108 lines
4.5 KiB
Markdown
108 lines
4.5 KiB
Markdown
---
|
|
name: winui3-msix-reverse
|
|
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages"
|
|
---
|
|
|
|
# Reverse Engineering WinUI 3 MSIX Apps
|
|
|
|
## Prerequisites
|
|
- ILSpy CLI (`ilspycmd`) installed via dotnet tool
|
|
- Windows SDK (makeappx.exe, signtool.exe)
|
|
- .NET 8 SDK
|
|
- Target MSIX installed (locate via `Get-AppxPackage`)
|
|
|
|
## Step 1: Decompile
|
|
```bash
|
|
ilspycmd -p --decompile-baml "C:\Path\To\Target.dll" -o "C:\Output\src"
|
|
```
|
|
- Produces C# files from .NET assembly
|
|
- `--decompile-baml` attempts XAML but XBF v2+ may not decompile
|
|
- Fix CS errors (duplicate variables, ambiguous references, missing `using`)
|
|
|
|
## Step 2: Build
|
|
```bash
|
|
dotnet publish Project.csproj -c Release -r win-x64 --self-contained true
|
|
```
|
|
- **Must use `--self-contained true`** — original MSIX bundles .NET runtime, FDD will fail with "No frameworks were found"
|
|
- Original `runtimeconfig.json` uses `includedFrameworks`, rebuilt uses `framework` — self-contained fixes this
|
|
|
|
## Step 3: Overlay Original Assets
|
|
Copy from original MSIX install dir to publish output:
|
|
- `resources.pri` (XBF, strings, images)
|
|
- `Assets/` folder
|
|
- `Watchers/` folder (backend executables)
|
|
- Locale dirs (`xx-YY/` pattern)
|
|
- `Microsoft.UI.Xaml/` folder
|
|
- Native WinUI DLLs (CoreMessagingXP.dll, dcompi.dll, etc.)
|
|
- **Never overwrite rebuilt VibeProxy.exe/dll**
|
|
|
|
## Step 4: Create AppxManifest.xml
|
|
- New `Identity` Name (e.g. `AtC.VibeProxyRev`)
|
|
- Same Publisher CN as original
|
|
- Bump Version (e.g. `3.7.2.8`)
|
|
- Same `EntryPoint="Windows.FullTrustApplication"`
|
|
- `rescap:Capability Name="runFullTrust"`
|
|
|
|
## Step 5: Register — Two Options
|
|
|
|
### Option A: Loose Register (no admin, no signing) — PREFERRED
|
|
```powershell
|
|
# Enable dev mode
|
|
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name "AllowDevelopmentWithoutDevLicense" -Value 1
|
|
# Register from staging dir
|
|
Add-AppxPackage -Register "C:\Staging\AppxManifest.xml"
|
|
```
|
|
- No cert needed, no admin for cert stores
|
|
- Package runs from staging dir, not WindowsApps
|
|
- Works when `AllowAllTrustedApps=1` + `AllowDevelopmentWithoutDevLicense=1`
|
|
|
|
### Option B: Signed MSIX (requires admin for cert stores)
|
|
```powershell
|
|
# Create self-signed cert
|
|
$cert = New-SelfSignedCertificate -Subject "CN=..." -CertStoreLocation "Cert:\CurrentUser\My" ...
|
|
# MUST add to LocalMachine\Root and LocalMachine\TrustedPeople (requires admin)
|
|
# CurrentUser\Root is NOT trusted for MSIX — returns 0x800B0109
|
|
# Pack
|
|
makeappx pack /d Staging /p Output.msix /nv
|
|
# Sign
|
|
signtool sign /fd SHA256 /a /f cert.pfx /p password Output.msix
|
|
# Install
|
|
Add-AppxPackage -Path Output.msix
|
|
# CLEANUP: Remove cert from all stores + delete PFX after install
|
|
```
|
|
|
|
## Step 6: Launch
|
|
```powershell
|
|
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App'
|
|
```
|
|
- Wait ≥8 seconds before checking process
|
|
- Verify: PID path starts with Rev package, not original
|
|
- Check `MainWindowTitle` is non-empty
|
|
- RAM > 150MB indicates UI rendered
|
|
|
|
## Step 7: Verify Changes
|
|
- UI Automation: `[System.Windows.Automation.AutomationElement]::FromHandle($proc.MainWindowHandle)`
|
|
- Find Text elements by name to confirm UI changes visible
|
|
- Screenshot + pixel sampling for visual proof
|
|
|
|
## Step 8: Add Custom Functions
|
|
- Create new `Page` subclass in `VibeProxy.Views/`
|
|
- Add routing in `NavigateToTag`: `"CustomPage" => typeof(CustomPage)`
|
|
- Add `NavigationViewItem` programmatically in constructor:
|
|
```csharp
|
|
var navItem = new NavigationViewItem { Content = "Custom", Tag = "CustomPage", Icon = new FontIcon { Glyph = "\uE9D9;" } };
|
|
NavView.MenuItems.Add(navItem);
|
|
```
|
|
- Verify via UI Automation: find ListItem with name matching Content
|
|
|
|
## Critical Lessons
|
|
- **PowerShell `$_` gets stripped through bash inline** — always use `.ps1` script files
|
|
- **`CurrentUser\Root` cert store is NOT trusted for MSIX** — must use `LocalMachine` (admin) or loose register
|
|
- **XBF v2.1 XAML not decompilable** — use original `resources.pri`, modify UI programmatically in C#
|
|
- **`NavView.PaneBackground` doesn't exist in WinUI 3** — use `NavView.Background` instead
|
|
- **`Window.RequestedTheme` not available** — set theme on child elements
|
|
- **`Color` is ambiguous** — qualify as `Windows.UI.Color.FromArgb(...)`
|
|
- **Self-contained publish is mandatory** — FDD fails in MSIX without framework discovery
|
|
- **`makeappx pack` on 1200+ files takes ~70 seconds** — use async/background
|
|
- **`Add-AppxPackage` on 300MB MSIX takes minutes** — use loose register instead
|