{"id":2233,"date":"2023-06-13T09:38:52","date_gmt":"2023-06-13T07:38:52","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=2233"},"modified":"2025-09-15T13:38:19","modified_gmt":"2025-09-15T13:38:19","slug":"pentesting-xamarin-android-apps-dlls-and-root-check-bypass","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/pentesting-xamarin-android-apps-dlls-and-root-check-bypass\/","title":{"rendered":"Pentesting Xamarin Android apps: DLLs and root check bypass"},"content":{"rendered":"

In this article, I\u2019ll show how to detect and bypass some basic security checks in the application’s DLLs, such as the root check, to be able to start pentesting an android mobile application written in Xamarin.<\/p>\n

Backstory<\/h2>\n

I was not expecting Xamarin. I’m quite new to the mobile application pentesting world and it was a sunny bright day when I decided to pick an app from a bug bounty program thinking “this app looks like a good candidate to flex my new skills”. Turned out it was quite different from my previous experiences. Not so sunny anymore.<\/p>\n

\"Feels<\/p>\n

There were a few articles online on Xamarin app pentesting but none seemed to tackle all the complexities I had faced from start to end. So here I am, hopefully helping someone who just got Xamarined in the face.<\/p>\n

Unpacking and decoding the apk<\/h2>\n

Nothing special here, just preparing the field by unpacking and decoding the apk. I used Apktool<\/a>:<\/p>\n

$ java -jar apktool_2.6.1.jar d -o \/<path for output>\/apktoolOut \u00a0\/<path to apk>\/XamarinApplication.apk<\/pre>\n
Discovery<\/h2>\n
My starting point in this case was an error message that the application displayed after recognizing I was using a rooted device. Searching for strings is usually a very quick way to find the relevant code behind a specific function. However, pay attention that your search includes also archives, binaries and such. Just so, by searching the error string returned by the root check, I discovered that the root check functionality I was searching for was inside a binary file called assemblies.blob.<\/p>\n
With a bit of googling I learned that this file contains the DLLs used by the application and, as it turned out, this particular application had actually most of its security logic implemented in these DLLs.<\/p>\n
Unpacking the assemblies.blob<\/h2>\n
To unpack the assemblies.blob I tried a few different tools but settled for pyxamstore<\/a> because it also allowed to repack the blob after tampering with the DLLs. This tool must be launched on the folder containing both the assemblies.blob and the assemblies.manifest files:<\/p>\n
$ pyxamstore unpack -d apktoolOut\/unknown\/assemblies\/<\/pre>\n
As output this tool creates an assemblies.json, which will be needed for repacking, and a folder named \u201cout\u201d containing all the DLLs.<\/p>\n
Now, searching again for the error string I could locate the exact DLL that contained it.<\/p>\n
Tampering the DLL<\/h2>\n
To decompile, edit and recompile the DLL I used dnSpy<\/a>. Turned out it was quite easy to bypass the root check. Starting from my error string I eventually found a class named IsJailBroken(). All I had to do was replace all code with a “return false”.<\/p>\n
\"\"<\/p>\n
To edit the code simply right click on it and select \u201cEdit Class\u201d then hit \u201cCompile\u201d.<\/p>\n
When done with all the code edits go to File > Save Module. I left the default settings with Module Type: DLL and overwrote the original file.<\/p>\n
Now the annoying part, making it all work again.<\/p>\n
Repacking assemblies.blob<\/h2>\n
I repacked the blob with pyxamstore, running it in the folder that had the assemblies.json and the \u201cout\u201d folder with the tampered DLL:<\/p>\n
$ pyxamstore pack<\/pre>\n
In the folder generated by Apktool I replaced the original assemblies.blob and assemblies.manifest files with those generated by the pyxamstore pack command. In my case they were in a folder named \/unknown\/assemblies\/.<\/p>\n
Repacking the apk<\/h2>\n
I repacked the application with Apktool as follows:<\/p>\n
$ java -jar apktool_2.7.0.jar b -o \/<path to repacked output>\/XamarinApplication.apk \/<path to Apktool generated folder>\/apktoolOut\r\n<\/pre>\n
Resigning the apk<\/h2>\n
Finally, the apk needs to be signed and reinstalled on the phone. I had some trouble with the whole manual signing, zip aligning, etc. process but managed to make it work very easily by using the tool uber-apk-signer<\/a>:<\/p>\n
$ java -jar uber-apk-signer-1.3.0.jar --apks \/<path to repacked apk>\/XamarinApplication.apk<\/pre>\n
In my case I had the additional complexity that the application was actually an app bundle divided into 5 apks, that looked something like this:<\/p>\n