Protecting .NET MAUI & Xamarin apps

.NET MAUI (and legacy Xamarin) apps ship your logic as managed .NET assemblies on every platform head — Android, iOS, Windows and Mac Catalyst. Nebula protects them the same way it protects any managed assembly: it works at the IL level, so a MAUI app assembly obfuscates, virtualizes and hardens exactly like a WPF or console app — you just keep the members your XAML binds to intact.

What to protect, and what to keep

MAUI uses XAML data binding, which resolves member names as strings at runtime. So the rule mirrors WPF:

• Keep bound members named. Pages, view-models, their public bound properties and commands, value converters, and any type referenced by name in XAML must retain their names. preservePublicApi: true covers the usual case (bound members are public); Nebula also auto-detects most binding patterns. For anything bound but not public, add it to your preserve list.
• Obfuscate the internals. Your business logic, algorithms, pricing rules, licence checks and helper methods have no XAML dependency — rename them, flatten their control flow, encrypt their strings, and (Enterprise) virtualize the sensitive ones.
• [DllImport] / platform-service names are preserved automatically.

{
  "preservePublicApi": true,
  "controlFlowObfuscation": true,
  "encryptStrings": true,
  "virtualizeMethods": true,
  "virtualizeInclude": [ "MyApp.Licensing.LicenseCheck.Validate" ]
}

Where it fits in the build

Obfuscate the managed assemblies after the normal build, before packaging/AOT:

• Android / Windows / Mac Catalyst: obfuscate the built app assembly, then package as usual.
• iOS: iOS uses AOT, and the linker/AOT run over your assemblies — obfuscate the managed IL before the AOT/publish step, and make sure everything reflection- or XAML-referenced is preserved so the linker keeps it.

Because Nebula transforms compiled output and needs no source or project changes, it drops into a MAUI CI pipeline like any other post-build step (see MSBuild & CI).

Cross-platform runtime

Enterprise code virtualization ships a small Nebula.Runtime alongside the app; it targets .NET Standard 2.0, so it loads on every MAUI head (Android, iOS, Windows, Mac Catalyst).

Verified

We build a MAUI app, compile its Windows head, and obfuscate the resulting app assembly with the full Enterprise pipeline — renaming, aggressive control-flow, string encryption, constant masking and virtualization. The result is verified structurally valid, with the XAML-bound view-model and its bound properties preserved while the internal compute logic is virtualized; and the same view-model pattern, obfuscated identically and executed, returns byte-identical results (bound property included).

Note: a running MAUI app is inherently reachable on the device, and iOS AOT/linker interactions vary by project. Obfuscation raises the cost of reverse-engineering your MAUI code substantially; as always, genuinely secret logic and secrets belong on a server. Test your specific heads (especially iOS) after enabling protection.