---
name: winui3-msix-reverse-rebuild
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
---

# WinUI 3 MSIX Reverse & Rebuild Pipeline

## When to use
Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original.

## Prerequisites
- ILSpy CLI (`ilspycmd`) installed
- .NET 8 SDK
- Windows SDK (makeappx.exe, signtool.exe) at `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\`
- Target MSIX installed (to access original files in `C:\Program Files\WindowsApps\`)

## Steps

### 1. Locate & decompile
```powershell
# Find installed MSIX
Get-AppxPackage -Name "*TargetApp*"

# Decompile main DLL
ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\<Package>\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\
```

### 2. Fix build errors
- Set `<LangVersion>preview</LangVersion>` in .csproj
- Add `<HintPath>` entries for all DLLs from the MSIX package
- Fix `CS0136` duplicate variables (rename)
- Fix `CS0104` ambiguous references (qualify with `Windows.UI.Color` not `System.Drawing.Color`)
- Fix inline literals (e.g. `FindOrRegisterForKey("...")` → use const)

### 3. Self-contained publish
```powershell
dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true
```
**Critical**: Framework-dependent build fails inside MSIX — must use `--self-contained true`.

### 4. Stage MSIX payload
- Copy publish output to staging dir
- Overlay original `resources.pri`, `Assets/`, `Watchers/`, locale dirs, `Microsoft.UI.Xaml/`
- Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll)
- Write new `AppxManifest.xml` with bumped version and same Publisher CN

### 5. Cert & sign
```powershell
# Create self-signed cert matching original Publisher CN
$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")

# Add to Trusted Root and Trusted People (LocalMachine)
# Export PFX
# Pack with makeappx /nv
# Sign with signtool /fd SHA256
```

### 6. Install & launch
```powershell
Add-AppxPackage -Path TargetAppRev.msix
# Launch via AppsFolder (NOT Start-Process directly)
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
```

### 7. Verify
- Check `Get-AppxPackage` shows new version
- Check process path starts with Rev package InstallLocation
- Check MainWindowTitle and RAM growing (not stuck at 17MB)
- Use UI Automation to verify text elements inside window
- Sample pixel colors from screenshot for design changes

### 8. Cleanup (IMPORTANT)
- Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`
- Delete PFX file
- Trusted root + accessible private key = arbitrary code signing capability

## Gotchas
- `RequestedTheme` not available on `Window` in WinUI 3 — use `ElementTheme` on child elements
- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background`
- `base.Title` changes Windows title bar but custom title bar uses `AppTitleTextBlock.Text`
- XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original `resources.pri`
- `NavView.SelectedItem = NavView.MenuItems[0]` must be preserved or dashboard won't load
- PowerShell `$` variables get stripped through bash inline — use `.ps1` script files
- `Start-Process 'shell:AppsFolder\...'` fails — use `explorer.exe` as intermediary
- Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found)
- Process alive at 200MB+ RAM with proper title = working