For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse engineering I thought that it shouldn't be too hard because I thought it was a standalone exe. It was only until I couldn't launch the exe on it's own that I realised it's a UWP app which means I couldn't do my go-to debugging it in IDA.
(Just to mention now, I noticed that sticky notes always has two processes running -
ApplicationFrameHost which I assume is the main sticky notes window and another process which I assume is the actual open sticky notes. All the methods I've tried, I've tried on both processes to be certain.)
I started by opening sticky notes in IDA and trying to use the debugger, but as mentioned, that didn't get me too far so I opened it up in Binary Ninja instead, just to explore a bit. I didn't know what to look for, so I didn't find much. However, BN did show a lot of strings except apparently they aren't used anywhere in the program. Things like:
BCreateStickyNoteViaJumplistAction - "Jumplist" is also in the name of the plus icon used as the button - C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_220.127.116.11_x64__8wekyb3d8bbwe\Assets\JumpListNewNote.png` CreateNewNote .... WithNewStickyNote TryGet_ViewState_IsSticky
and lots of what looks like C# code. But as I mentioned, BN showed no references to these (and other) strings and as I'll mention later, the strings in x64dbg all seemed "encoded" so I never found a use for these anyway.
Next I think I tried out WinDBG (preview). I tried first by just attaching it to the running sticky notes process (and then launching the app using the
launch app package) but I wasn't able to do anything with that. It just told me the DLL's that were being loaded, including the ones missing which means I couldn't launch the exe directly, like:
C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\SharedLibrary.dll
Maybe it's possible to somehow point the exe to these DLL so I could launch it via IDA but I think it's a stretch.
I did a few other small things here and there like ollydbg and PE Disassembler viewer but they are not of significance.
The thing I have been trying the most is x64dbg. On my own, I didn't really get anything done; I didn't find anything related to buttons or their handler's. So I tried googling to see if someone else had tried reverse engineering a UWP and came across this. I gave the second answer a go, since it was quicker to do at the time. However, when you click to open a new note, no new DLL's will be loaded so I couldn't use that. I tried also breaking when a new thread is created which did cause it to stop execution when I created a new note but I don't think each new note is its own thread, I think that was just some other internal Windows thing.
The reason I didn't try the first answer is that they hook into
KernelBase.dll to "redirect" the resources accessed, since it loads a new DLL when
Restart now is pressed, but again, in my situation, nothing new is loaded when a new note is created.
I did also try EventHook and just using
GetProcessById to get the sticky notes process but that doesn't really expose much.
I feel like I have what I need to do this, I just don't quite know how. If anyone could point me in the right direction I'd really appreciate it.