FlutterTap: Persistent Flutter TLS Proxy & SSL Bypass

FlutterTap is an open-source Zygisk module that redirects Flutter app network traffic to a custom proxy while bypassing BoringSSL certificate verification. It works natively on Android without app repackaging, active USB cables, or Frida background sessions.

When testing Flutter applications, I found that FlutterTap hooks directly into native libflutter.so methods via Capstone disassembly and Dobby, completely eliminating the headache of reconnecting Frida after every app restart. Setting the proxy IP inside the companion app instantly routed my HTTPS traffic straight to Burp Suite without leaving behind obvious detection footprints.

FlutterTap Features

• Native BoringSSL hooks target unexported SSL functions inside libflutter.so to force valid certificate checks.
• Companion manager app lets you toggle target applications and update your proxy IP directly on your phone.
• Zero memory footprint on unselected apps because the module instantly unloads itself using DLCLOSE.
• Cable-free persistence ensures your traffic redirect stays alive across reboots without an active Frida session.

Support & Requirements

• Android Support: Android 10 (API 29) through Android 17 (API 37) on arm64-v8a and x86_64.
• Root Requirements: Magisk, KernelSU, SukiSu Ultra, or APatch.
• Zygisk Framework: Magisk built-in Zygisk, Zygisk Next (including with Linker enabled), or NeoZygisk.

How to Install

1. Flash the module: Open your root manager, flash FlutterTap.zip, and reboot your phone.
2. Setup the manager: Install FlutterTap-manager.apk and grant root access when prompted.
3. Apply settings: Set your proxy IP and port, tick your target apps, then force-stop and reopen them.