Mini reverse engineering and modification of Windows Phone applications

Hello!

A few days ago I caught the eye of a funny game in which it was necessary to go around obstacles on a motorcycle and get points for it, and my friends and I began to measure the number of points scored a little. A little thought, I decided to delve into the code of the game and add a small hack for glasses. So, how to disassemble the Windows Phone application, change something in it and put it all back:

To begin with, we will define everything necessary:

• Unlocked Windows Phone device (emulator is also suitable, but there is no pleasure from the game).
• Installed WP7.1 SDK or any alternative for installing .xap on the device.
• .NET Reflector for decompiling / compiling assemblies.
• Reflexil to save assemblies
• HxD to edit HEX values
• Phone7Market for downloading .xap from the market

My knowledge of the bydlohaker in the reflector / hex-editor is just enough to replace simple values.
To begin with, we extort the application from the market using Phone7Market. We find the game by searching, right-click and save to the desired directory on the disk.


')
Now copy our .xap file and rename the copy to .zip and unpack it into a folder. For example, after my operations, the folder looks like this:



Now we will start the most interesting. Unpack the reflexil and copy the path to it. Now run ReShrper and go to Tools -> Add-Ins ... click Add and paste the path to Reflexil.Reflector.dll in the folder with reflexil. This thing is needed in the reflector in order to edit and reassemble the assembly.
Open in the reflector our previously unpacked archive. Quickly running through the list of libraries, open the one with which, the name is similar to the application. Most likely, this is the main project.



The Config class immediately catches the eye. Hold on - yes this is a class with basic meanings! Now you can change something small type of speed or the likelihood of machines. Let's correct a little the speed of adding points, the probability of occurrence of obstacles and the number of points for avoiding obstacles.



Open HxD and select our library ThreeDMoto.dll .



A little scary, but just to understand everything. Find the line that we will change.

public static readonly float[] TIMESPAN_OF_SHIFT = new float[] { 0.5f, 1f, 3f, 5f }; 

So, we have the values ​​0.5, 1, 3, 5. Go back to HxD and click the search. We will search by the number 3.



found several meanings. Now we are looking for 5. There are only 2. Now you need to find the place where 3 and 5 are next to each other:



Fine. Make sure that there are exactly those numbers and replace all 4 with 0.1



Click save and switch to the reflector. To make sure we did everything right. Remove the library from the reflector and connect it again. Go to the config and find the desired line:

  public static readonly float[] TIMESPAN_OF_SHIFT = new float[] { 0.1f, 0.1f, 0.1f, 0.1f }; 

So the build has changed. Now in the conductor we drag the dll to zip and confirm the replacement. Rename .zip to .xap and upload the application to the device.



And we get the first error. This error occurs because the .xap package contains a file with the checksum of the WMAppPRHeader.xml application. Delete the file from the archive and try again:



The phone gives out a strange thing. If you think about it, this can occur only because of editing the library without recompiling. So, again open the reflector with the library and save our library.



Again, we perform the renaming action and drag and drop the project onto the device. It worked. Now acceleration takes place in a quarter of a second, and the points are multiplied by 4 times almost instantly. Now we will edit the number of points for avoiding obstacles and the likelihood of obstacles on the road.



Replace all with:



Save, rename, copy, rename, fill. Now you can easily set a record of any size.

Original application.
Edited application.

So let's summarize

When developing games and applications on Windows Phone, developers should not forget that their code can be viewed after compilation. To complicate the lives of those who will watch or edit it - you can use convenient and simple means to obfuscate the code and sign the assemblies. This will create several problems. Because of the signature, the assembly will be more difficult to edit, and because of obfuscation, it will be completely unclear what to edit. After all, using the described method, you can not only edit innocuous values, but also remove trials from applications and even add your own methods and classes and rewrite existing ones.