[Windows Phone 8 Development and Hacking] Sunius1:
Here's the source code I used to pull files out:

using Microsoft.SmartDevice.Connectivity;
using Microsoft.SmartDevice.Connectivity.Wrapper;
using Microsoft.SmartDevice.MultiTargeting.Connectivity;
using Microsoft.VisualStudio.DeviceConnectivity.Interop;
using System;
using System.Collections.Generic;
using System.Globalization;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Text;

namespace WindowsPhoneConnection
{
class Program
{
static void Main(string[] args)
{
var connectivity = new MultiTargetingConnectivity(CultureInfo.CurrentCulture.LCID);
var devices = connectivity.GetConnectableDevices();
var connectableDevice = devices.Single(x => x.Name == "Device");

DeviceObject device;
try
{
device = connectableDevice.Connect() as DeviceObject;
}
catch (Exception e)
{
Console.WriteLine("Failed to connect!");
return;
}

var deviceWrapper = GetField(device, "mDevice") as Device;

var deviceInterface = GetField(deviceWrapper, "mDevice") as ICcDevice;
var conManServer = GetField(deviceWrapper, "mConmanServer") as ConManServer;
var datastoreManager = GetField(deviceWrapper, "mDatastoreManager") as DatastoreManager;
var platform = GetField(deviceWrapper, "mPlatform") as Platform;

var ccConnection = conManServer as ICcConnection;
var ccConnection2 = conManServer as ICcConnection2;
var ccConnection3 = conManServer as ICcConnection3;
var ccConnection4 = conManServer as ICcConnection4;

Array productIds, instanceIds;
ccConnection3.GetInstalledApplicationIDs(out productIds, out instanceIds);

string pathFormat = "%FOLDERID_APPID_ISOROOT%\\{0}\\";
foreach (string productId in productIds)
{
var path = string.Format(pathFormat, productId);
var listing = ((string[])ccConnection4.GetDirectoryListing(path)).ToList();
for (int i = 0; i < listing.Count; i++)
{
listing[i] = Path.Combine(path, listing[i]);
}

while (listing.Count > 0)
{
var dirs = new Queue<string>();

foreach (string fileName in listing)
{
tagFileInfo fileInfo;
ccConnection.GetFileInfo(fileName, out fileInfo);

if (((FileAttributes)fileInfo.m_FileAttributes & FileAttributes.Directory)
== FileAttributes.Directory)
{
dirs.Enqueue(fileName);
}
else
{
var localDir = Path.Combine(@"D:\Downloaded\", Path.GetDirectoryName(fileName));
Directory.CreateDirectory(localDir);
ccConnection.ReceiveFile(fileName, Path.Combine(localDir, Path.GetFileName(fileName)), 2u);
}
}

listing.Clear();
while (dirs.Count > 0)
{
var dir = dirs.Dequeue();
string[] newListing = (string[])ccConnection4.GetDirectoryListing(dir);

if (newListing == null)
{
continue;
}

for (int i = 0; i < newListing.Length; i++)
{
listing.Add(Path.Combine(dir, newListing[i]));
}
}
}
}

var a = 0; // Place breakpoint here
}

static object GetField(object o, string name)
{
var field = o.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic);
return field.GetValue(o);
}
}
}

All the needed assemblies to reference are in their folders at "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\".

By the way, using ICcConnection3 I was able to successfully launch every app that's listed in C:\Windows\System32\Manifests. Lastly, there's also terminate method, with which I was able to kill the start menu :D. Though it starts right back up.