Locating Flutter's TLS certificate verifier in a stripped libflutter.so without byte signatures

The author describes a method to locate the ssl_crypto_x509_session_verify_cert_chain function in stripped Flutter libraries (libflutter.so) without relying on byte signatures that break across compiler versions. The technique uses two compiler-independent properties: the function references both "ssl_client" and "ssl_server" strings, and on arm64 its prologue stores a byte through the x2 register. The method was tested on 13 apps with Flutter engines ranging from version 2.19.2 to 3.11.1 and successfully located the function in all cases, also revealing a bug in their patcher that only opened base.apk when most apps ship libflutter.so in split_config.arm64_v8a.apk.