87 lines
3.7 KiB
Markdown
87 lines
3.7 KiB
Markdown
---
|
|
name: winui3-msix-reverse-rebuild
|
|
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
|
|
---
|
|
|
|
# WinUI 3 MSIX Reverse & Rebuild Pipeline
|
|
|
|
## When to use
|
|
Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original.
|
|
|
|
## Prerequisites
|
|
- ILSpy CLI (`ilspycmd`) installed
|
|
- .NET 8 SDK
|
|
- Windows SDK (makeappx.exe, signtool.exe) at `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\`
|
|
- Target MSIX installed (to access original files in `C:\Program Files\WindowsApps\`)
|
|
|
|
## Steps
|
|
|
|
### 1. Locate & decompile
|
|
```powershell
|
|
# Find installed MSIX
|
|
Get-AppxPackage -Name "*TargetApp*"
|
|
|
|
# Decompile main DLL
|
|
ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\<Package>\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\
|
|
```
|
|
|
|
### 2. Fix build errors
|
|
- Set `<LangVersion>preview</LangVersion>` in .csproj
|
|
- Add `<HintPath>` entries for all DLLs from the MSIX package
|
|
- Fix `CS0136` duplicate variables (rename)
|
|
- Fix `CS0104` ambiguous references (qualify with `Windows.UI.Color` not `System.Drawing.Color`)
|
|
- Fix inline literals (e.g. `FindOrRegisterForKey("...")` → use const)
|
|
|
|
### 3. Self-contained publish
|
|
```powershell
|
|
dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true
|
|
```
|
|
**Critical**: Framework-dependent build fails inside MSIX — must use `--self-contained true`.
|
|
|
|
### 4. Stage MSIX payload
|
|
- Copy publish output to staging dir
|
|
- Overlay original `resources.pri`, `Assets/`, `Watchers/`, locale dirs, `Microsoft.UI.Xaml/`
|
|
- Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll)
|
|
- Write new `AppxManifest.xml` with bumped version and same Publisher CN
|
|
|
|
### 5. Cert & sign
|
|
```powershell
|
|
# Create self-signed cert matching original Publisher CN
|
|
$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
|
|
|
|
# Add to Trusted Root and Trusted People (LocalMachine)
|
|
# Export PFX
|
|
# Pack with makeappx /nv
|
|
# Sign with signtool /fd SHA256
|
|
```
|
|
|
|
### 6. Install & launch
|
|
```powershell
|
|
Add-AppxPackage -Path TargetAppRev.msix
|
|
# Launch via AppsFolder (NOT Start-Process directly)
|
|
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
|
|
```
|
|
|
|
### 7. Verify
|
|
- Check `Get-AppxPackage` shows new version
|
|
- Check process path starts with Rev package InstallLocation
|
|
- Check MainWindowTitle and RAM growing (not stuck at 17MB)
|
|
- Use UI Automation to verify text elements inside window
|
|
- Sample pixel colors from screenshot for design changes
|
|
|
|
### 8. Cleanup (IMPORTANT)
|
|
- Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`
|
|
- Delete PFX file
|
|
- Trusted root + accessible private key = arbitrary code signing capability
|
|
|
|
## Gotchas
|
|
- `RequestedTheme` not available on `Window` in WinUI 3 — use `ElementTheme` on child elements
|
|
- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background`
|
|
- `base.Title` changes Windows title bar but custom title bar uses `AppTitleTextBlock.Text`
|
|
- XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original `resources.pri`
|
|
- `NavView.SelectedItem = NavView.MenuItems[0]` must be preserved or dashboard won't load
|
|
- PowerShell `$` variables get stripped through bash inline — use `.ps1` script files
|
|
- `Start-Process 'shell:AppsFolder\...'` fails — use `explorer.exe` as intermediary
|
|
- Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found)
|
|
- Process alive at 200MB+ RAM with proper title = working
|