Xamarin is a collection of Python classes focused on unpacking Xamarin assemblies.
A common use-case for this is unpacking portions of APK that were packaged with Xamarin, in which case they would appear under the ./assemblies/ directory.
Xamarout currently supports the following filetypes:
| Name | Signature |
|---|---|
| CompressedAssembly | XALZ |
| BundledAssembly | XABA |
A CompressedAssembly file is a file type which is essentially a LZ4 compressed .NET executable.
A BundledAssembly is a collection of CompressedAssembly files, .NET executables, and their respective config or debug information.
import logging
from xamarout import xaba
logging.basicConfig(level=logging.DEBUG)
x = xaba.XamarinBundledAssembly("assemblies.blob")
x.write("out")Maybe I'll turn this into a Python package at some point. There's also some more UI/UX improvements to be made, but the class structure is here to build off of.
- https://github.com/xamarin/xamarin-android/blob/d0701eb75e096f53e3c070fc6cdbad6d7477afba/src/monodroid/jni/xamarin-app.hh
- https://github.com/x41sec/tools/blob/master/Mobile/Xamarin/Xamarin_XALZ_decompress.py
- https://www.x41-dsec.de/security/news/working/research/2020/09/22/xamarin-dll-decompression/