Akande Simpa
Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs Comprehensive Security Partner (CSP)

Decompressing and decompiling Xamarin assemblies

Auditing a Xamarin application begins by extracting the .NET assemblies from the package. In Xamarin Android applications, the DLL files are often compressed using assemblies compression. We decompress them using tools like xamarin-decompress or custom python scripts before analysis:

# Unzip the APK
unzip app-release.apk -d extracted_app
cd extracted_app/assemblies/
# Decompress Xamarin assembly DLLs
python3 decompress_xamarin_assemblies.py UserInterface.dll UserInterface.decompiled.dll

Once decompiled, we load the assembly files into dnSpy or ILSpy. Because C# compiles to Intermediate Language (IL), decompilation yields near-original source code, exposing database connection credentials, encryption keys, and business logic flaws.

Dynamic analysis and Mono runtime hooking

During dynamic testing, we hook the Mono runtime. Since Xamarin wraps native iOS/Android code inside the Mono virtual machine, standard native hooking scripts for Android (Java.use) or iOS (ObjC.classes) won't intercept C# method execution. We use Frida scripts that target the Mono library directly:

const mono = Module.findExportByName("libmonosgen-2.0.so", "mono_runtime_invoke");
if (mono) {
  Interceptor.attach(mono, {
    onEnter: function (args) {
      const method = args[0];
      const methodName = getMonoMethodName(method);
      console.log("[Mono Audit] Invoked C# Method: " + methodName);
    }
  });
}

Common Xamarin vulnerability vectors

Our penetration tests regularly identify these high-severity findings in Xamarin setups:

1. Hardcoded Cryptographic Keys

The Flaw: C# developers place AES encryption keys, API secrets, or database passwords in static configuration classes. Because IL decompiles cleanly, these keys are instantly visible to reverse engineers.

The Fix: Never store keys in the source. Use Key Vault services or dynamically fetch session-bound keys from your backend after successful multi-factor authentication.

2. Insecure SQLite Storage

The Flaw: Using unencrypted SQLite databases (e.g., SQLite-net) to store user data locally. The databases are stored in plain text in the app sandbox.

The Fix: Implement SQLCipher to encrypt the local database at rest, utilizing keys secured in the Android Keystore or iOS Secure Enclave.

Failure example

Hardcoded client secrets in bank app

A merchant credential or HMAC key inside a Xamarin assembly can be extracted and used outside the app. Revoke it, inspect signed-request logs, move signing to the server, and issue short-lived device tokens for the mobile client.

Decide whether to fix, isolate, or replace

Fix the current app when supported libraries, signing, and server controls remain sound. Isolate a legacy app when migration needs time: reduce API permissions, shorten sessions, block old versions, and add server alerts. Replace the app when unsupported runtime code prevents safe updates or required controls cannot be enforced.

Keep an assembly map, dependency versions, runtime hooks, API evidence, storage paths, and a list of controls enforced only by the client. The shorter Xamarin mobile test plan gives teams a repeatable starting checklist.

Get a focused penetration test for your mobile app and backend. We test the Xamarin or .NET MAUI client, APIs, authentication, and supporting systems as one engagement.

Request a security review

Frequently asked questions

Where is the application logic stored in a Xamarin app?

Unlike native Android (Dex bytecode) or iOS (compiled Mach-O binaries), Xamarin compiles application logic into standard .NET DLL files. These files are typically found in the Assemblies directory of the unzipped app container.

How do security auditors decompile Xamarin DLLs?

We extract the DLLs from the APK/IPA and load them into .NET decompilers like dnSpy, ILSpy, or JetBrains dotPeek. This reveals the C# code, including database connection details, API configurations, and custom logic.

Can certificate pinning be bypassed in Xamarin?

Yes. Xamarin applications using ModernHttpClient or HttpClientHandler can have their certificate pinning bypassed using Frida scripts that hook the Mono runtime or the underlying native networking libraries.