If you've recently googled "how to decompile a xamarin app" or something similar, you will have noticed that most tools and tutorials are aimed at doing this on a Windows machine -- dnSpy is built for Windows, same goes for dotPeek, and this video tutorial starts on a Mac, but goes on to use a Windows virtual machine to decompile the C# assemblies using ILSpy.
This article has the simple goal of fixing this and showing anyone who googles it how to actually decompile Xamarin apps without a Windows machine.
Before starting though, the first thing to know about Xamarin is that since it is a .NET based SDK the language most of the code will have been written on is C#. So our focus will be on retrieving, decompressing and decompiling that code.
Retrieving the Compiled C# Assemblies
Retrieving the compiled assemblies is as easy as unzipping the apk. You can do this either by renaming the .apk file to .zip and then double clicking on the file, or you can run unzip path_to_app.apk -d destination_folder in the Terminal.
After you do this you will find a folder called "assemblies" inside the unzipped files:
XALZ Decompression
After retrieving the assemblies folder it is necessary to check if any of the .dll files inside are XALZ compressed because if they are it will be necessary to decompress them before being able to decompile them.
You can confirm if they are compressed by simply typing xxd path_to_file.dll | head -1 in order to get the first line of the file's hexdump. If the result starts with XALZ then it needs to be decompressed.
If one of them is compressed as confirmed above then it's likely all of them are, either way the decompression script also checks this when running.
Decompression Script
Clone or copy the contents of Xamarin_XALZ_decompress.py into your preferred location and run it on all the .dll files in the assemblies folder with a command such as the following:
for assem in assemblies/*.dll; do python3 ~/android-tools/Xamarin_XALZ_decompress.py $assem $assem; done
After the script is done the files should be decompressed and starting with MZ when checking the hexdump.
Decompiling the Assemblies
For the final step we will use AvaloniaILSpy, a cross platform version of ILSpy, the open source .NET assembly browser and decompiler.
Follow the steps:
- Download the latest release from releases
- Copy ILSpy.app to your Applications folder
- If you're having trouble launching the application you might not be on a final release and likely need to follow the steps in Issue #63
- Launch the app, open all the assemblies, select all of them, right click and "Save Code..."
Voilà, once its done the decompiled code will be available in whatever folder was selected for the decompilation.