0

I have no experience with Windows Store Apps and there appears to be limited info out because they are still relatively new.

I have 3 questions:

  1. When I open a store app in analysis tools such as PE Studio and IDA Pro, it's got quite a jungle of symbols. Are these apps running in a VM?

  2. Is there any constant unique way to identify a Windows Store app by its header info? It appears to be a standard PE to me, however, it definitely is "corrupt" as far as Windows 7 and before is concerned. Of course is isn't designed to be run in those environments, but I'm studying the format.

  3. Are there any good papers or other info on reversing or otherwise technical studies on the Windows Store Apps?

Improve this question

1 Answer 1

Reset to default
1

Windows Store Apps are .NET applications so probably better would be to open them in .NET Disassembler (like dnSpy).

  1. They are executed by .NET runtime so VM is a good way of calling what's going on there. Read about the JIT compiler.

  2. There will be a .NET Directory present inside the PE (.net file format)

  3. Search for any info about .NET apps - a lot of them is available.

Improve this answer
4
  • Are you sure about this that they are ALWAYS .NET? I ask because I'm used to .NET having a single import of _corlibmain which fires up the CLR stuff. However, many of these store apps contain standard W32 imports as well. ILSpy also cannot open any of them, it says they "are not managed assemblies." I'm going to try dnSpy next. You're probably right it's just these have different characteristics from regular .NET assemblies it seems. Also, by .NET are you also meaning Visual C++ managed? In Detect-It-Easy a lot of these show as VC++ too.
    – the_endian
    Commented Jun 6, 2017 at 7:32
  • dnSpy can't get any .NET symbols from them at all. Just gives PE Header.
    – the_endian
    Commented Jun 6, 2017 at 7:38
  • "ALWAYS" might not be the correct but word here as I know that at some point it was possible to write them in JS too.
    – Paweł Łukasik
    Commented Jun 6, 2017 at 7:43
  • 1
    Microsoft promotes .Net languages to develop apps for their app store, so the greatest number actually is. There are some well-known older programs included in the store, which are mostly for computers that they were included as-are, so these might need different tools. But almos 90% of apps is in .Net, so ILSpy, a good hew editor and some PE header tools is the best way to wander around the code.
    – Chris Tsiakoulas
    Commented Jun 6, 2017 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.