[GH-ISSUE #3694] [Feature] .NET MAUI/Xamarin reverse engineering: XAML, managed assemblies, native bindings, resources and cross-platform app graph reconstruction #1407

New issue

Open

opened 2026-10-16 21:05:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:10 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3694

Problem Statement & Context

.NET MAUI (Multi-platform App UI) and its predecessor Xamarin are Microsoft's flagship frameworks for building cross-platform applications targeting Android, iOS, macOS, and Windows from a single managed C# codebase.

While REA has individual tools for inspecting generic PE/.NET CIL assemblies and mobile APK/IPA archives, it cannot holistically reverse engineer a .NET MAUI application as an integrated application architecture. MAUI/Xamarin applications employ a layered architecture:

Compiled XAML (XamlC) & Resource Dictionaries: UI layouts compiled into CIL bytecode via XamlC or embedded as binary XAML resources (.xaml).
Platform Heads & Shell Navigation: Unified routing via Shell, NavigationPage, and MVVM/MVI bindings.
Managed-to-Native Interop:
- Android: JNI bridges generated by Xamarin.Android (Android.Runtime.JNIEnv), embedding managed DLLs within assemblies blobs (assemblies.blob, assemblies.manifest, or compressed LZ4 assemblies).
- iOS: Ahead-of-Time (AOT) compiled native Mach-O binaries paired with Objective-C selectors and Mono runtime initialization.
Dependency Injection & Handler Architecture: MAUI's Handler pattern mapping abstract cross-platform controls (Button, Entry) to native platform handlers (UIButton, AppCompatButton).
Packaged Assets & Configuration: MauiProgram.cs builder configuration, font assets, and app permissions.

A dedicated .NET MAUI/Xamarin engine is needed to extract bundled assemblies, decompile compiled XAML layouts, and reconstruct the cross-platform application graph.

Proposed Architecture

flowchart TD
    A[".NET MAUI / Xamarin App (APK, IPA, Windows EXE/MSIX)"] --> B[".NET MAUI Semantic Reconstruction Engine"]
    B --> C["Assembly Bundle Unpacker & LZ4 Decompressor"]
    B --> D["XAML & View-Model Decompiler"]
    B --> E["Managed-to-Native Interop Mapper"]
    
    C --> C1["assemblies.blob / assemblies.manifest Extraction"]
    C --> C2["LZ4 Header Decoding (Header XALZ / Compressed DLLs)"]
    C --> C3["Managed Assemblies (CIL DLLs)"]
    
    D --> D1["Compiled XAML (XamlC) Decompilation"]
    D --> D2["Shell Navigation Routes & Page Graph"]
    D --> D3["Data Binding & MVVM Command Resolution"]
    
    E --> E1["Android JNI Wrappers & Activity Handlers"]
    E --> E2["iOS Objective-C Selectors & AOT Bindings"]
    E --> E3["P/Invoke & Platform Service Dependencies"]
    
    C & D & E --> F["Synthesized Cross-Platform MAUI App Architecture Graph"]

Technical Capabilities & Modules

Assembly Extraction & Bundle Unpacking:
- Detect and unpack Xamarin/MAUI Android bundles:
  - Unpack assemblies.blob and parse assemblies.manifest.
  - Decompress LZ4-compressed assemblies (XALZ magic header).
- Extract managed assemblies from iOS app bundles (Frameworks/Mono.framework or AOT metadata) and Windows MSIX packages.
Compiled XAML (XamlC) & UI Decompilation:
- Parse embedded .xaml XML resources.
- Decompile CIL methods generated by the XamlC compiler into clean, declarative XAML markup.
- Resolve StaticResource, DynamicResource, and AppThemeBinding references.
Navigation & Application Routing Reconstruction:
- Analyze AppShell.xaml / AppShell.cs routing tables and Routing.RegisterRoute registrations.
- Build a state transition diagram of pages, flyouts, tabs, and navigation parameters.
Data Binding & ViewModel Correlation:
- Correlate XAML {Binding ...} expressions with ViewModel properties and ICommand handlers.
- Trace dependency injection container registrations configured in MauiProgram.CreateMauiApp().
Platform Interop & Permissions Audit:
- Map platform-specific invocations (Platform.CurrentActivity, Essentials APIs like Geolocation, Camera, SecureStorage).
- Cross-reference permissions requested in AndroidManifest.xml / Info.plist with actual managed API call sites.

Acceptance Criteria

Automated detection and unpacking of .NET MAUI and Xamarin applications across Android, iOS, and Windows.
Successful extraction of assemblies from compressed assemblies.blob and XALZ packages.
Decompilation of compiled XAML (XamlC) back into readable, structured XAML UI markup.
Mapping of Shell navigation routes and ViewModel data bindings.
Generation of an end-to-end architecture diagram showing pages, view models, and native interop calls.

Complements #3636 (Windows XAML UI reconstruction: WPF BAML, UWP/WinUI XBF)
Complements #3607 (Comprehensive Unity extraction and reverse engineering: Mono CIL)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3694 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context .NET MAUI (Multi-platform App UI) and its predecessor Xamarin are Microsoft's flagship frameworks for building cross-platform applications targeting Android, iOS, macOS, and Windows from a single managed C# codebase. While REA has individual tools for inspecting generic PE/.NET CIL assemblies and mobile APK/IPA archives, it cannot holistically reverse engineer a .NET MAUI application as an integrated application architecture. MAUI/Xamarin applications employ a layered architecture: 1. **Compiled XAML (`XamlC`) & Resource Dictionaries**: UI layouts compiled into CIL bytecode via XamlC or embedded as binary XAML resources (`.xaml`). 2. **Platform Heads & Shell Navigation**: Unified routing via `Shell`, `NavigationPage`, and MVVM/MVI bindings. 3. **Managed-to-Native Interop**: - Android: JNI bridges generated by Xamarin.Android (`Android.Runtime.JNIEnv`), embedding managed DLLs within assemblies blobs (`assemblies.blob`, `assemblies.manifest`, or compressed LZ4 assemblies). - iOS: Ahead-of-Time (AOT) compiled native Mach-O binaries paired with Objective-C selectors and Mono runtime initialization. 4. **Dependency Injection & Handler Architecture**: MAUI's Handler pattern mapping abstract cross-platform controls (`Button`, `Entry`) to native platform handlers (`UIButton`, `AppCompatButton`). 5. **Packaged Assets & Configuration**: `MauiProgram.cs` builder configuration, font assets, and app permissions. A dedicated .NET MAUI/Xamarin engine is needed to extract bundled assemblies, decompile compiled XAML layouts, and reconstruct the cross-platform application graph. ### Proposed Architecture ```mermaid flowchart TD A[".NET MAUI / Xamarin App (APK, IPA, Windows EXE/MSIX)"] --> B[".NET MAUI Semantic Reconstruction Engine"] B --> C["Assembly Bundle Unpacker & LZ4 Decompressor"] B --> D["XAML & View-Model Decompiler"] B --> E["Managed-to-Native Interop Mapper"] C --> C1["assemblies.blob / assemblies.manifest Extraction"] C --> C2["LZ4 Header Decoding (Header XALZ / Compressed DLLs)"] C --> C3["Managed Assemblies (CIL DLLs)"] D --> D1["Compiled XAML (XamlC) Decompilation"] D --> D2["Shell Navigation Routes & Page Graph"] D --> D3["Data Binding & MVVM Command Resolution"] E --> E1["Android JNI Wrappers & Activity Handlers"] E --> E2["iOS Objective-C Selectors & AOT Bindings"] E --> E3["P/Invoke & Platform Service Dependencies"] C & D & E --> F["Synthesized Cross-Platform MAUI App Architecture Graph"] ``` ### Technical Capabilities & Modules 1. **Assembly Extraction & Bundle Unpacking:** - Detect and unpack Xamarin/MAUI Android bundles: - Unpack `assemblies.blob` and parse `assemblies.manifest`. - Decompress LZ4-compressed assemblies (`XALZ` magic header). - Extract managed assemblies from iOS app bundles (`Frameworks/Mono.framework` or AOT metadata) and Windows MSIX packages. 2. **Compiled XAML (`XamlC`) & UI Decompilation:** - Parse embedded `.xaml` XML resources. - Decompile CIL methods generated by the `XamlC` compiler into clean, declarative XAML markup. - Resolve `StaticResource`, `DynamicResource`, and `AppThemeBinding` references. 3. **Navigation & Application Routing Reconstruction:** - Analyze `AppShell.xaml` / `AppShell.cs` routing tables and `Routing.RegisterRoute` registrations. - Build a state transition diagram of pages, flyouts, tabs, and navigation parameters. 4. **Data Binding & ViewModel Correlation:** - Correlate XAML `{Binding ...}` expressions with ViewModel properties and `ICommand` handlers. - Trace dependency injection container registrations configured in `MauiProgram.CreateMauiApp()`. 5. **Platform Interop & Permissions Audit:** - Map platform-specific invocations (`Platform.CurrentActivity`, `Essentials` APIs like Geolocation, Camera, SecureStorage). - Cross-reference permissions requested in `AndroidManifest.xml` / `Info.plist` with actual managed API call sites. ### Acceptance Criteria - [ ] Automated detection and unpacking of .NET MAUI and Xamarin applications across Android, iOS, and Windows. - [ ] Successful extraction of assemblies from compressed `assemblies.blob` and `XALZ` packages. - [ ] Decompilation of compiled XAML (XamlC) back into readable, structured XAML UI markup. - [ ] Mapping of Shell navigation routes and ViewModel data bindings. - [ ] Generation of an end-to-end architecture diagram showing pages, view models, and native interop calls. ### Related Issues & Dependencies - Complements #3636 (Windows XAML UI reconstruction: WPF BAML, UWP/WinUI XBF) - Complements #3607 (Comprehensive Unity extraction and reverse engineering: Mono CIL)

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:11:09 +00:00

[PR #1407] [MERGED] fix(javascript)!: stop copying literals into semantic metadata #2863

bsakaguchi referenced this issue

2026-10-17 21:11:09 +00:00

[PR #1408] [MERGED] fix(javascript): retain shorter literal metadata encodings #2864