[Windows Phone 7 Development and Hacking] Heathcliff74:
Full Root Access

Hi hackers!

I have not posted much lately. But that doesn't mean that I haven't been hacking ;)

First a little info on the Windows Phone 7 security mechanisms. WP7 RTM has the Developer lock and the policy engine. The developer lock was broken by ChevronWP7 and the policy engine was partly broken by the exploits I created for WP7 Root Tools. NoDo got improved developer locking, but other than that it was unchanged. In Mango there is a third security mechanism: No native code is allowed for unsigned apps.

Today I had a little breakthrough. I have now Root Access on my Samsung Omnia7 with NoDo. You might think that I already had root access, because the WP7 Root Tools work really well. That's true, but I did not have Full root access yet. The main exploit I used was a very complicated work-around. And it was extremely slow. I had to use all kinds of multi-threading tricks to make WP7 Root Tools usable, performance wise. If you would use the native API's that are meant for Filesystem access and Registry access, the system is much faster. But we are not allowed to use those API's. They will usually return error 0x000004ec, which means "Blocked by policy". Also, the native API's provide much more functionality than the exploits I used. Having access to all the native API's also provides new perspectives for future development.

So I started working on the policy engine. See this thread for more info. I got some help from fiinix there. Later on I was contacted by YukiXDA, who was working on a custom ROM for HTC HD2 with Root Access. We combined our knowledge so I could work on a version of WP7 Root Tools that would work on his HD2 ROM. I've been working on that for the last couple of weeks and I'm making good progress now. In the mean time I continued research on the policy engine with a different approach than YukiXDA is using. And now I have found a way to apply root access to selected apps. This was important to me. I didn't want to break down the security of WP7 all together, because that would mean we're back to WM6 with security. And one rogue app could mess up your device or leak all private info to the web. So I wanted to let the user decide which apps he trusts to give root access and which apps should retain in their sandbox. And that's what I got working now! :cool: The security mechanism that Microsoft has implemented for WP7 is actually really cool, but I think they should have made it possible for users to select apps that can break out of the sandbox and apply tweaks to the system. We hackers and tweakers are smart enough to decide that.

To get this working I'm installing some prerequisites. And for that I'm still using Samsung specific exploits at the moment. But I'm quite sure I can get that working for HTC's and LG's too. But that needs a bit more research.

So with Chevron WP7 Labs and this new Root Access we finally have full control over our NoDo devices. But for now, we still can't run native code on Mango yet. But I have a couple of attack-vectors, that I want to try for that. I have good faith that I can defeat that. But before I start working on Mango, I first want to finish the next version of WP7 Root Tools, which will work faster and will also work in HTC HD2 and possibly other devices.

I have had so many requests from people who asked me to share source code of the exploits, that I have decided to create a WP7 Root Tools SDK. This will be released after the next version of WP7 Root Tools. The SDK will contain libraries that allow other apps to get full access to the registry and filesystem. By then everybody can start working on cool backup-apps and tweak-apps, etc.

Will keep you posted on progress of the new version and SDK.

Ciao,

Heathcliff74