Blutter Crash Report – DartVM Segfault (SIGSEGV)

[Gintoki93]

App:qlango
Dart Version: 3.5.4

libapp.so SnapshotHash: 80a49c7111088100a233b2ae788e1f48
✅ What I was doing:

I used the following command:

blutter

Processing a Flutter application:

/storage/emulated/0/MT2/apks/qlango.apk

❌ What happened:

The tool ran and printed Dart version/snapshot information, then crashed with SIGSEGV while analyzing instructions in libapp.so.

Here is the full traceback and logs:

Dart version: 3.5.4, Snapshot: 80a49c7111088100a233b2ae788e1f48, Target: android arm64
flags: product no-code_comments no-dwarf_stack_traces_mode dedup_instructions no-tsan no-msan arm64 android compressed-pointers

Cannot find null-safety text. Setting null_safety to true.

libapp is loaded at 0x754ec2f000
Dart heap at 0x7400000000

Analyzing the application

Analysis error at line 1670 void FunctionAnalyzer::handleParameterRegisters(AsmIterator &): !isTmpReg
0x1156ca0: mov x0, x3
0x1156ca4: stur x1, [x29, #-8]
0x1156ca8: mov x16, x3
0x1156cac: mov x3, x1

• 0x1156cb0: mov x1, x16
  0x1156cb4: stur x1, [x29, #-0x10]

Analysis error at line 644 std::unique_ptr<CallLeafRuntimeInstr> FunctionAnalyzer::processCallLeafRuntime(AsmIterator &): il
0xf9f128: ldur x2, [x1, #7]
0xf9f12c: mov x1, x26
0xf9f130: ldr x9, [x1, #0x608]
0xf9f134: mov x1, x2

• 0xf9f138: ldur x2, [x29, #-8]
  0xf9f13c: mov x17, x29

Analysis error at line 487 std::unique_ptr<LeaveFrameInstr> FunctionAnalyzer::processLeaveFrameInstr(AsmIterator &): insn.id() == ARM64_INS_LDP && insn.op_count() == 4
0xf9f15c: mov x16, #8
0xf9f160: str x16, [x26, #0x750]
0xf9f164: mov sp, x19
0xf9f168: mov x15, x29

• 0xf9f16c: ldr x29, [x15], I need help, when I use it all my data is gone, I don't know where #8
  0xf9f170: ldur x0, [x29, #-0x18]

Traceback (most recent call last):
File "/data/data/com.termux/files/home/blutter/blutter.py", line 430, in
main(args.indir, args.outdir, args.rebuild, args.vs_sln, args.no_analysis, args.ida_fcn)
File "/data/data/com.termux/files/home/blutter/blutter.py", line 339, in main
main2(
File "/data/data/com.termux/files/home/blutter/blutter.py", line 313, in main2
build_and_run(input)
File "/data/data/com.termux/files/home/blutter/blutter.py", line 277, in build_and_run
subprocess.run(
File "/data/data/com.termux/files/usr/lib/python3.12/subprocess.py", line 571, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/data/data/com.termux/files/home/blutter/bin/blutter_dartvm3.5.4_android_arm64', '-i', '/storage/emulated/0/MT2/apks/arm64-v8a/libapp.so', '-o', '/storage/emulated/0/MT2/apks/out_dir']' died with <Signals.SIGSEGV: 11>.

🔎 Notes:

This seems to be caused by an unexpected instruction or register state during AArch64 disassembly.

It might be related to inline assembly patterns or obfuscated code sequences in this particular libapp.so

[AbhiTheModder]

Looks like I missed this, sorry for that

[AbhiTheModder]

Can you try the steps below and let me know:

rm -rf bin/ build/ dartsdk/ packages/
git reset --hard origin/main
git pull

And then run blutter on your file

[Gintoki93]

Thanks again. I followed your latest instructions precisely:

rm -rf bin/ build/ dartsdk/ packages/
git reset --hard origin/main
git pull

Than ran
python blutter.py /storage/emulated/0/MT2/apks/arm64-v8a/ out_dir/

And again
rm -rf bin/ build/ dartsdk/ packages/
git reset --hard origin/main
git pull

python blutter.py /storage/emulated/0/MT2/apks/arm64-v8a/ out_dir/ --rebuild

Everything rebuilt successfully, and the Dart SDK (3.5.4) was downloaded and compiled without issues.

However, the same SIGSEGV crash still occurs, at exactly the same point in FunctionAnalyzer::asm2il, while analyzing libapp.so of Qlango.

As mentioned before, the crash seems to be related to this instruction:

0xf9f16c: ldr x29, [x15], #8

blutter-termux.txt

[AbhiTheModder]

Thanks @Gintoki93 ,
Can you share your apk or libs so that I can reproduce it on my side.

[AbhiTheModder]

As mentioned before, the crash seems to be related to this instruction:

0xf9f16c: ldr x29, [x15], #8

Those are just analysis errors. Generally there shouldn't be any errors/crashes due to them.

[Gintoki93]

Thanks @Gintoki93 , Can you share your apk or libs so that I can reproduce it on my side.

arm64-v8a.zip

[Gintoki93]

Honestly, I have no experience with the internals of the tool or C++, so I wouldn’t know how to patch it myself.
That’s why I shared the crash and files — just in case it’s not specific to my device.
If you do end up testing a fix with safe if checks instead of assert(), I’d be happy to test that build and confirm if it works on my end.
Thanks again for all the help and time.

[AbhiTheModder]

Interesting:

Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so

Cannot find define of srcReg
  0x1000cc0: stur d0, [x29, #-0x88]

[saleh-exeer-sys]

Interesting:

Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so

Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

I am looking forward for the answer since I am facing the same issue but with dart 3.7.2

[AbhiTheModder]

Interesting:
Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so
Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

I am looking forward for the answer since I am facing the same issue but with dart 3.7.2

Can you please share your libs?
Thanks

[Gintoki93]

Interesting:

Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so

Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

Update:

I tested the same APK and libapp.so using blutter on Ubuntu (outside of Termux), and it worked perfectly.

✅ The analysis completed without any crash — all scripts and assembly dumps were generated.

🧠 So it looks like the SIGSEGV is due to a buggy or incompatible version of libcapstone.so shipped in Termux.

Might be worth mentioning as a known limitation for ARM64 Termux environments.

Thanks again for all the help and support!

[AbhiTheModder]

Interesting:
Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so
Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

Update:

I tested the same APK and libapp.so using blutter on Ubuntu (outside of Termux), and it worked perfectly.

✅ The analysis completed without any crash — all scripts and assembly dumps were generated.

🧠 So it looks like the SIGSEGV is due to a buggy or incompatible version of libcapstone.so shipped in Termux.

Might be worth mentioning as a known limitation for ARM64 Termux environments.

Thanks again for all the help and support!

Yes, I am aware of it, and it functions perfectly with older versions of libraries in Termux as well. However, as a maintainer, I cannot instruct users to migrate and utilize outdated library versions unless I am entirely unable to resolve the issue.

[saleh-exeer-sys]

Interesting:
Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so
Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

I am looking forward for the answer since I am facing the same issue but with dart 3.7.2

Can you please share your libs? Thanks

Absolutely

libs.zip

[AbhiTheModder]

Interesting:
Program received signal SIGSEGV, Segmentation fault. 0x0000007fefb2afe4 in AArch64_get_insn_id () from /data/data/com.termux/files/usr/lib/libcapstone.so
Cannot find define of srcReg
0x1000cc0: stur d0, [x29, #-0x88]

I am looking forward for the answer since I am facing the same issue but with dart 3.7.2

Can you please share your libs? Thanks

Absolutely

libs.zip

Hi,
Your issue is unrelated to this.

exception: Wrong full snapshot version, expected 'd91c0e6f35f0eb2e44124e8f42aa44a7' found 'fee3de0d0af52c31bb081d4226a13a42'

It's not officially compiled lib rather a custom flutter build, blutter doesn't support custom builds.