[File] magdir submission: Xamarin LZ4-compressed assemblies

Gaelan Steele gbs at canishe.com
Mon Aug 14 06:04:07 UTC 2023


Hello,

Xamarin, a framework for writing Android (and iOS, but the format in question isn’t used there) apps using Microsoft’s .NET languages, stores bytecode in .dll files containing LZ4-compressed data and a custom header. The format is documented in a GitHub pull request[1]. This header begins with the magic number “XALZ” at position 0. A rule like this one will match it:

0 string XALZ Xamarin LZ4-compressed assembly

Not submitting this as a proper patch because there are a few points I’m not sure about:

* Without this rule, these files are matched as “PlayStation Audio” due to the “XA” prefix; passing the above rule with -m seems to get the right rule, but I’m not sure if that’s reliable or just luck. Do I need some sort of strength line? (Ideally we’d improve the matching for PlayStation audio, but I don’t have any of those files around to test on.)

* Not quite sure where this rule should go; I suppose the closest match is “android”, but (a) this isn’t actually part of the Android platform, and (b) it seems possible that this format is reused for Xamarin iOS later. 

Best wishes,
Gaelan Steele

[1]: https://github.com/xamarin/xamarin-android/pull/4686


More information about the File mailing list