reverse-skills-max: initial public release (restored, redacted, hardened)

our-skills/winui3-msix-reverse-rebuild/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: winui3-msix-reverse-rebuild
+description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
+---
+
+# WinUI 3 MSIX Reverse & Rebuild Pipeline
+
+## When to use
+Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original.
+
+## Prerequisites
+- ILSpy CLI (`ilspycmd`) installed
+- .NET 8 SDK
+- Windows SDK (makeappx.exe, signtool.exe) at `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\`
+- Target MSIX installed (to access original files in `C:\Program Files\WindowsApps\`)
+
+## Steps
+
+### 1. Locate & decompile
+```powershell
+# Find installed MSIX
+Get-AppxPackage -Name "*TargetApp*"
+
+# Decompile main DLL
+ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\<Package>\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\
+```
+
+### 2. Fix build errors
+- Set `<LangVersion>preview</LangVersion>` in .csproj
+- Add `<HintPath>` entries for all DLLs from the MSIX package
+- Fix `CS0136` duplicate variables (rename)
+- Fix `CS0104` ambiguous references (qualify with `Windows.UI.Color` not `System.Drawing.Color`)
+- Fix inline literals (e.g. `FindOrRegisterForKey("...")` → use const)
+
+### 3. Self-contained publish
+```powershell
+dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true
+```
+**Critical**: Framework-dependent build fails inside MSIX — must use `--self-contained true`.
+
+### 4. Stage MSIX payload
+- Copy publish output to staging dir
+- Overlay original `resources.pri`, `Assets/`, `Watchers/`, locale dirs, `Microsoft.UI.Xaml/`
+- Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll)
+- Write new `AppxManifest.xml` with bumped version and same Publisher CN
+
+### 5. Cert & sign
+```powershell
+# Create self-signed cert matching original Publisher CN
+$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
+
+# Add to Trusted Root and Trusted People (LocalMachine)
+# Export PFX
+# Pack with makeappx /nv
+# Sign with signtool /fd SHA256
+```
+
+### 6. Install & launch
+```powershell
+Add-AppxPackage -Path TargetAppRev.msix
+# Launch via AppsFolder (NOT Start-Process directly)
+Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
+```
+
+### 7. Verify
+- Check `Get-AppxPackage` shows new version
+- Check process path starts with Rev package InstallLocation
+- Check MainWindowTitle and RAM growing (not stuck at 17MB)
+- Use UI Automation to verify text elements inside window
+- Sample pixel colors from screenshot for design changes
+
+### 8. Cleanup (IMPORTANT)
+- Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`
+- Delete PFX file
+- Trusted root + accessible private key = arbitrary code signing capability
+
+## Gotchas
+- `RequestedTheme` not available on `Window` in WinUI 3 — use `ElementTheme` on child elements
+- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background`
+- `base.Title` changes Windows title bar but custom title bar uses `AppTitleTextBlock.Text`
+- XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original `resources.pri`
+- `NavView.SelectedItem = NavView.MenuItems[0]` must be preserved or dashboard won't load
+- PowerShell `$` variables get stripped through bash inline — use `.ps1` script files
+- `Start-Process 'shell:AppsFolder\...'` fails — use `explorer.exe` as intermediary
+- Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found)
+- Process alive at 200MB+ RAM with proper title = working