Reverse Engineering a Xamarin Application.

During a recent engagement I came across an Android application which, after extracting and decompiling the Java code (using dex2-jar and jd-gui) I noticed the logic was calling a native function, by reviewing the code a little more I figured out the native function was defined in a DLL file located in an assemblies folder. The folder also included a bunch of Xamarin, Microsoft and Mono DLL binaries, which is what you would expect to find in Xamarin applications.

Xamarin “is an open-source platform for building modern and performant applications for iOS, Android, and Windows with .NET” or at least that’s what Microsoft says. It basically is a framework that allows code developed in .Net to run in the most popular platforms out there.

Since reviewing and understanding the code of the application is a most in these kind of engagements, the next step was to reverse engineer those DLL files, for this you would think a tool like ILSpy would easily take care of the task, right?

The problem

Here is where things start to get interesting, we can use ILSpy after installing the extension in Visual Studio Code, below is the result I got when trying to decompile one of the DLLs (as example we will use Mono.Android.dll):

By doing some digging we can see this comment on a pull request within the Xamarin github repository where compression of assemblies was changed to LZ4 for efficiency reasons. By hexdumping the DLL with the following command:

hexdump -C Mono.Android.dll

We confirm the presence of LZ4 compression via the XALZ header:

This means that the LZ4 compressed DLL looks something like this:

The solution

That means we will need to extract and unpack the payload length to find out the length of the payload and then LZ4 decompress the payload to obtain a file that can be decompiled (via ILSpy for instance). For this we can use the lz4.block python library and do something like the below:

lz4.block.decompress(payload, uncompressed_size=length)

You can find the full script in the below github link:

https://github.com/securitygrind/lz4_decompress/blob/main/lz4_decompress.py

After running the script with the below command:

./lz4_decompress.py Mono.Android.dll

We take the resulting DLL (Mono.Android_out.dll) and try again with ILSpy, we can now see that the assembly is decompiled and we can inspect the contents of the DLL: