jsxamstore

Xamarin AssemblyStore Explorer

Summary

• rewrite of pyxamstore by Jake Valletta
• converted implementation from Python to JavaScript
• made a few tweaks

Installation

  npm install --global "@warren-bank/jsxamstore"

Usage

Unpacking:

I recommend using the tool in conjunction with apktool. Run the following commands to unpack an APK, and unpack the Xamarin DLLs:

  apktool d yourapp.apk
  jsxamstore unpack -d yourapp/unknown/assemblies/

Assemblies that are detected as compressed with LZ4 will be automatically decompressed in the extraction process.

Repacking:

If you want to make changes to the DLLs within the AssemblyStore, you can use jsxamstore along with the assemblies.json generated during the unpack to create a new assemblies.blob file(s). Run the following command from the directory where your assemblies.json file exists:

  jsxamstore pack

From here you'll need to copy the new manifest and blobs as well as repackage/sign the APK.

Help:

> jsxamstore help

usage: node jsxamstore.js MODE <args>

MODES:
  unpack <args>  Unpack assembly blobs.
  pack <args>    Repackage assembly blobs.
  hash file_name Generate xxHash values.
  help           Print this message.

> jsxamstore unpack --help

Usage: jsxamstore unpack [options]

Options:
  -d, --dir    Where to load blobs/manifest from.       [string] [default: "./"]
  -o, --out    Where to save dlls/manifest to.      [string] [default: "./out/"]
  -a, --arch   Which architectures to unpack. Default is all. To select a
               subset, repeat flag with any combination of: "arm", "arm64",
               "x86", "x86_64". To exclude all, use: "none", "no", or "0".
                                                           [array] [default: []]
  -f, --force  Force re-create out/ directory.        [boolean] [default: false]
      --help   Show help                                               [boolean]

> jsxamstore pack --help

Usage: jsxamstore pack [options]

Options:
  -c, --config  Input assemblies.json file.[string] [default: "assemblies.json"]
  -o, --out     Where to save blobs/manifest to.    [string] [default: "./out/"]
      --help    Show help                                              [boolean]

Related Reading

• several articles written by Jake Valletta
  • author of: pyxamstore
• Unpacking Xamarin Android Mobile Applications
  • author of: XamAsmUnZ
• Introduction to the Exploitation of Xamarin Apps
• Decompiling an Android Application Written in .NET MAUI

Known Limitations

• DLLs that have debug/config data associated with them

Legal

• copyright: Warren Bank
• license: GPL-2.0