Windows App Certification Kit fail Binary analyzer test and supported API test

Question

I tried to package a windows app with release mode, but two tests failed:

1.Binary analyzer failed

Binary analyzer
•Error Found: The binary analyzer test detected the following errors:
  ◦File C:\Program Files\WindowsApps\***_1.0.0.0_x64__2qz35x103g***\clrcompression.dll has failed the AppContainerCheck check.
  ◦File C:\Program Files\WindowsApps\***.MStube_1.0.0.0_x64__2qz35x103g***\clrjit.dll has failed the AppContainerCheck check.  
•Impact if not fixed: If the app doesn’t use the available Windows protections, it can increase the vulnerability of the customer's computer to malware.
•How to fix: Apply the required linker options - SAFESEH, DYNAMICBASE, NXCOMPAT, and APPCONTAINER - when you link the app. See links below for more information:

2. Supported API test failed

•Error Found: The supported APIs test detected the following errors:
◦API RtlCaptureContext in api-ms-win-core-rtlsupport-l1-1-0.dll is not supported for this application type. clrcompression.dll calls this API.
◦API RtlVirtualUnwind in api-ms-win-core-rtlsupport-l1-1-0.dll is not supported for this application type. clrcompression.dll calls this API.
◦API _XcptFilter in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API __C_specific_handler in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API _amsg_exit in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API _initterm in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API free in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API malloc in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API memcpy in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.
◦API memset in msvcrt.dll is not supported for this application type. clrcompression.dll calls this API.

•Impact if not fixed:  Using an API that is not part of the Windows SDK for Windows Store apps violates the Windows Store certification requirements. 

•How to fix:  Review the error messages to identify the API that is not part of the Windows SDK for Windows Store apps. Please note, C++ apps that are built in a debug configuration will fail this test even if it only uses APIs from the Windows SDK for Windows Store apps. See the link below for more information: 
 Alternatives to Windows APIs in Windows Store apps. 

I have no ways to solve them...How to fix the two errors to make sure my application could be packaged correctly?

Thanks.

Greisen

I am using Microsoft.NETCore.UniversalWindowsPlatform 6.1.9 but I still have this issue – Tatro

Answer 1

The "clrjit.dll" should not exist in the output directory (e.g. "bin/x64/Release") or inside appx package for the Store submission.

You need to make sure that:

1. you are submitting Release package, not Debug, and
2. checkbox "Project Properties -> Build -> Compile with .NET Native tool chain" is checked (for Release configuration). This checkbox is saved as UseDotNetNativeToolchain=true in your .csproj file.

Note that "clrcompression.dll" by itself is fine, and will pass certification.

Hope this saves you a few agonizing hours. Downgrading NetCore is not a solution.

Learn

It fails to create pack with this conf <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x86'"> <OutputPath>bin\x86\Release\</OutputPath> <DefineConstants>TRACE;NETFX_CORE;WINDOWS_UWP</DefineConstants> <Optimize>true</Optimize> <NoWarn>;2008</NoWarn> <DebugType>pdbonly</DebugType> <PlatformTarget>x86</PlatformTarget> <UseVSHostingProcess>false</UseVSHostingProcess> <ErrorReport>prompt</ErrorReport> <Prefer32Bit>true</Prefer32Bit> <UseDotNetNativeToolchain>true</UseDotNetNativeToolchain> <AllowUnsafeBlocks>true</AllowUnsafeBlocks> </PropertyGroup> – Tatro

it throws this error when I set UseDotNetNativeToolchain = true Internal compiler error: Specified cast is not valid. – Tatro

I'm using visual studio 2019 community version and I couldn't find the Build option in the project properties. – Fulminate

Answer 2

When I downgrade NetCore.UWP version from 5.2.2 to 5.1.0, the problems with clrcompression.dll disappeared.

Greisen

Me too. It's amazing this is still not fixed. – Neufer

I am using Microsoft.NETCore.UniversalWindowsPlatform 6.1.9 but I still have this issue – Tatro

Answer 3

I also have Microsoft.NETCore.UniversalWindowsPlatform 6.1.9 and having the same issue.

Yes, .net native toolchain is checked. I try x86 and x64 and it doesn't work - my output directory always contains clrjit.dll and clrcompression.dll.

I don't have a reference to EntityFramework in any of my code so I'm not sure that's the problem I'm hitting.

The corefx link above has a link to a new issue in it - https://github.com/dotnet/corefx/issues/30594

Apparently Microsoft.NETCore.Portable.Compatibility is no longer needed with newer versions of Microsoft.NETCore.UniversalWindowsPlatform.

Removing Microsoft.NETCore.Portable.Compatibility has fixed my issue.

Hawley

Answer 4

It's a bug of .NET, see https://github.com/dotnet/corefx/issues/13214 and https://github.com/aspnet/EntityFramework/issues/6905 .

As a workaround, maybe you can build an app package without x64 version.

Snowshoe

Answer 5

Let try to build in Master mode, instead of Release Mode. Release mode is not for App Certification kit or publishing to store.

Dissolve

Answer 6

Loopback flags were indicated as a possible issue. After deactivation, tests still failed.

One of the following references was the real culprit:

Microsoft.VisualStudio.Services.Client
Microsoft.AspNetCore.Mvc.Core
Microsoft.IdentityModel.Clients.ActiveDirectory

There were references to one of these that removed as part of a cleanup.

I believe that the culprit is: Microsoft.VisualStudio.Services.Client

Description from NuGet: Integrate with Azure DevOps Server 2019 and Azure DevOps Services from desktop-based, ASP.NET, and other Windows applications. Provides access to shared platform services such as account, profile, identity, security, and more via public REST APIs.

Posted here as well: https://www.codeproject.com/Answers/5311445/API-istokenrestricted-in-advapi32-dll-is-not-suppo#answer1

Preterit