How are WinRT / Metro apps restrictions enforced? - windows-8

The new Metro style / WinRT apps in Windows 8 have certain restrictions as to which APIs you can call. Also, you have to use asyncronous techniques and your app has to be pauseable, etc.. I'm wondering how, and if all of this is enforced.
Are the new Metro apps simply execuable programs, or are they something else (e.g. more like COM controls, with a set of defined interfaces)? How are the API restrictions enforced, at compilation, at runtime (via sandboxing etc.) or just via Windows Store policy (similar to the situation in iOS)? If I was feeling devious, could I e.g. get a handle to the screen and manipulate the interface, add floating windows on top, launch something in the background, or otherwise break out of the confines of Metro?
One reason I'm asking is that I'm looking into creating a WinRT library for Python, so that one could use it for writing Metro apps. However, the Python core obviously uses a lot of non-WinRT API calls, so this might be doomed from the beginning. I'd also like to get a feel for the anatomy of Metro apps in general.
Edit: According to this thread, you have all the functions of the C runtime available. It seems like you can compile stuff that calls forbidden functions, but the "application verifier" complains. I'm wondering if you could just run such a hybrid app, if you don't care about the Store (and maybe make it Store compatible later by writing workarounds for the forbidden functions)...

There are (at least) two separate sets of technical restrictions on what a Metro style Windows Store app can do.
The first is a set of security restrictions: Windows Store apps run with low privileges, and thus are limited in how they are permitted to interact with the rest of the system. For example, a Windows Store app cannot access arbitrary locations in the filesystem, it can only access files in a predefined set of locations, and files to which the system expressly gives access. You cannot violate these security restrictions (if you could, that would be a rather problematic operating system bug).
The second set of restrictions is the API partitioning. Windows Store apps are only permitted to call system functions that are present in the App Partition. The documentation for each system function on MSDN specifies whether the function is present in the App Partition. You can also find out by looking in the header file that defines the function: functions are conditionally defined depending on the API partition targeted by the project: the WINAPI_FAMILY macro controls this (see winapifamily.h in the Windows SDK for more information).
If you call an "unapproved" function, the results are undefined. It might appear to work; it might fail catastrophically. It might appear to work fine today and fail catastrophically tomorrow (or after a Windows update is applied, or with the next version of Windows).
The API partitioning is enforced in various ways. The headers are constructed such that it is difficult to call an unapproved function. If you define the function yourself or change the WINAPI_FAMILY, your app will fail the Windows App Certification Kit (WACK) process. My understanding is that the CLR prohibits calls to unapproved .NET functionality at runtime, though I am less familiar with the .NET restrictions. In any case, my understanding is that if your app calls an unapproved function, you cannot submit it to the store, per the "Windows 8 app certification requirements" (please read those requirements yourself, though; I have not read them in detail and I certainly can't interpret them for you).
If you don't care about submitting your application to the Windows Store or just want to write some test apps or play with WinRT, then there's nothing stopping you from trying to call unapproved functions. For example, I find it is useful to create a console window for debugging purposes. That appears to work fine, and I don't much care that it fails Windows Store certification since it's for debugging and testing only.

They aren't standard executables. You're restricted to a subset of .Net 4.5 to create the applications which doesn't let you (or rather, makes it extremely difficult to) do anything that MS don't want Metro apps doing. They're pretty heavily sandboxed as well.

You have a limited part of the .net api available:
The .NET Framework provides a subset of managed types that you can use
to create Metro style apps for Windows using C# or Visual Basic. This
subset of managed types is called the .NET for Windows Store apps and
enables .NET Framework developers to create Metro style apps within a
familiar programming framework. Any types that are not related to
developing Metro style apps are not included in the subset.
You use
these managed types with types from the Windows Runtime API to create
Metro style apps. Typically, you won't notice any differences between
using the managed types and the Windows Runtime types except that the
managed types reside in namespaces that start with System, and the
Windows Runtime types reside in namespaces that start with Windows.
Together, the .NET for Windows Store apps and the Windows Runtime
provide the complete set of types and members available for developing
Metro style apps with C# or Visual Basic.
There are app store requirements.
3.1 You must use only the Metro style APIs to implement the features of your Metro style app We describe these APIs in the Metro style apps
API reference. Your app may only depend on software listed in the
Windows Store.
Apps are sandboxed.
In short, you must you the api provided.

Related

VB.NET Cross platform app

I make a game using vb.net & wpf. But I want this run on Windows/Linux/Mac.
How can I do it?
I'm sorry my english is really bad :D I use Google translate.
Implementing a solution for multiple platforms is not an easy task and you need to be familiar with all the platforms you plan to support, starting with trivialities such as different path schemes and ending with checking every reference you require by your project settings for its compatibility to the target platform.
Please have a look at http://www.mono-project.com. When you install the mono package to your system, you can run your compiled .exe as it is from the shell under certain circumstances.
Obviously, you need to decide whether you try to create one application that runs on all target platforms OR if you want to create platform specific applications all referencing to the same game engine.
If you stick very close to the framework not using external references, chances are higher to achieve the former. If the main logic of your game can easily be compartmentalized into a dedicated project, the latter is the way to go.
In general, cross-plattform compatibility is more easily to achieve if your application backend consists of a console application to be accessed by a webbrowser installed on the system - using a web frontend though. But as long as you do not require accelerated graphics, this should be feasible.

Difference between Metro Apps written in HTML/CSS/JS vs XAML/C#

What is the difference between Metro apps written in web-development technologies and ones written in XAML/C#, etc.? Does Microsoft Metro API provide hooks for Javascript, where it's all native for C#? Should they work hand in hand, or is it the developers choice which route to go?
Is there certain functionality that cannot be implemented if using JS (other than OpenGL hardware capabilities)?
The reason I'm wondering is to know which technologies are necessary for building extensive Metro apps, so that when I get to a certain point I'm not stopped by a brick wall, letting me know that I used the wrong technology.
Microsoft has put in a lot of work to make Javascript a first-order language on par with C# for WinRT development. Both Javascript and C# have direct access to the WinRT API via language projections. That is, there is a unique binding specific to the language to the underlying API. So neither language is any more "native" than the other.
You should be able to write an equivalent Metro app in either language. At a high-level, it really does come down to which language/environment you are more comfortable with.
However, there are a couple of differences that should factor into the decision. First, WinRT components can only be written in C# or C++. Javascript can only consume thse components. If there is an intent to create reusable/shareable components, should keep this in mind.
Second, although the Windows Phone 8 SDK has not been released yet, there are indications that Windows Phone 8 apps can only be written in C#. If there is an intent to create similar apps for both the tablet as well as the phone, this is probably a serious consideration.
There haven't been a lot of performance-based studies comparing the two in a Metro app, so it's hard to say whether that will become a factor or not.
Then, there is also 3rd-party support to consider. C#/XAML is well established and has a lot of 3rd-party support. But similarly, Javascript has a lot of 3rd-party libraries available (e.g. jQuery) that for the most part can be brought in and used in a Metro app as well. I would give a slight edge to C#/XAML, but it seems like support is good for both.

Can WinRT application use obfuscation?

All Metro applications must be inspected before distribution through Windows 8 AppStore. Does this mean it will not be allowed to use code obfuscation? Or it is still possible, and only some specific aspects are going to be monitored during such inspection?
Here are some facts:
Marketplace for WP7 allows C# apps be obfuscated (even MS he advises
doing so) and I don't see any reason why Windows AppStore would ban
such apps.
It is almost certain that some vendors will provide compatible C++
obfuscator.
You should care about your clients not crackers. :)
a lot of hacks for code obfuscation will be banned.
Remember, if you have some logic that you want to hide, make a webservice and consume it in your client app. Better spend your time building better app, fixing bugs etc.
No dice, if someone has access to the binaries is just a matter of time when someone cracks it.
This is an armchair answer with some things that come to mind:
Even a C++ application can still be anazlyed if it depends on dynamic linking to a runtime or API, which is the case with WinRT applications. Microsoft approval can in theory include automated or human guided testing of your app using a special sandbox and/or OS hooks capable of detecting if your application attempts certain prohibited operations.
Under the hood, C++ apps for WinRT are more like native C++ apps than C++/CLI, so obfuscation is not needed to the degree that it is for C#, all things being equal.
You can still build C# apps that target WinRT, but your code will still be compiled to CIL and run within the CLR (more or less), invoking WinRT through wrappers that Microsoft provides. Because it's CIL, the question of obfuscation should be equivalent to that of C#/.NET obfuscation in general.
Obfuscation is still possible for WinRT. The inspection made by the Application Certification Kit cover lot of aspects including metadata and IL verification. Just like the old peverify did.

Is there any way to write a WinRt (Metro) app that will also work on Windows 7 and Vista?

We can’t just leave our customers that are not able to upgrade to windows 8 for a long time in the larch. However there is demand for a “tablet”/”touch” version of our app.
So how can we support both touch with Metro on Windows 8 and our current customers from a single code base?
When WPF come out, after a lot of “Pushing” Microsoft saw since and make it work on Windows XP – has anything like this been talked about for WinRT.
(I am not expecting any solution to work on XP, as XP support is being wound down.)
See Also: Can the ARM version of Windows 8 only run Metro (WinRt) style apps?
The best answer is that you do not want the same application to run on Windows 7 and Windows 8 Metro style. The UI that works best for mouse and keyboards (windows 7) will not work well for a touch-first presentation and visa versa. It is important to re-imagine the UI for the two different worlds.
That said, you have 2 options if you want to share a lot of the code:
1) Write it largely in JavaScript/HTML5. This will let you re-use many of the assets (especially the business logic parts).
2) Write it in (desktop) Silverlight. The Silverlight XAML is closest to Windows XAML. WPF is further away and will require more re-work later.
In either case, you should look at and follow the principles used when writing cross-platform code. Understand the platform dependencies and isolate them behind indirection boundaries. You want to localize all of the code that will have to change. For instance, you don't want calls to the .Net System.IO.File APIs which you know will have to change to Windows.System.Storage calls being scattered throughout your code. Instead, you want it localized in one function that can be modified later.
The only way I can think of is to implement your application in HTML5/CSS3/JS, and avoid using WinRT APIs inasmuch as possible - this may be feasible depending on what, exactly, your app needs to do (e.g. portable 2D graphics is easy with HTML5 canvas).
Then, for Win8, you'll package this as Metro web app. For Win7 and below, you write a simple app that embeds your browser of choice (not IE9, since it doesn't work on XP - so Firefox or Chrome) with all chrome hidden, and loads your HTML5 app inside that embedded browser.
As others have noted, you would not want to have exactly the same application working in Win8 Metro and Win7 / Vista Desktop. If you structure your application properly, using a suitabel design pattern, it is possible to share quite a bit of code between the various version that you would require. For the Win8 version, you will be using WinRT, for Win7 / Vista you have a choice of Silverlight or WPF.
I have published a couple of articles that demonsrate how this can be done, they include quite a bit of code as well:
XAMLFinance – A Cross-platform WPF, Silverlight & WP7 Application - while this article does not cover Win8, it does share code from WPF to Windows Phone 7, which is a very similar problem.
TweetSearch – A Cross platform Metro UI WinRT and Silverlight Application - this article shows how to use the same techniques to share code between WinRT and Silverlight
It is unlikely that we'll see Microsoft push the Metro-style
application framework back to past releases due to the level of
re-architecting that went into Windows 8.
I agree with Zac on this point. It appears Microsoft is definitely pushing both the technology and usability forward with the introduction of Windows 8 (and Windows Runtime).
The Metro UI is a different UI paradigm. If your using the current
Win32 controls (which includes WPF controls), your application will
look really dated in Metro. The only way to fix that is to
re-implement the UI (your View classes in an MVVM design) using Metro
controls. However, C# and majority of the .NET APIs are first class
citizens in this new environment. The rest of your application should
be fine.
As you already have what I assume a rather large application your best solution would be separate your view from your model-viewmodel. Then you can continue to develop both Windows 8 Metro full-screen touch-friendly awesome interfaces and the "classic" window interface (what we have done for the last x number of years). With good separation, design, and an excellent source control solution (i.e. Perforce) you will able to share a lot of the code base.
In addition to the answers given to your recent question on Windows Runtime Bill Wagner (one of the many C# bloggers that I follow) has posted summary on WinRT and managed languages conference sessions; it is an good read and recommended if you have a few minutes. One of the things that his summary clarified (in the FAQ at the end) was that the future of .NET as the branding for the framework we use is going to be replaced with Windows Runtime.
Another piece from Bill's blog post:
Some of the .NET APIs are changing for WinRT. I don’t have an
exhaustive list, and I’m not sure there is one yet. Other APIs are not
exposed via WinRT. (They are still available as .net APIs, just not as
Metro / WinRT APIs.)
It is unlikely that we'll see Microsoft push the Metro-style application framework back to past releases due to the level of re-architecting that went into Windows 8.
Like Pavel said, if you kept your application from using as much of the WinRT libraries as possible, it is possible but then again, you're now building a regular web app.

How to create a cross-platform smartphone application?

I am new to smartphone application Development, I have worked with .NET web and Windows Forms applications and only used the C# language.
I am planning to make a simple application which can run on all mobile OSes, like BlackBerry, Windows Mobile, Android phones, iPhone, etc. On searching I found that all have different OSes and uses different languages. I can use the C# language and .NET since I am aware about it. After some thinking, is it possible to make a web-based application using normal website coding but make it work like an application?
Please suggest some method to make a application which is possible to run on all smartphones. What technology or tools can be used for developing it?
The best approach to create truly cross platform app is to use HTML5 and JavaScript. All the other options will be painful. However, of course you can't access all the features with these web applications.
One interesting framework for creating HTML5/JavaScript based apps is PhoneGap (http://www.phonegap.com/). It has quite many API's available and wide support for different platforms. (Note that browser performance varies between devices so make sure not to add too much effects and glitter)
For native apps, there's no that many frameworks but one interesting is MoSync (http://www.mosync.com/)
There can be multiple approaches to create a Cross Smatphone plateform apllication.
If you want to code just once and want to to run on multiple enviroments without any change you must go for some javascript/HTML5 bassed solutions. One that I work with is NGCore. It is a development framework that allows games to be authored in JavaScript but with native application performance by leveraging ngmoco's ngCore libraries.
Other approach that will best suit your needs is to go for a Environment like MonoTouch. Its C# based and AFAIK you can use most of the .net API in MonoDevelope. It lets you reuse most of your code on another environment.