Using Fiddler on a Desktop to capture traffic from Surface WinRT Metro Apps?

[robertob]

Is there any story for configuring a win8 surface RT  device so that all traffic from its modern apps will pass through my dev wks fiddler with remote connections enabled, e.g. similar to setting we can make on windows phones living on same wifi network as dev wks?

[EricLaw]

Have you tried simply changing the WinRT proxy settings to point at your Fiddler desktop? In principle, it should "just work."

 

If you open Desktop IE on WinRT and visit http://DesktopPCWithFiddler:8888/ do you see a "Fiddler echo service" page?

 

In reality, there may be complications.

 

First, if you're at Microsoft or another network using IPsec, you may need to get MSIT to give your desktop an IPsec boundary exemption, so that the device can talk to the desktop PC.

 

Second, you may run into problems with AppContainer Network Restrictions due to the privateNetwork restrictions. To deal with that,

 

  Configure the proxy setting using the Group Policy Editor on the WinRT device

  Step 1: Go in the Search box and type "GPEDIT.MSC" and launch it. The Group Policy Editor window will open.

  Step 2: In the Group Policy Editor Window, open "Computer Configuration > Administrative Template > Network > Network Isolation".

  Step 3: Double-click on "Internet proxy servers for Apps" or click on "Edit Setting".

  Step 4: The "Internet proxy servers for Apps" window will be opened. In this window click on "Enable" and enter the IP/Port address of the Desktop PC running Fiddler in "Domain Proxies". For instance, use 192.168.1.123:8888 if the Fiddler PC's IP is 192.168.1.123 and if you have not changed the port Fiddler listens on. Click "OK"

  Step 5: Restart your computer.

If the Group Policy editor isn't available on WinRT, you may need to use RegEdit to edit the REG_SZ named DomainProxies inside HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation.

Please let me know how it goes.

Thanks!

-Eric

[robertob]

success, here are the exact steps i ended up using

 

1. opened desktop ie and configured the wininet proxy settings the same as what fiddler would do on machine where fiddler was running, except i used the ipV4 address of that machine instead of the 127.0.0.1 loopback address.  

 

2. installed the fiddler root certificate into that machines trusted root ca store by using visiting http://<ipV4 of machine running fiddler>:8888/FiddlerRoot.cer and selecting install certificate | current user | automatic -> place in following store / browse | trusted root certificate authorities

 

3. fiddler | tools | fiddler options | https | skip decryption for the following addresses "wscont.apps.microsoft.com; watson.telemetry.microsoft.comservices.apps.microsoft.com;services.apps.microsoft.com" which i found necessary for things like store app to still function.

 

4. if fiddler running on a machine as member of domain with IPsec policy enabled, which mine is, ensure you have an IPsec policy exclusion in place or temporarily disable it by running "net stop policyagent" being careful to monitor its state as domain policy will come along every so often and restart it on you.

 

For my modern app capture tests i didn't run into appcontainer network restrictions matter so i did not need to try those additional settings you mentioned.

 

[EricLaw]

Awesome, thanks for letting me know. Historically, I haven't had problems with running the Windows App Store through Fiddler, but it's possible that they've done more restrictive things on RT, or changed Win8 at some point after RTM.

[robertob]

Fyi, i've updated my crib notes, derived from your writings and responses on this forum, on using fiddler for win8 and wp8 application debugging captures here to include these surface rt operated win8/winrt app capture details.