Skip to content

Add Dart 3.13 single-snapshot support - #213

Open
Techuouo520 wants to merge 1 commit into
worawit:mainfrom
Techuouo520:feat/dart-3.13-support
Open

Add Dart 3.13 single-snapshot support#213
Techuouo520 wants to merge 1 commit into
worawit:mainfrom
Techuouo520:feat/dart-3.13-support

Conversation

@Techuouo520

Copy link
Copy Markdown
Contributor

Summary

Dart 3.13.0-282.3.beta removed the VM isolate and switched AOT snapshots to a single-snapshot layout. Blutter still assumed the old VM + isolate snapshot model, so apps built with this Dart version could not be loaded.

This PR adds support for the new layout while keeping the existing code path for older Dart versions. Dart 3.13-specific behavior is guarded by BLUTTER_DART_SINGLE_SNAPSHOT.

What changed

Dart 3.13 changed a few VM internals that Blutter relied on:

  • The four _kDartVm* / _kDartIsolate* snapshot symbols were replaced by _kDartSnapshotData and _kDartSnapshotText.
  • Dart_InitializeParams no longer accepts a VM snapshot.
  • OBJECT_STORE_STUB_CODE_LIST was removed and the relevant stubs moved into VM_STUB_CODE_LIST.
  • ObjectStore::throw_stub() and StubCode::HasBeenInitialized() are gone.
  • Closure context and delayed type arguments no longer have fixed offsets and now live in the variable-length elements[] area.
  • Some type-context entries can be null, where null effectively means dynamic.

There were also a few Windows build issues exposed by the newer Dart sources: __VA_OPT__ requires /Zc:preprocessor, UTF-8 source files need /utf-8 on non-UTF-8 Windows codepages, and Dart 3.13's regexp code now requires the matching ICU 73 libraries instead of the Windows SDK ICU.

Implementation

The main changes are:

  • extract_dart_info.py / ElfHelper.cpp
    • support the new two-symbol snapshot layout
    • keep the old symbol lookup as a fallback
  • DartLoader.cpp
    • initialize Dart without a separate VM snapshot on Dart 3.13
    • treat Dart 3.13 snapshots as strong null safety
  • DartStub.h / DartApp.cpp
    • build and load stubs from VM_STUB_CODE_LIST for the new VM layout
  • DartTypes.cpp
    • treat null type slots as Type::DynamicType()
    • include the CID and class name in invalid-type errors to make failures easier to diagnose
  • CodeAnalyzer_arm64.cpp / FridaWriter.cpp
    • temporarily skip the old fixed-offset closure context / delayed-type-argument analysis
    • TODOs are left in place for reimplementing this against elements[]
  • Windows build
    • add /Zc:preprocessor
    • add /utf-8
    • link against the bundled/matching ICU 73 libraries

Validation

Tested end-to-end with an ARM64 libapp.so built using Dart 3.13.0-282.3.beta. Blutter successfully produces:

  • asm/
  • pp.txt
  • objs.txt
  • blutter_frida.js
  • ida_script/

There is still one non-fatal handleOptionalNamedParameters INSN_ASSERT during analysis, but it does not stop output generation.

Known limitation

Closure parameter and generic-type inference is currently less complete on Dart 3.13 because the old analysis depended on fixed closure offsets. Supporting the new elements[] layout properly should be handled separately.

Older Dart versions continue using the existing code paths unchanged.

## Summary

Dart 3.13.0-282.3.beta removed the VM isolate and switched AOT snapshots to a
single-snapshot layout. Blutter still assumed the old VM + isolate snapshot
model, so apps built with this Dart version could not be loaded.

This PR adds support for the new layout while keeping the existing code path for
older Dart versions. Dart 3.13-specific behavior is guarded by
`BLUTTER_DART_SINGLE_SNAPSHOT`.

## What changed

Dart 3.13 changed a few VM internals that Blutter relied on:

* The four `_kDartVm*` / `_kDartIsolate*` snapshot symbols were replaced by
  `_kDartSnapshotData` and `_kDartSnapshotText`.
* `Dart_InitializeParams` no longer accepts a VM snapshot.
* `OBJECT_STORE_STUB_CODE_LIST` was removed and the relevant stubs moved into
  `VM_STUB_CODE_LIST`.
* `ObjectStore::throw_stub()` and `StubCode::HasBeenInitialized()` are gone.
* Closure context and delayed type arguments no longer have fixed offsets and
  now live in the variable-length `elements[]` area.
* Some type-context entries can be null, where null effectively means `dynamic`.

There were also a few Windows build issues exposed by the newer Dart sources:
`__VA_OPT__` requires `/Zc:preprocessor`, UTF-8 source files need `/utf-8` on
non-UTF-8 Windows codepages, and Dart 3.13's regexp code now requires the
matching ICU 73 libraries instead of the Windows SDK ICU.

## Implementation

The main changes are:

* `extract_dart_info.py` / `ElfHelper.cpp`
  * support the new two-symbol snapshot layout
  * keep the old symbol lookup as a fallback
* `DartLoader.cpp`
  * initialize Dart without a separate VM snapshot on Dart 3.13
  * treat Dart 3.13 snapshots as strong null safety
* `DartStub.h` / `DartApp.cpp`
  * build and load stubs from `VM_STUB_CODE_LIST` for the new VM layout
* `DartTypes.cpp`
  * treat null type slots as `Type::DynamicType()`
  * include the CID and class name in invalid-type errors to make failures
    easier to diagnose
* `CodeAnalyzer_arm64.cpp` / `FridaWriter.cpp`
  * temporarily skip the old fixed-offset closure context / delayed-type-argument
    analysis
  * TODOs are left in place for reimplementing this against `elements[]`
* Windows build
  * add `/Zc:preprocessor`
  * add `/utf-8`
  * link against the bundled/matching ICU 73 libraries

## Validation

Tested end-to-end with an ARM64 `libapp.so` built using Dart `3.13.0-282.3.beta`.
Blutter successfully produces:

* `asm/`
* `pp.txt`
* `objs.txt`
* `blutter_frida.js`
* `ida_script/`

There is still one non-fatal `handleOptionalNamedParameters` `INSN_ASSERT` during
analysis, but it does not stop output generation.

## Known limitation

Closure parameter and generic-type inference is currently less complete on Dart
3.13 because the old analysis depended on fixed closure offsets. Supporting the
new `elements[]` layout properly should be handled separately.

Older Dart versions continue using the existing code paths unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant