Home > View Post

Reflectorizing a ClickOnce app

Reflectorizing? Controllerizing? I think I've been watching too much Winnie the Pooh with my son. Anyway, this post is a quick walkthrough of how to use reflector to poke around a ClickOnce application. The idea for the post came after a comment was left on the blog asking for the code to a ClickOnce demo I host on this site. The demo in question is a WPF demo so I'll also show how to use the BamlViewer add-in for Reflector to gain access to the Xaml too.

Remember, ClickOnce apps are .NET applications and Reflector can reflect over them just like any other .NET application. The hard part is finding the exe or dll in question because they're tucked away deep in user specific storage. It's not too hard to find though. And even if the ClickOnce app is in 'run online only' mode the images still have to be downloaded and persisted to disk so that's no obstacle.

Here's how.

Fire up the ClickOnce application in question and head to Task Manager and find the application's process:

Go To Process

You should see the specific process in process view and now we'd like to see the name and path of the image. Go to View | Select Columns in the Task Manager menu..

Select Columns

.. and choose the Image Path Name column.

Image Path Name column

And huzzah!

Image Location in Task Manager

Now we just view this exe or dll in Reflector and we're away. If we'd like to see any XAML then we're currently scuppered as XAML is compiled into BAML and stored in the resources of the dll, as you can see:

BAML in reflector

All we need now is the excellent BamlViewer extension for Reflector.

Make sure you 'connect' the add-in using View | Add-ins function in Reflector and then we can activate the Baml Viewer tool (Tools | BAML Viewer).

BAML Viewer in action

If you don't want somebody poking around your ClickOnce application like this then you need an Obfuscator.

Tags: .NET

© 2005 - 2022 Josh Twist - All Rights Reserved.