reverse-skills-max/our-skills/winui3-msix-reverse-rebuild/SKILL.md

name, description

name	description
winui3-msix-reverse-rebuild	Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder

WinUI 3 MSIX Reverse & Rebuild Pipeline

When to use

Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original.

Prerequisites

• ILSpy CLI (ilspycmd) installed
• .NET 8 SDK
• Windows SDK (makeappx.exe, signtool.exe) at C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\
• Target MSIX installed (to access original files in C:\Program Files\WindowsApps\)

Steps

1. Locate & decompile

# Find installed MSIX
Get-AppxPackage -Name "*TargetApp*"

# Decompile main DLL
ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\<Package>\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\

2. Fix build errors

• Set <LangVersion>preview</LangVersion> in .csproj
• Add <HintPath> entries for all DLLs from the MSIX package
• Fix CS0136 duplicate variables (rename)
• Fix CS0104 ambiguous references (qualify with Windows.UI.Color not System.Drawing.Color)
• Fix inline literals (e.g. FindOrRegisterForKey("...") → use const)

3. Self-contained publish

dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true

Critical: Framework-dependent build fails inside MSIX — must use --self-contained true.

4. Stage MSIX payload

• Copy publish output to staging dir
• Overlay original resources.pri, Assets/, Watchers/, locale dirs, Microsoft.UI.Xaml/
• Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll)
• Write new AppxManifest.xml with bumped version and same Publisher CN

5. Cert & sign

# Create self-signed cert matching original Publisher CN
$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")

# Add to Trusted Root and Trusted People (LocalMachine)
# Export PFX
# Pack with makeappx /nv
# Sign with signtool /fd SHA256

6. Install & launch

Add-AppxPackage -Path TargetAppRev.msix
# Launch via AppsFolder (NOT Start-Process directly)
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'

7. Verify

• Check Get-AppxPackage shows new version
• Check process path starts with Rev package InstallLocation
• Check MainWindowTitle and RAM growing (not stuck at 17MB)
• Use UI Automation to verify text elements inside window
• Sample pixel colors from screenshot for design changes

8. Cleanup (IMPORTANT)

• Remove self-signed cert from LocalMachine\Root, LocalMachine\TrustedPeople, CurrentUser\My
• Delete PFX file
• Trusted root + accessible private key = arbitrary code signing capability

Gotchas

• RequestedTheme not available on Window in WinUI 3 — use ElementTheme on child elements
• NavigationView.PaneBackground doesn't exist in WinUI 3 — use NavView.Background
• base.Title changes Windows title bar but custom title bar uses AppTitleTextBlock.Text
• XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original resources.pri
• NavView.SelectedItem = NavView.MenuItems[0] must be preserved or dashboard won't load
• PowerShell $ variables get stripped through bash inline — use .ps1 script files
• Start-Process 'shell:AppsFolder\...' fails — use explorer.exe as intermediary
• Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found)
• Process alive at 200MB+ RAM with proper title = working