A recent glitch on download servers for brand new s has sparked widespread Internet chatter among developers and focused new attention on the best ways to protect apps from being hacked. The MobileTechWorld Web site that it was possible for registered developers with 'unlocked' phones to download the basic code package, in Microsoft's XAP file format, directly from Microsoft's online servers, bypassing the company's online Zune marketplace. The XAP 'package' could then be subjected to a variety of well-known tools to break down the files into their constituent elements, including any data or intellectual property that the developer might want to keep hidden.
Hi, I downloed XAP file from the market place (There is an option called. I have Lumia 920 developer's unlock, and also the Visual Studio 2013. A workaround of DRM protection was put online here there is very little time.
The ease of unpacking is due to the underlying foundation for Windows Phone 7 apps -- a version of Microsoft's.Net code framework. The application code runs in a virtual machine, which interprets it and makes calls to the underlying operating system. For WP7, the virtual machine is provided by either Microsoft Silverlight or Microsoft XNA Studio.
From the outset,.Net applications, like those of other managed code environments such as Java (and by extension Android, among other mobile operating systems) have been easy to disassemble for experienced programmers. 'A WP7 XAP [pronounced 'zap'] is nothing more than a zip file with an XML manifest in it,' says Kevin Hoffman, Windows.
'.Net developers have always known that their applicationswere subject to disassembly. Tools like ILDASM.EXE and Reflector have always allowed anyone with even a basic knowledge of.Net to crack open the file and, in many cases, read completely un-obscured source code.' Though.Net is unique to Microsoft, the overall application architecture is not. Pirated applications in the Android OS community are a long-standing problem, which some feel is getting worse. Google has taken a range of recent measures to make it more difficult.
) Microsoft quickly closed the particular XAP download loophole, which in any case was one that only registered developer phones, not the consumer WP7 handsets, could use. 'It is important to note that applications obtained from a site like this cannot run on consumer retail devices. These application files are signed and will not run without modification. Such files would only run on the limited number of 'unlocked' phones in circulation, such as those that have been registered by a Marketplace developer via [the online developer portal] App Hub,' Microsoft said in its response to the incident. For novices, the ease with which their applications can be unpacked may be disquieting. Some online forums were filled with fulminations and outrage. But the same forums also showed that experienced.Net developers, like Hoffman, were well aware of the issue, which, as they pointed out, is not unique to Microsoft.
'This response seems to be pretty nonchalant considering Microsoft has just confirmed that, for a period, all 2,000 applications in marketplace could be downloaded and used by an unlocked device,', a Microsoft Student Partner pursuing a computer science and engineering degree, and a blogger at the WMPowerUser.com site. Not everyone agreed.
'[A]ny.Net developer that has a clue knows this and would obfuscate their program if they wanted to be a little more secure,'. 'However even obfuscated code can be decompiled and ran on an unlocked device.'
An unidentified programmer with Seles Games, identified on its Twitter and accounts as an WP7 game and apps developer, took issue with Cannon on two points, angry that the XAP files were unsecured to start with, and angry that the obfuscation tools have only just become available. 'This is not about whether a XAP can be decompiled,' this coder wrote. 'It is about, why would those XAPs ever be exposed via a web service call?? In other words, why are they exposed to the world so easily? Huge oversight on Microsoft's end, and this will rub a lot of developers the wrong way. Also, obfuscation tools were only released last week for Windows Phone 7. Many apps were released a month ago. 
Do the math!' Another programmer, identified as Clint, sided with Cannon. 'As a developer and one who has a product in the [Zune] Marketplace I would have been pretty naive to think that my app was protected in any shape or form,' he wrote. 'It is just the nature of things when it comes to software. I fully expect that someone at XDA or elsewhere will come up with a way to unlock a phone without being a developer. It is bound to happen at some point.'