Find if app was built using Xamarin?

Question

Theres is any way to find out if a given Android or iOS app was built using Xamarin?

Answer 1

yes. The structure of the folder of the application. For Example you can in Android

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'

/assemblies/Sikur.Monodroid.dll
/assemblies/Sikur.dll
/assemblies/Xamarin.Android.Support.v13.dll
/assemblies/Xamarin.Android.Support.v4.dll
/assemblies/Xamarin.Android.Support.v7.AppCompat.dll
/assemblies/Xamarin.Android.Support.v7.CardView.dll
/assemblies/Xamarin.Android.Support.v7.RecyclerView.dll
/assemblies/Xamarin.Mobile.dll
/assemblies/mscorlib.dll
/classes.dex
/lib
/lib/armeabi-v7a
/lib/armeabi-v7a/libmonodroid.so
/lib/armeabi-v7a/libmonosgen-2.0.so

File in the assemblies directory will be the Mono/.Net code and can be reversed using those normal tools.

classes.dex is a normal Android Dalvik executable file (dex) which can be reversed using the usual tools (baksmali, IDA Pro, etc) - though it should just be the stub loaded to start the Mono engine.

The files includes in lib/**/*.so are native shared libraries which are compiled into an ELF ARM file. These are normally going to the the monodroid engine (libmonodroid.so) and potentially other plugins that have been used by the developer. These would require ELF ARM capable disassemblers like Hopper, IDA Pro, r2, etc.

In the specific example above, the only non-Xamarin code would be located in Sikur.dll and Sikur.Monodroid.dll.

---

decompile the apk https://ibotpeaches.github.io/Apktool/

If have a mono.dll is in xamarin.

you can decompile some .dll in c# watching the code.

---

and in iOS you can't decompilate. Android apps are compiled to a machine-independent Java bytecode, and it's relatively easy to convert that back into Java. iOS apps are compiled directly to machine code, with an aggressive optimization pass that tends to destroy a lot of the structure of the original code.

That's not to say you can't learn anything useful from a compiled iOS app, though. The class-dump tool can extract the names of Objective-C classes, properties, and methods from a compiled app, which can give you clues to how it's implemented. NibUnlocker can convert compiled Interface Builder UI files back to an editable format. Hopper can not only disassemble machine code to turn it into assembly code, but can further convert it into a more understandable pseudocode. And images, sounds and other resources are usually included unencrypted in an iOS app bundle.

You can try use this apps and watch the difference is anyone that read this answer can try. Let me know what is the difference.