider.createClientBuilder.implementation = function() {
      const b = this.createClientBuilder();
      const emptyPinner = Java.use('okhttp3.CertificatePinner$Builder').$new().build();
      b.certificatePinner(emptyPinner);
      return b;
    };
  } catch(e) {}
});
```

---

## Flutter

### Identify Flutter Version

```bash
docker exec rtexit-kali bash -c "
adb pull \$(adb shell pm path com.target.app | cut -d: -f2 | tr -d '\r') /tmp/target.apk
unzip /tmp/target.apk -d /tmp/flutter_apk
strings /tmp/flutter_apk/lib/arm64-v8a/libflutter.so | grep -E '^[0-9]+\.[0-9]+\.[0-9]'
# Also check:
strings /tmp/flutter_apk/lib/arm64-v8a/libflutter.so | grep 'Flutter '
"
```

### Extract Dart Code (flutter_assets)

```bash
docker exec rtexit-kali bash -c "
# Flutter stores compiled Dart in flutter_assets/kernel_blob.bin or snapshot_blob.bin
ls /tmp/flutter_apk/assets/flutter_assets/

# Use Doldrums or reFlutter to extract
pip3 install doldrums 2>/dev/null
doldrums /tmp/flutter_apk/assets/flutter_assets/kernel_blob.bin /tmp/dart_out/

# Hunt secrets in extracted Dart
grep -r 'apiKey\|secret\|password\|endpoint' /tmp/dart_out/
"
```

### reFlutter — Patch Flutter SSL

```bash
docker exec rtexit-kali bash -c "
# reFlutter patches libflutter.so to remove SSL pinning
pip3 install reFlutter

# Patch + rebuild APK
reFlutter target.apk
# Output: release.RE.apk (with patched Flutter engine)

# Sign and install
java -jar /opt/uber-apk-signer.jar -a release.RE.apk --out ./signed/
adb install signed/release.RE-aligned-debugSigned.apk

# Set up Burp proxy
# reFlutter redirects all traffic to 127.0.0.1:8083
adb reverse tcp:8083 tcp:8080
# Now Burp intercepts all Flutter HTTPS traffic
"
```

### Frida for Flutter (Native Hook)

```javascript
// flutter-ssl-bypass.js — hook BoringSSL directly

setTimeout(() => {
  const lib = Process.getModuleByName('libflutter.so');
  if (!lib) { console.log('libflutter.so not loaded'); return; }
  
  // Find ssl_verify_peer_cert (varies by version)
  // Use: $ nm -D libflutter.so | grep ssl_verify
  // Or: $ objdump -d libflutter.so | grep -A5 "ssl_verify_peer"
  
  // Common Flutter 3.x offset (find yours with nm/objdump)
  const exports = ['ssl_verify_peer_cert', 'ssl_crypto_x509_session_verify_cert_chain'];
  exports.forEach(name => {
    const addr = Module.findExportByName('libflutter.so', name);
    if (addr) {
      Interceptor.replace(addr, new NativeCallback(() => {
        console.log('[*] Flutter ' + name + ' bypassed');
        return 1;
      }, 'int', ['pointer', 'pointer', 'int', 'pointer']));
    }
  });
}, 500);
```

---

## Xamarin

### Extract .NET Assemblies

```bash
docker exec rtexit-kali bash -c "
# Xamarin embeds .NET DLLs in assemblies/ directory
unzip target.apk 'assemblies/*' -d /tmp/xamarin_apk

# Assemblies are compressed in newer Xamarin — decompress
cd /tmp/xamarin_apk/assemblies/
# Try: LZ4 compressed
python3 -c \"
import lz4.frame, os
for f in os.listdir('.'):
    if f.endswith('.dll'):
        try:
            with open(f, 'rb') as fin:
                data = fin.read()
                if data[:4] == b'XALZ':  # Xamarin LZ4 header
                    decompressed = lz4.frame.decompress(data[8:])
                    with open(f + '.dec', 'wb') as fout:
                        fout.write(decompressed)
                    print('Decompressed:', f)
        except: pass
\"
"
```

```bash
docker exec rtexit-kali bash -c "
# Decompile DLLs with ILSpy or dnSpy equivalent (ilspycmd)
dotnet tool install ilspycmd -g 2>/dev/null || true
~/.dotnet/tools/ilspycmd /tmp/xamarin_apk/assemblies/App.dll > /tmp/app_source.cs

# Or use monodis
monodis /tmp/xamarin_apk/assemblies/App.dll > /tmp/app.il

# Hunt secrets
grep -i 'apiKey\|secret\|password\|baseUrl\|endpoint' /tmp/app_source.cs
"
```

---

## Ionic / Cordova

```bash
docker exec rtexit-kali bash -c "
# Cordova is basically a WebView app — JS source in www/
unzip target.apk 'assets/www/*' -d /tmp/cordova_apk

# Read JS directly — no compilation
cat /tmp/cordova_apk/assets/www/js/app.js | head -200
grep -r 'apiKey\|secret\|baseUrl\|password' /tmp/cordova_apk/assets/www/ -r

# Cordova plugins are often vulnerable
ls /tmp/cordova_apk/assets/www/plugins/

# Intercept traffic — no special bypass needed usually
# Just set Burp proxy + trust cert
"
```

---

## Unity Mobile Games

```bash
docker exec rtexit-kali bash -c "
# Unity stores game logic in libil2cpp.so (IL2CPP) or in assets (Mono)
unzip target.apk 'lib/arm64-v8a/libil2cpp.so' 'assets/bin/Data/*' -d /tmp/unity_apk

# Check if Mono (easier) or IL2CPP
ls /tmp/unity_apk/assets/bin/Data/*.assets

# Mono: extract with AssetRipper or UABE
# IL2CPP: use Il2CppInspector or il2cpp-analyzer

# Secrets often in GameConfig.json or hardcoded in Assembly-CSharp.dll (Mono)
find /tmp/unity_apk -name '*.json' | xargs grep -i 'api\|key\|token\|secret'
"
```

---

## Related Skills
- `rt-frida-advanced` — hook any of these frameworks at runtime
- `rt-mobile-ssl-pinning` — framework-specific pinning bypass
- `rt-exploit-android` — full Android methodology
- `rt-exploit-ios` — full iOS methodology
- `rt-mobile-static-deep` — MobSF + automated analysis

## References
- https://github.com/Impact-I/reFlutter
- https://github.com/nicowillis/doldrums (Dart extractor)
- https://github.com/nicowillis/hermes-dec
- https://attack.mitre.org/techniques/T1601/ — Modify System Image
