[GH-ISSUE #3636] [Feature] Windows XAML UI reconstruction: WPF BAML, UWP/WinUI XBF, bindings, and event-handler correlation #1362

New issue

Open

opened 2026-10-16 21:04:41 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:41 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3636

Summary

Windows desktop and system applications—spanning enterprise Line-of-Business software, Windows components, commercial tools, and native desktop clients—predominantly construct their user interfaces using XAML. While legacy Microsoft Silverlight apps use raw or embedded text XAML (#3616), modern production Windows applications compile XAML into binary pre-parsed streams:

WPF BAML (Binary Application Markup Language): Embedded .baml resource streams stored within .g.resources in managed .NET assemblies.
UWP / WinUI XBF (XAML Binary Format): Standalone or embedded .xbf binary assets in Universal Windows Platform (UWP), WinUI 2, and modern WinUI 3 / Windows App SDK applications.

Currently, REA does not decompile BAML or XBF binary UI definitions. When inspecting WPF or WinUI applications, the visual hierarchy, data-binding paths, UI control names, and event connections are inaccessible, leaving the UI layer disconnected from the underlying business logic.

This feature proposal introduces dedicated Windows XAML UI Reconstruction to REA: decompiling WPF BAML and WinUI XBF streams back into structured, readable XAML, reconstructing visual trees and ResourceDictionaries, resolving data bindings, and mapping UI events directly to C# / C++ code-behind methods.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: WPF Binary (.dll/.exe resources) |
                                    |        or UWP/WinUI XBF (.xbf / MSIX)   |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | WPF BAML Stream Parser    |                                   | WinUI XBF Stream Parser   |
           | (.baml records, WPF types)|                                   | (XBF v1/v2, magic XBF\0)  |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Visual Tree & ResourceDictionary      |
                                     | Decompiler (<Grid>, Styles, Templates)|
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Named Controls & Data     |                                   | Routed Event & ICommand   |
           | Binding Paths ({Binding}) |                                   | Code-Behind Binding       |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence: Reconstructed XAML,     |
                                     | Control Tree, and Event Wiring Dossier|
                                     +---------------------------------------+

1. WPF BAML (Binary Application Markup Language) Decompiler

Resource Stream Extraction: Extract .baml streams embedded within compiled .resources tables of managed .NET assemblies (reusing REA's src/dotnet/ infrastructure).
BAML Record Stream Parser: Parse BAML token records across WPF 3.x, 4.x, and .NET Core/5/6/7/8/9+:
- Document & Element delimiters: DocumentStart, DocumentEnd, ElementStart, ElementEnd.
- Assembly, Type, and Property mappings: AssemblyInfo, TypeInfo, PropertyInfo, AttributeInfo.
- Values and Text: LiteralContent, Text, PIMapping, RoutedEvent.
- Optimized custom properties: PropertyCustom, PropertyComplexStart.
XAML Inversion: Reconstruct clean, standard XAML syntax matching the original markup (<Window>, <UserControl>, <Grid>, <StackPanel>, <Button>, <TextBox>).

2. UWP & WinUI XBF (XAML Binary Format) Decompiler

XBF Header & Versioning: Parse XBF containers (magic XBF\x00 / 0x00464258) across format revisions:
- XBF v1 (Windows 8.1).
- XBF v2 (Windows 10, Windows 11, WinUI 2, and WinUI 3 / Windows App SDK).
Metadata Section Decoding:
- String Table: extract type names, property names, namespace URIs, and string literals.
- Assembly & Namespace Tables: resolve type prefixes (e.g. local:, controls:, muxc:).
- Type Table & Property Table: map object types and property tokens.
Node Stream Traversal: Reconstruct the declarative visual tree, layout grids, visual state managers, and custom control templates.

3. ResourceDictionary & Styling Hierarchy Reconstruction

Resource Dictionaries: Parse merged dictionaries (ResourceDictionary.MergedDictionaries) and localized theme resources (Generic.xaml, ThemeDictionaries).
Styles & Templates: Extract Style setters, ControlTemplate, DataTemplate, and VisualStateManager state transitions (e.g. Normal, PointerOver, Pressed, Disabled).

4. Named Control & Data Binding Discovery

Named Control Mapping: Extract all controls defined with x:Name or Name (e.g. x:Name="LoginSubmitBtn"), correlating them with generated backing fields in the code-behind class.
Binding Path Recovery:
- Decompile classic WPF {Binding Path=Model.Property, Mode=TwoWay, Converter=...} expressions.
- Decompile compiled UWP/WinUI {x:Bind Path=ViewModel.Command, Mode=OneWay} expressions, mapping compile-time generated binding helpers (IComponentConnector, IXamlMetadataProvider).

5. Routed Events & Command Code-Behind Correlation

Routed Event Resolution: Extract event wireups (e.g. Click="OnSubmitClicked", SelectionChanged="List_SelectionChanged", Loaded="Window_Loaded") and link them directly to concrete method symbols in C# or C++/WinRT assemblies.
ICommand & MVVM Wiring: Trace Command="{Binding SubmitCommand}" bindings to identify backing MVVM ViewModel command implementations (e.g. RelayCommand, DelegateCommand).

Acceptance Criteria

Introduce analyze_xaml_ui in REA CLI and MCP contracts, accepting .baml, .xbf, and .NET binaries containing embedded resources.
Safely parse synthetic WPF BAML test streams and emit well-formed, human-readable XAML.
Decompile synthetic WinUI 3 XBF v2 test streams into valid XAML visual trees.
Extract named UI controls (x:Name) and map them to code-behind class member fields in structured evidence.
Reconstruct {Binding} and {x:Bind} expressions, documenting binding paths and modes.
Correlate XAML event handlers with managed method symbols in the application graph.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#3616 [Feature] Microsoft Silverlight & XAP reverse engineering
#3624 [Feature] Native C++ semantic reconstruction
src/dotnet/ManagedArtifactInspector.ts

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3636 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Windows desktop and system applications—spanning enterprise Line-of-Business software, Windows components, commercial tools, and native desktop clients—predominantly construct their user interfaces using XAML. While legacy Microsoft Silverlight apps use raw or embedded text XAML (#3616), modern production Windows applications compile XAML into binary pre-parsed streams: - **WPF BAML (Binary Application Markup Language):** Embedded `.baml` resource streams stored within `.g.resources` in managed .NET assemblies. - **UWP / WinUI XBF (XAML Binary Format):** Standalone or embedded `.xbf` binary assets in Universal Windows Platform (UWP), WinUI 2, and modern WinUI 3 / Windows App SDK applications. Currently, REA does not decompile BAML or XBF binary UI definitions. When inspecting WPF or WinUI applications, the visual hierarchy, data-binding paths, UI control names, and event connections are inaccessible, leaving the UI layer disconnected from the underlying business logic. This feature proposal introduces dedicated **Windows XAML UI Reconstruction** to REA: decompiling WPF BAML and WinUI XBF streams back into structured, readable XAML, reconstructing visual trees and ResourceDictionaries, resolving data bindings, and mapping UI events directly to C# / C++ code-behind methods. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: WPF Binary (.dll/.exe resources) | | or UWP/WinUI XBF (.xbf / MSIX) | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | WPF BAML Stream Parser | | WinUI XBF Stream Parser | | (.baml records, WPF types)| | (XBF v1/v2, magic XBF\0) | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Visual Tree & ResourceDictionary | | Decompiler (<Grid>, Styles, Templates)| +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Named Controls & Data | | Routed Event & ICommand | | Binding Paths ({Binding}) | | Code-Behind Binding | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence: Reconstructed XAML, | | Control Tree, and Event Wiring Dossier| +---------------------------------------+ ``` ### 1. WPF BAML (Binary Application Markup Language) Decompiler - **Resource Stream Extraction:** Extract `.baml` streams embedded within compiled `.resources` tables of managed .NET assemblies (reusing REA's `src/dotnet/` infrastructure). - **BAML Record Stream Parser:** Parse BAML token records across WPF 3.x, 4.x, and .NET Core/5/6/7/8/9+: - Document & Element delimiters: `DocumentStart`, `DocumentEnd`, `ElementStart`, `ElementEnd`. - Assembly, Type, and Property mappings: `AssemblyInfo`, `TypeInfo`, `PropertyInfo`, `AttributeInfo`. - Values and Text: `LiteralContent`, `Text`, `PIMapping`, `RoutedEvent`. - Optimized custom properties: `PropertyCustom`, `PropertyComplexStart`. - **XAML Inversion:** Reconstruct clean, standard XAML syntax matching the original markup (`<Window>`, `<UserControl>`, `<Grid>`, `<StackPanel>`, `<Button>`, `<TextBox>`). ### 2. UWP & WinUI XBF (XAML Binary Format) Decompiler - **XBF Header & Versioning:** Parse XBF containers (magic `XBF\x00` / `0x00464258`) across format revisions: - XBF v1 (Windows 8.1). - XBF v2 (Windows 10, Windows 11, WinUI 2, and WinUI 3 / Windows App SDK). - **Metadata Section Decoding:** - String Table: extract type names, property names, namespace URIs, and string literals. - Assembly & Namespace Tables: resolve type prefixes (e.g. `local:`, `controls:`, `muxc:`). - Type Table & Property Table: map object types and property tokens. - **Node Stream Traversal:** Reconstruct the declarative visual tree, layout grids, visual state managers, and custom control templates. ### 3. ResourceDictionary & Styling Hierarchy Reconstruction - **Resource Dictionaries:** Parse merged dictionaries (`ResourceDictionary.MergedDictionaries`) and localized theme resources (`Generic.xaml`, `ThemeDictionaries`). - **Styles & Templates:** Extract `Style` setters, `ControlTemplate`, `DataTemplate`, and `VisualStateManager` state transitions (e.g. `Normal`, `PointerOver`, `Pressed`, `Disabled`). ### 4. Named Control & Data Binding Discovery - **Named Control Mapping:** Extract all controls defined with `x:Name` or `Name` (e.g. `x:Name="LoginSubmitBtn"`), correlating them with generated backing fields in the code-behind class. - **Binding Path Recovery:** - Decompile classic WPF `{Binding Path=Model.Property, Mode=TwoWay, Converter=...}` expressions. - Decompile compiled UWP/WinUI `{x:Bind Path=ViewModel.Command, Mode=OneWay}` expressions, mapping compile-time generated binding helpers (`IComponentConnector`, `IXamlMetadataProvider`). ### 5. Routed Events & Command Code-Behind Correlation - **Routed Event Resolution:** Extract event wireups (e.g. `Click="OnSubmitClicked"`, `SelectionChanged="List_SelectionChanged"`, `Loaded="Window_Loaded"`) and link them directly to concrete method symbols in C# or C++/WinRT assemblies. - **ICommand & MVVM Wiring:** Trace `Command="{Binding SubmitCommand}"` bindings to identify backing MVVM ViewModel command implementations (e.g. `RelayCommand`, `DelegateCommand`). --- ## Acceptance Criteria 1. Introduce `analyze_xaml_ui` in REA CLI and MCP contracts, accepting `.baml`, `.xbf`, and .NET binaries containing embedded resources. 2. Safely parse synthetic WPF BAML test streams and emit well-formed, human-readable XAML. 3. Decompile synthetic WinUI 3 XBF v2 test streams into valid XAML visual trees. 4. Extract named UI controls (`x:Name`) and map them to code-behind class member fields in structured evidence. 5. Reconstruct `{Binding}` and `{x:Bind}` expressions, documenting binding paths and modes. 6. Correlate XAML event handlers with managed method symbols in the application graph. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #3616 [Feature] Microsoft Silverlight & XAP reverse engineering - #3624 [Feature] Native C++ semantic reconstruction - src/dotnet/ManagedArtifactInspector.ts

bsakaguchi referenced this issue

2026-10-17 21:10:45 +00:00

[PR #1362] [MERGED] feat(native): admit bounded MIPS ELF analysis through Ghidra #2829

bsakaguchi referenced this issue

2026-10-17 21:12:42 +00:00

[PR #1599] [MERGED] feat(ghidra): admit bounded PSP ELF through installed Allegrex #2995