Merge pull request #1860 from HackTricks-wiki/research_update_src_mobile-pentesting_xamarin-apps_20260205_023626

Research Update Enhanced src/mobile-pentesting/xamarin-apps....

Author: carlospolop

src/mobile-pentesting/xamarin-apps.md

@@ -34,20 +34,37 @@ To access the assemblies in an APK/IPA, unzip the file and explore the assemblie
 python3 xamarin-decompress.py -o /path/to/decompressed/apk
 ```
 
-In cases where after decompiling the APK it's possible to see the unknown/assemblies/ folder with the `.dll` files inside it, so it's posible to use [**dnSpy**](https://github.com/dnSpy/dnSpy) directly over the `.dlls` to analyze them.\
-However, sometimes, it's found the `assemblies.blob` and `assemblies.manifest` files inside the unknown/assemblies/ folder. The tool [pyxamstore](https://github.com/jakev/pyxamstore) can be used for unpacking the `assemblies.blob` file in Xamarin apps, allowing access to the .NET assemblies for further analysis:
+In cases where after decompiling the APK it's possible to see the unknown/assemblies/ folder with the `.dll` files inside it, it's possible to use [**dnSpy**](https://github.com/dnSpy/dnSpy) directly over the `.dlls` to analyze them. However, sometimes the `assemblies.blob` and `assemblies.manifest` files are inside the unknown/assemblies/ folder. The tool [pyxamstore](https://github.com/jakev/pyxamstore) can unpack the `assemblies.blob` file in Xamarin apps, allowing access to the .NET assemblies for further analysis:
 
 ```bash
 pyxamstore unpack -d /path/to/decompressed/apk/assemblies/
+# After patching DLLs, rebuild the store
+pyxamstore pack
+```
+
+Some recent Xamarin/MAUI builds store compressed assemblies using the **XALZ** format inside `/assemblies.blob` or `/resources/assemblies`. You can quickly decompress them with the [xamarout](https://pypi.org/project/xamarout/) library:
+
+```python
+from xamarout import xalz
+import os
+for root, _, files in os.walk("."):
+    for f in files:
+        if open(os.path.join(root, f), 'rb').read(4) == b"XALZ":
+            xa = xalz.XamarinCompressedAssembly(os.path.join(root, f))
+            xa.write("decompressed/" + f)
 ```
 
 iOS dll files are readily accessible for decompilation, revealing significant portions of the application code, which often shares a common base across different platforms.
 
+> **AOT on iOS**: managed IL is compiled into native `*.aotdata.*` files. Patching the DLL alone will not change logic; you need to hook native stubs (e.g., with Frida) because the IL bodies are empty placeholders.
+
 ### Static Analysis
 
-Once the `.dll`s are obtained it's possible to analyze the .Net code statically using tools such as [**dnSpy**](https://github.com/dnSpy/dnSpy) **or** [**ILSpy**](https://github.com/icsharpcode/ILSpy) **t**hat will allow to modify the code of the app. This can be super useful to tamper the application to bypass protections for example.\
+Once the `.dll`s are obtained it's possible to analyze the .Net code statically using tools such as [**dnSpy**](https://github.com/dnSpy/dnSpy) or [**ILSpy**](https://github.com/icsharpcode/ILSpy) that will allow modifying the code of the app. This can be super useful to tamper the application to bypass protections for example.\
 Note that after modifying the app you will need to pack it back again and sign it again.
 
+> dnSpy is archived; maintained forks like **dnSpyEx** keep working with .NET 8/MAUI assemblies and preserve debug symbols when re-saving.
+
 ### Dynamic Analysis
 
 Dynamic analysis involves checking for SSL pinning and using tools like [Fridax](https://github.com/NorthwaveSecurity/fridax) for runtime modifications of the .NET binary in Xamarin apps. Frida scripts are available to bypass root detection or SSL pinning, enhancing analysis capabilities.
@@ -58,17 +75,36 @@ Other interesting Frida scripts:
 - [**xamarin-root-detect-bypass**](https://codeshare.frida.re/@nuschpl/xamarin-root-detect-bypass/)
 - [**Frida-xamarin-unpin**](https://github.com/GoSecure/frida-xamarin-unpin)
 
+Updated **Frida-xamarin-unpin** (Mono >=6) hooks `System.Net.Http.HttpClient.SendAsync` and swaps the handler to a permissive one, so it still works even when pinning is implemented in custom handlers. Run it after the app starts:
+
+```bash
+frida -U -l dist/xamarin-unpin.js com.target.app --no-pause
+```
+
+Quick template to hook managed methods with the bundled `frida-mono-api`:
+
+```javascript
+const mono = require('frida-mono-api');
+Mono.ensureInitialized();
+Mono.enumerateLoadedImages().forEach(i => console.log(i.name));
+const klass = Mono.classFromName("Namespace", "Class");
+const m = Mono.methodFromName(klass, "Method", 2);
+Mono.intercept(m, { onEnter(args){ console.log(args[1].toInt32()); } });
+```
+
 ### Resigning
 
 The tool [Uber APK Signer](https://github.com/patrickfav/uber-apk-signer) simplifies signing multiple APKs with the same key, and can be used to resign an app after changes have been performed to it.
 
-## Further information
+## References
 
 - [https://www.appknox.com/security/xamarin-reverse-engineering-a-guide-for-penetration-testers](https://www.appknox.com/security/xamarin-reverse-engineering-a-guide-for-penetration-testers)
 - [https://thecobraden.com/posts/unpacking_xamarin_assembly_stores/](https://thecobraden.com/posts/unpacking_xamarin_assembly_stores/)
 - [https://medium.com/@justmobilesec/introduction-to-the-exploitation-of-xamarin-apps-fde4619a51bf](https://medium.com/@justmobilesec/introduction-to-the-exploitation-of-xamarin-apps-fde4619a51bf)
+- [https://github.com/jakev/pyxamstore](https://github.com/jakev/pyxamstore)
+- [https://pypi.org/project/xamarout/](https://pypi.org/project/xamarout/)
+- [https://github.com/GoSecure/frida-xamarin-unpin](https://github.com/GoSecure/frida-xamarin-unpin)
+- [https://gist.github.com/Diefunction/e26fce039efcab57aac342a4b2d48ff6](https://gist.github.com/Diefunction/e26fce039efcab57aac342a4b2d48ff6)
+- [https://reverseengineering.stackexchange.com/questions/31716/deobfuscating-ios-dll-file-i-think-arm64](https://reverseengineering.stackexchange.com/questions/31716/deobfuscating-ios-dll-file-i-think-arm64)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-