Reverse Engineering WIndows Phone 8 Apps - Security Discussion

Hi all,
I am developing an app for Windows Phone 8 and am currently in the process of testing for which i need details about reverse engineering.
After searching on the net for a few days i have gained a bit of knowledge about the process but not full understanding.
From what i have read, I first installed an app called Windows Phone App analyser which unzips xap files and decompiles dll. Now this works for xaps packaged by me or home brewn xaps. But if I try it on xaps after downloading it from Windows Marketplace, then it does not work.
After spending time on this, I realised that once developers submit their apps in the Store, the store encrypts it, thus the xap directly downloaded from marketplace cant be reverse engineered which is fair enough. So the other workaround I understood was to first install the app in the device(Windows 8 phone) itself and then somehow convert it to Xap, transfer xap to my testing device or pc and try on it.
Now here first I would like to hear from you all that is my understanding till this moment right or flawed. And the following questions.
1) There is a tools or app I should say I found to repackage apps installed in windows Phone 8 into xaps. It is Product Manager. But from where I found it I got the xap file for it. Now how do I install the xap into the phone. I tried using the Windows Phone Application Deployment Tool but was not able to do it. So how exactly do I install it on the phone and also how to use it??
2) Now when I get it up and running and also get an app packaged to a xap using the tool, then how do I transfer the xap to my pc??
3) After I transfer the xap to my pc, is it a actually possible to reverse engineer it( I ASK THIS AS I AM ASSUMING THAT THE DEVICE ON INSTALLING THE APP DECRYPTS THE ENCRYPTED XAP (WHICH COULD NOT BE REVERSE ENGINEERED) AND SO WHEN WE REPACKAGE THE XAP IT IS IN DECRYPTED FORM ONLY. SO IT MAY BE POSSIBLE TO REVERSE ENGINEER IT USING THE PHONE APP ANALYSER I MENTIONED ABOVE), or is it not possible to reverse engineer the repackaged xap??
4) If its not possible, then is there any other way to reverse engineer Windows Phone 8 apps(If yes, please explain the whole procedure in detail).
Thanks in advance.

Bumb.
I'm also interested when it comes to the aspect of reverse engineering a XAP/APPX from the store, especially as a dev.

Related

[Q] Integrate WM Device Center

Hi everyone, Is it possible to integrate the WM Device Center directly in the OS? I don't wanna have to open this app every time I connect my phone to the pc..I'm lazy, I know
gigsaw said:
I'm lazy, I know
Click to expand...
Click to collapse
Seems like you are lazy more than you've expected. You don't even read forum title - it's WP7, not WM forum
I'm not even sure what app or what OS you're referring to - do you mean ToucnXpereince on WP7? That's *supposed* to open automatically when you start WPDM on the PC.
Windows Mobile Device Center is a "big" Windows (desktop/laptop) app, not a phone app... are you saying you want it to launch on the PC when you connect your phone?
Sorry guys, I haven't been clear enough I meant the Windows Mobile Device Center LAUNCHER look at this tread: http://forum.xda-developers.com/showthread.php?t=1521763
It's an app that has to be launched on a fully unlocked phone every time you connect it to the computer. In this way your device can be explored as a sort of plug&play usb mass storage. You can directly copy on it doc files, or anything else you want. Even xap files on my HD7 with deepshining, if I install a File Browser too, I'm able to install XAPs directly from my phone without any other software installed on my pc or on my phone. I think it's a great thing, even for doc files because before of this program the only method to transfer them from PC to the phone ad vice versa was to send'em to myself via mail, or use skydrive. Not much convenient for me. This new method simplyfied my life
So my question was: can this XAP be directly integrated in Windows Phone 7 so when I connect my device to the computer I don't have to open every time this app on my phone?
Now *that* is actually an interesting question. It's certainly possible to have a PC app start a phone app; that's how WPDM launches TouchXperience or Visual Studio launches a debug app. To launch fully automaticlaly, though... that would probably require that the app either have some background service (possible on a fully-unlocked ROM) that monitors for a PC connection, or that the app be registered in some way as "do this when you connect" although I'm not sure how I'd go about the latter.
Yeah, now it's much clear and as GoodDayToDie said is much more interesting I'm already thought about implementation (but I need to run WPConnect.exe automatically, not a Windows Mobile Device Center LAUNCHER). I'll try to find time for the development of this app (this one - finding time - is really hard ), so stay tuned!
Here we are: http://forum.xda-developers.com/showthread.php?p=24820620
Hey, gigsaw, did you tried WP7 auto launcher? I don't have full unlock so I can't test with WMDC Launcher.
So sorry if it seems that I disappeared but someone stole my HD7 some days ago D: D: D: D: I'm so sad........I was very interested in windows phone 7, I thought it could be the best mobile OS with a bit of developing..but now I can't do anything more. So sorry guys ='(

[Q] Custom ROM?

Is there a FULL unlock for WP7 2nd gen devices? I just got the Focus S and LOVE IT! But I kind of miss some of the freedom of android. I used WindowsBreak to interop unlock it, but I want to install a custom ROM on it so I can have access to DH Marketplace and such... If anyone has any info that'd be great
Many, although not all, of the benefits of full-unlock are already available by using WP7 Root Tools. For example, I can use DS Marketplace, Bazaar, install XAP files from IE or email, and access the full filesystem and registry.
Yeah but most apps from alternative markets usually don't work because they require a higher level of privileges. So for total control like themes and such you'd need a full unlock right?
Nope! After you install the app that needs elevated permissions, go into root tools, swipe to the long list of apps, and push the slider next to the app you want to give rights to. If you don't already have root tools/bazaar, download them to your PC (xap files, that is) and use the package deployment tool to get them on your device.
You can find that easily by hitting start and typing deployment in the windows start menu.
I don't think you understand what I'm talking about, I'm referring to things such as opera mobile and the likes. Those need an unlocked ROM
Opera wasn't mentioned specifically. Every app I've tried off of bazaar has worked so far on my quantum. Sorry I couldn't be of more help!
So far as I know, Opera and BT File Transfer are the only homebrew apps published for WP7 right now that need more unlock than WP7 Root Tools can provide.

Save WhatsApp Conversation

Hello!
I have a question regarding WhatsApp. Is there a possibility to save WhatsApp conversations/history? Through any homebrew-App?
I searched through Google and XDA, didn't find anything useful, unfortunately.
Thanks in advance.
Greetings,
Crash1k
You need to copy out the Isolated Storage for the app. There are a few tools that can do this, including any filesystem browser (such as WP7 Root Tools). An easy way to get the file(s) from your phone to the PC would be my Root Webserver app; find the App GUID of WhatsApp and go to http://<PHONE_IP>/FileSystem/Applications/Data/<APP_GUID>/Data on the PC while the phone runs the webserver app.
Thanks for your fast answer.
Since I'm pretty new to this homebrew-and-phoneHacking thing I don't have much of a clue how to work with those programs. I have downloaded "HtcRootWebServer_231.zip" and the ".xap" file, but I don't know how to get started. Are there any instructions online, perhaps on your homepage, if you have one?
Thanks again.
Oh boy... okay, I assumed you'd already be familiar with dev-unlock at least, so this is going to be a bit complicated. First of all, what phone do you have? On some phones, you won't even be able to run the app because of restrictions that we don't know how to get past.
The summary:
To install an app to the phone from a XAP file, your phone needs to be developer-unlocked. There are a few ways to do this, including an official one from Microsoft (though that costs money unless you're a student). To deploy the apps, you'll probably want to download the Windows Phone SDK from Microsoft as it has all the tools.
To use high-privilege apps, you'll need your phone to be "interop-unlocked" which you can read about on XDA-Devs. Not all phones can currently be interop-unlocked, though many can.
Once your phone is IUed, install the webserver and also WP7 Root Tools v0.9. Use the Root Tools to mark the Webserver app as "Trusted"; this will give it the permissions it needs (it has its own permission elevation code, but I'm almost sure your phone isn't compatible).
if your phone is unlocked:
install wmdc by ultrashot, then, connect it to wmdc, then browse <YOUR WP NAME>\\Applications\Data\218A0EBB-1585-4C7E-A9EC-054CF4569A79 then copy everything from it
GoodDayToDie said:
Oh boy... okay, I assumed you'd already be familiar with dev-unlock at least, so this is going to be a bit complicated. First of all, what phone do you have? On some phones, you won't even be able to run the app because of restrictions that we don't know how to get past.
The summary:
To install an app to the phone from a XAP file, your phone needs to be developer-unlocked. There are a few ways to do this, including an official one from Microsoft (though that costs money unless you're a student). To deploy the apps, you'll probably want to download the Windows Phone SDK from Microsoft as it has all the tools.
To use high-privilege apps, you'll need your phone to be "interop-unlocked" which you can read about on XDA-Devs. Not all phones can currently be interop-unlocked, though many can.
Once your phone is IUed, install the webserver and also WP7 Root Tools v0.9. Use the Root Tools to mark the Webserver app as "Trusted"; this will give it the permissions it needs (it has its own permission elevation code, but I'm almost sure your phone isn't compatible).
Click to expand...
Click to collapse
Thanks a lot for your help, and I'm sorry you had to write this much. I already know how to deploy .xap's and these things, but I have no clue when it comes to the Webserver and how to find the conversations with that. I'll try this for now. I appreciate your help and effort.
aramadsanar said:
if your phone is unlocked:
install wmdc by ultrashot, then, connect it to wmdc, then browse <YOUR WP NAME>\\Applications\Data\218A0EBB-1585-4C7E-A9EC-054CF4569A79 then copy everything from it
Click to expand...
Click to collapse
Is this the same method as the one GoodDayToDie explained?
Thanks for your answer!
//Edit:
I tried it like you, GoodDayToDie, told me. I downloaded your HtcRootWebServer_231.xap and HtcRootWebServer_231.zip. (even though I have a Samsung Omnia 7 with windowbreak unlock (I think that's interop unlock, don't know for sure though)). Then I deployed the .xap, opened the App in the phone but didn't know what to do with the numbers and text fields (like what kind of Admin name and password I should fill in...). After I gave up on the phone-part, I tried to work with the .zip file, but I don't know what to do next. There are 2 folders, one is called "Homebrew" the other "WebServer", I tried to open the programs which are placed in the subfolders (I opened both with Microsoft Visual Studio Solution) but I only get an error and it won't show anything.
Do you know where the problem is? (aside from my lack of knowledge of course :/ )
Thanks for your help.
Crash1k said:
Thanks a lot for your help, and I'm sorry you had to write this much. I already know how to deploy .xap's and these things, but I have no clue when it comes to the Webserver and how to find the conversations with that. I'll try this for now. I appreciate your help and effort.
Is this the same method as the one GoodDayToDie explained?
Thanks for your answer!
//Edit:
I tried it like you, GoodDayToDie, told me. I downloaded your HtcRootWebServer_231.xap and HtcRootWebServer_231.zip. (even though I have a Samsung Omnia 7 with windowbreak unlock (I think that's interop unlock, don't know for sure though)). Then I deployed the .xap, opened the App in the phone but didn't know what to do with the numbers and text fields (like what kind of Admin name and password I should fill in...). After I gave up on the phone-part, I tried to work with the .zip file, but I don't know what to do next. There are 2 folders, one is called "Homebrew" the other "WebServer", I tried to open the programs which are placed in the subfolders (I opened both with Microsoft Visual Studio Solution) but I only get an error and it won't show anything.
Do you know where the problem is? (aside from my lack of knowledge of course :/ )
Thanks for your help.
Click to expand...
Click to collapse
yes, it goes to one objective, but in a simpler method
Eh, WebServer doesn't require installing anything on the PC, WPDM doesn't (directly) require installing anything on the phone. In both cases, you'll need to have WP7 Root Tools installed.
For WPDM + TouchXperience:
Install Windows Phone Device Manager from TouchXperience.com.
Start Zune and connect your phone.
Start WPDM and wait for it to install the TouchXperience app on the phone.
Open WP7 Root Tools v0.9 and go to the Policy pivot.
Mark TouchXperience as "Trusted" and exit Root Tools.
Open TouchXperience (and WPDM on the PC, if you closed it) and connect them.
Either do what @aramadsanar suggested, or use the Installed Apps feature of WPDM to make a backup.
For Root Webserver:
Install Root Webserver (the XAP; the ZIP file is the source code); you already did this.
Open WP7 Root Tools v0.9 and go to the Policy pivot.
Mark "Webserver (HtcRoot)" as Trusted and close Root Tools.
Connect the phone to WiFi (on the same network as your PC) and launch the webserver app.
Set a username and password you can remember ("admin" and "root" for example, though that's insecure).
On the PC, open a web browser and go to the phone's IP address, then drill down into the FileSystem like I said (aramadsanar gave you the app's GUID).
Download the files from the Isolated Storage to your PC, and save them somewhere.
Thanks a LOT for those great instructions, GoodDayToDie! That's really nice, thanks for your effort.
I tried the WebServer method since I didn't want to install Windows Phone SDK 7.1, but I didn't manage to get into my phone through the browser (by typing the I.P. of the phone, which is listed on the Webserver App, just as you said), that's why I was forced to use the other way. Well, who cares, it worked! I have my messages file, but the next problem shows up. I can open the file with the Editor, but it shows weird symbols and you can't read the messages actually. I tried many other programs but none work. Do you guys know how to open those files? The ending is ".sdf". I google'd it for nearly two hours, couldn't find anything useful.
Thanks for the help so far.
You used the WiFi address of the phone, right? The WWAN (cellular) connection is almost certainly firewalled. For example, on my home network the router usually gives my phone IP address 192.168.0.73 on WiFi, so I type in "http://192.168.0.73" into the browser on my PC. It'll ask for username and password; give it what you put on the phone.
As for the file contents, I can't help there. They might be encrypted, in which case the crypto key is somewhere but might be hard to find. Or they might be compressed, in which case you need to find a decoder for that compression. Either one would produce files that appear to be meaningless binary to a casual glance.
One thing you could try for the compressed file possibility is tell 7-Zip to open the file. It's usually very good at recognizing compressed formats. If it's encrypted, you'll probably need to decompile WhatsApp to figure out how. If WhatsApp is obfuscated, you're going to be in a tough spot.
By the way, I assume you downloaded the messages file directly, rather than using the data backup function of WPDM, right?
Hmm... what do you need these files for? If it's just for backup, what you have is *probably* sufficient, so long as you grabbed *all* the files from the IsolatedStorage.
Yeah, I used the WiFi address which is listed on the WebServer App, and I typed that IP Address just like you said into my browser, with "http://" etc., but it still didn't work. It doesn't even ask me for any password or username.
I don't think they are compressed, because I already tried to open/extract them with 7zip, all I got was an error because of the incompatibility. The other thing is, that when I open the files with the "Editor", I can see my messages there, but there are many many other symbols there, which makes it impossible to read the messages. They are too wide spread and you can't tell which messages belong together etc.
Even though I have no idea how to "decompile" WhatsApp, I won't ask you to tell me, since it sounds pretty complicated. I hope there is another way to solve this problem.
Yes, I simply saved the file on my Desktop, didn't use the BackUp function.
That's right, they're "just" for backup, and I didn't grab just the IsolatedStorage folder, I took the whole "Data" folder, just like aramadsanar told me to.
Thanks again for your fast and detailed answer.
If the wifi address didn't work, either your phone was not on WiFi (did the address start with 169.254.?) or your PC was not on WiFi or even connected to the same WiFi network. You can (in theory; I've never tried) also connect to the phone over wired Ethernet by plugging in the phone to the PC with its USB cable, and running Zune on the PC. That will add an ethernet entry to the phone IP list, but I don't know if it can be used for server ports from the PC.
There are a number of free apps for decompiling managed (.NET) code. The latest version of .NET RAIN, distributed right here on XDA-Devs, can do it, for example. Decompiling turns the intermediate-language binary code in a managed DLL or EXE file into C# or VB.NET or whatever. It's not a perfect reversal; the decompiler has to guess what the original source code looked like, and of course comments are missing. It's good enough to read pretty easily, though.
It sounds like what you have is probably a database file of some kind. There are only a few database formats available for WP7 apps (a few more can be accessed using native code).

side loading

I am trying to side load a 64mb app on my HTC arrive unlocked with leads rom. I have tries deploying it from sdk 7.1 to device and it comes back invalid cap. I downloaded - relax melodies directly from windows phone.com, manually. I tried the emulator and it doesn't seem to even work at all. I even tried to copy and paste right onto the phone and got invalid app. What is it im doing wrong. Thank you. Download from phone doesn't also work. I believe the file is too big
Can you explain the origin of the xap? Paid for ap, free app, etc, its very import!
Sent from my Lumia 900 using XDA Windows Phone 7 App
sorry for being unclear
the app is call relax melodies. Its an app and not an audio file. They offer a free download as well as a paid version. The problem like I said is that through the market place it stops and says attention needed Some apps can be too big to download from phone and try loading from desktop. Hit retry and I end up with the same. the problem is I can't seem to get any sideloading method to work. Thanks
maybe
try to copy it on your device connect to pc and use wmdc or similia to view and browse the folders on your phone (eg in the root) then use xap deployer in device to install (such custom roms have it pre loaded otherwise you will find everything on this forum)
hope this works (sometimes for me it worked)
remember that several paidapps are impossible to install due a signature restriction (or something like this)
You don't need to side load, what it means is connect to WiFi or connect to Zune with USB, that will allow you to install with no app size restrictions. If lets say you were to attempt to download an xap through illicit means, you will be unable to install it, not because of file size but because they are encrypted. If you download via the marketplace whilst connected to WiFi or Zune you should be fine
Sent from my Lumia 900 using XDA Windows Phone 7 App

Is possible, to install and use free apps (.xap,...) in airplane mode, on lumia 1020?

I mean when I am completely offline (like android phones). Or at least using reverse tethering. Is reverse tethering possible to lumia 1020?
P.s. My question is specific. I know about wifi or bluetooth, which I don't trust. Using my pc I feel more safe.
Thanks
:cyclops:
You can deploy XAP files using a PC using USB cable. On Win 10 Mobile, you can install APPX using file explorer just like APK on Android or you can also use Device Portal (similar to reverse tethering).
Thank you
nawat said:
You can deploy XAP files using a PC using USB cable. On Win 10 Mobile, you can install APPX using file explorer just like APK on Android or you can also use Device Portal (similar to reverse tethering).
Click to expand...
Click to collapse
I did loads of research and I never stumbled upon Device Portal. Obviously you are ... (somebody) and thank you...
Unfortunately my phone runs Windows 8.1 and my laptop Windows XP. Is there something out there for me, to marry my two devices offline? I also want to downgrade to Windows 8 but probably there is not a user friedly and safe way (fa fu bee ga ).
mimis.mimis.f said:
I did loads of research and I never stumbled upon Device Portal. Obviously you are ... (somebody) and thank you...
Unfortunately my phone runs Windows 8.1 and my laptop Windows XP. Is there something out there for me, to marry my two devices offline? I also want to downgrade to Windows 8 but probably there is not a user friedly and safe way (fa fu bee ga ).
Click to expand...
Click to collapse
You're very welcome.
You can deploy apps from XAP files on WP8.1 but unfortunately not for XP. I understand that the deployment tools is from Visual Studio 2015 which requires Win 7 or higher. I've seen some sites extracts the deployment tool as a standalone app so you don't have to install visual studio. You can attempt to deploy XAP file this way. But I have no idea if it will work.

Categories

Resources