[GH-ISSUE #3616] [Feature] Microsoft Silverlight & XAP reverse engineering: Package extraction, AppManifest inspection, XAML de-serialization, and WCF binary analysis #1346

New issue

Open

opened 2026-10-16 21:04:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:31 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3616

Summary

Microsoft Silverlight (.xap packages) was Microsoft's flagship Rich Internet Application (RIA) runtime and the primary application platform for Windows Phone 7, 7.5, and 8.0. Although official browser plugin support was retired in October 2021, a massive corpus of legacy enterprise line-of-business (LOB) software, banking and financial portals, digital learning software, and Windows Phone mobile apps remain archived and require static reverse engineering, vulnerability analysis, and digital preservation.

Silverlight applications compile managed .NET code against the Silverlight CoreCLR BCL, bundling multiple assemblies, XAML UI hierarchies, Out-of-Browser (OOB) elevated trust manifests, and WCF / RIA Services network communication protocols into a .xap container.

This feature proposal introduces dedicated Microsoft Silverlight & XAP Reverse Engineering to REA, integrating with REA's existing managed .NET analysis infrastructure (src/dotnet/ManagedArtifactInspector.ts) to unpack .xap archives, reconstruct XAML UI layouts, bind UI controls to code-behind event handlers, and decode WCF binary endpoints.

Technical Capabilities

1. XAP Package Unpacking & Manifest Inspection

Container Extraction: Bounded, safe ZIP archive extraction of .xap files with zip-bomb safeguards.
AppManifest.xaml Parser:
- Extract declared runtime version (RuntimeVersion), entry point assembly (Deployment.EntryPointAssembly), and entry point type (Deployment.EntryPointType).
- Map all bundled dependencies (Deployment.Parts / AssemblyPart).
Out-of-Browser (OOB) Manifests (OutOfBrowserSettings.xml):
- Detect ElevatedPermissions.Required status (full-trust Silverlight execution).
- Extract custom window chrome settings, application icons, and desktop integration hooks.
Windows Phone Manifests (WMAppManifest.xml):
- Extract Product ID, Publisher, Title, and Version.
- Map declared device capabilities (ID_CAP_NETWORKING, ID_CAP_LOCATION, ID_CAP_CAMERA, ID_CAP_MICROPHONE, ID_CAP_IDENTITY_DEVICE, ID_CAP_WEBBROWSERCOMPONENT).
- Parse background service agents (PeriodicTask, ResourceIntensiveTask) and tile configurations.

2. Silverlight .NET Managed Assembly Analysis

Silverlight BCL Classification: Extend ManagedArtifactInspector.ts to identify Silverlight target frameworks (mscorlib 2.0.5.0, 5.0.5.0, System.Windows).
Metadata & Type Inspection: Extract classes, methods, properties, interfaces, and field layouts across all bundled DLLs.
Obfuscation Detection: Identify common .NET obfuscator signatures (Dotfuscator, ConfuserEx, SmartAssembly, Agile.NET).
CIL Disassembly & Decompilation: Disassemble CIL instruction streams into structured method bodies, control flow graphs, and readable C# representations.

3. XAML Layout & Event Handler Binding Reconstruction

XAML Tree Parser: Parse raw and embedded XAML documents, reconstructing visual layouts (UserControl, Page, Grid, Canvas, DataTemplate).
Control-to-Code-Behind Binding:
- Map named UI elements (x:Name="SubmitButton") to generated code-behind fields.
- Resolve event attributes (e.g. Click="OnSubmitClicked", SelectionChanged="List_SelectionChanged") directly to their corresponding CIL method symbols in the owning class.
Data Binding & MVVM Flow:
- Parse {Binding Path=PropertyName, Mode=TwoWay} expressions to identify underlying ViewModel models and data-binding flows.

4. WCF Binary XML & RIA Services Endpoint Extraction

WCF Binary XML Decoder (application/soap+msbin1): Implement a decoder for WCF binary XML streams, reconstructing SOAP envelopes and message contracts.
WCF RIA Services Extraction: Identify domain contexts (DomainContext), query methods, invoke operations, and shared entity definitions ([DataContract], [DataMember]).
Static Endpoint Discovery: Extract hardcoded SOAP/REST service URLs, client proxy configurations, and connection strings.

5. Elevated Trust & Native Interop Surface Analysis

COM Automation Probing: Detect and annotate calls to AutomationFactory.CreateObject("...") used in elevated trust OOB apps (e.g. automation of Microsoft Office, shell scripts, or host Windows APIs).
P/Invoke Inspection: Surface unmanaged native method declarations ([DllImport("...")]) permitted under elevated trust profiles.
Local Filesystem Access: Identify usage of elevated filesystem APIs (System.IO.File, Environment.SpecialFolder.MyDocuments) vs. isolated storage (IsolatedStorageFile).

Acceptance Criteria

Introduce analyze_silverlight_application in REA CLI and MCP contracts, accepting .xap files.
Safely unpack .xap archives and report entry points from AppManifest.xaml and capabilities from WMAppManifest.xml.
Classify unpacked assemblies as silverlight-managed and extract type hierarchies and method signatures.
Correlate XAML event attributes with code-behind method symbols in structured evidence.
Decode synthetic WCF binary XML messages into readable XML representations.
Provide comprehensive unit tests with synthetic, open-source Silverlight XAP test fixtures.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#3607 [Feature] Comprehensive Unity extraction and reverse engineering
#3614 [Feature] Adobe Flash & SWF Reverse Engineering
src/dotnet/ManagedArtifactInspector.ts

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3616 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Microsoft Silverlight (`.xap` packages) was Microsoft's flagship Rich Internet Application (RIA) runtime and the primary application platform for Windows Phone 7, 7.5, and 8.0. Although official browser plugin support was retired in October 2021, a massive corpus of legacy enterprise line-of-business (LOB) software, banking and financial portals, digital learning software, and Windows Phone mobile apps remain archived and require static reverse engineering, vulnerability analysis, and digital preservation. Silverlight applications compile managed .NET code against the Silverlight CoreCLR BCL, bundling multiple assemblies, XAML UI hierarchies, Out-of-Browser (OOB) elevated trust manifests, and WCF / RIA Services network communication protocols into a `.xap` container. This feature proposal introduces dedicated **Microsoft Silverlight & XAP Reverse Engineering** to REA, integrating with REA's existing managed .NET analysis infrastructure (`src/dotnet/ManagedArtifactInspector.ts`) to unpack `.xap` archives, reconstruct XAML UI layouts, bind UI controls to code-behind event handlers, and decode WCF binary endpoints. --- ## Technical Capabilities ### 1. XAP Package Unpacking & Manifest Inspection - **Container Extraction:** Bounded, safe ZIP archive extraction of `.xap` files with zip-bomb safeguards. - **AppManifest.xaml Parser:** - Extract declared runtime version (`RuntimeVersion`), entry point assembly (`Deployment.EntryPointAssembly`), and entry point type (`Deployment.EntryPointType`). - Map all bundled dependencies (`Deployment.Parts` / `AssemblyPart`). - **Out-of-Browser (OOB) Manifests (`OutOfBrowserSettings.xml`):** - Detect `ElevatedPermissions.Required` status (full-trust Silverlight execution). - Extract custom window chrome settings, application icons, and desktop integration hooks. - **Windows Phone Manifests (`WMAppManifest.xml`):** - Extract Product ID, Publisher, Title, and Version. - Map declared device capabilities (`ID_CAP_NETWORKING`, `ID_CAP_LOCATION`, `ID_CAP_CAMERA`, `ID_CAP_MICROPHONE`, `ID_CAP_IDENTITY_DEVICE`, `ID_CAP_WEBBROWSERCOMPONENT`). - Parse background service agents (`PeriodicTask`, `ResourceIntensiveTask`) and tile configurations. ### 2. Silverlight .NET Managed Assembly Analysis - **Silverlight BCL Classification:** Extend `ManagedArtifactInspector.ts` to identify Silverlight target frameworks (`mscorlib 2.0.5.0`, `5.0.5.0`, `System.Windows`). - **Metadata & Type Inspection:** Extract classes, methods, properties, interfaces, and field layouts across all bundled DLLs. - **Obfuscation Detection:** Identify common .NET obfuscator signatures (Dotfuscator, ConfuserEx, SmartAssembly, Agile.NET). - **CIL Disassembly & Decompilation:** Disassemble CIL instruction streams into structured method bodies, control flow graphs, and readable C# representations. ### 3. XAML Layout & Event Handler Binding Reconstruction - **XAML Tree Parser:** Parse raw and embedded XAML documents, reconstructing visual layouts (`UserControl`, `Page`, `Grid`, `Canvas`, `DataTemplate`). - **Control-to-Code-Behind Binding:** - Map named UI elements (`x:Name="SubmitButton"`) to generated code-behind fields. - Resolve event attributes (e.g. `Click="OnSubmitClicked"`, `SelectionChanged="List_SelectionChanged"`) directly to their corresponding CIL method symbols in the owning class. - **Data Binding & MVVM Flow:** - Parse `{Binding Path=PropertyName, Mode=TwoWay}` expressions to identify underlying ViewModel models and data-binding flows. ### 4. WCF Binary XML & RIA Services Endpoint Extraction - **WCF Binary XML Decoder (`application/soap+msbin1`):** Implement a decoder for WCF binary XML streams, reconstructing SOAP envelopes and message contracts. - **WCF RIA Services Extraction:** Identify domain contexts (`DomainContext`), query methods, invoke operations, and shared entity definitions (`[DataContract]`, `[DataMember]`). - **Static Endpoint Discovery:** Extract hardcoded SOAP/REST service URLs, client proxy configurations, and connection strings. ### 5. Elevated Trust & Native Interop Surface Analysis - **COM Automation Probing:** Detect and annotate calls to `AutomationFactory.CreateObject("...")` used in elevated trust OOB apps (e.g. automation of Microsoft Office, shell scripts, or host Windows APIs). - **P/Invoke Inspection:** Surface unmanaged native method declarations (`[DllImport("...")]`) permitted under elevated trust profiles. - **Local Filesystem Access:** Identify usage of elevated filesystem APIs (`System.IO.File`, `Environment.SpecialFolder.MyDocuments`) vs. isolated storage (`IsolatedStorageFile`). --- ## Acceptance Criteria 1. Introduce `analyze_silverlight_application` in REA CLI and MCP contracts, accepting `.xap` files. 2. Safely unpack `.xap` archives and report entry points from `AppManifest.xaml` and capabilities from `WMAppManifest.xml`. 3. Classify unpacked assemblies as `silverlight-managed` and extract type hierarchies and method signatures. 4. Correlate XAML event attributes with code-behind method symbols in structured evidence. 5. Decode synthetic WCF binary XML messages into readable XML representations. 6. Provide comprehensive unit tests with synthetic, open-source Silverlight XAP test fixtures. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #3607 [Feature] Comprehensive Unity extraction and reverse engineering - #3614 [Feature] Adobe Flash & SWF Reverse Engineering - src/dotnet/ManagedArtifactInspector.ts

bsakaguchi referenced this issue

2026-10-17 21:10:35 +00:00

[PR #1346] [MERGED] fix(skill): pin packaged commands to the shipping package version #2814

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1346

No description provided.

Rows
Columns