kill_flutter — version-agnostic Flutter SSL pinning bypass

A Python CLI that generates a Frida script to disable TLS certificate validation in Flutter apps on Android and iOS. Flutter ships with its own BoringSSL-based network stack, so OS-level pinning bypasses fail, public Frida scripts rely on hardcoded offsets, and reFlutter maintains a version table. kill_flutter locates the certificate-validation function dynamically: it anchors on BoringSSL strings (ssl_client, ssl_server) and scans ARM64 instructions (ADRP+ADD, function prologue) to calculate the offset for an arbitrary build. Capabilities: bypasses pinning for the default HttpClient and the dio package, including custom validators in Flutter's HTTP stack; handles both .apk and .ipa; generates a ready-to-use flutter_bypass.js, iptables redirect commands, and a Frida launch command. It accepts an .apk/.ipa and a proxy address; a rooted/jailbroken device and a Burp listener are required. It does not bypass mTLS or root/jailbreak detection. 'Works on any build' is the author's claim, and the repo is still low-activity. Tool: https://github.com/f3rb123/kill_flutter