yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] fiinix:
HardcoreMode.Activate();

Guess what: "\ROOT\" { PolicyMergex.xml (3,769 Bytes), PolicyMeta.xml (183) }

haha, 3.7 KB :)

Remote CMD Line:

WP7Process p = device.LaunchEXE("PolicyLoader.exe", @"-writedump -nowritedb -dbdump=""\PolicyDump.xml"" ""\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml""");//@"\Windows\PolicyLoader.exe -writedump", "");

xdaa.policy.xml:

<?xml version="1.0" encoding="utf-8"?>
<CeSecurityPolicyFile Description="ExeX security policy" Vendor="Microsoft" RequiredOSVersion="7.00" FileVersion="7.0.7390" xmlns="urn:Microsoft.PlatformBuilder/CeSecurityPolicy">
<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/DF23D303099CEA31D0972CE7BE50888CE813BC98" SpeakerAccountId="S-1-5-112-0-0-1" Description="System Identity Group honors XDAA Code Signing PCA">
<Authorize>
<Match AccountId="S-1-5-112-0-0X01" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/LOADERVERIFIER/GLOBAL/ROUTE_TO_ACCOUNT/(+)/(+)/PRIMARY/WINDOWS/EXEX.EXE" SpeakerAccountId="S-1-5-112-0-0-1" Description="Route ExeX.exe">
<Authorize>
<Match AccountId="S-1-5-112-0-0-1" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/LOADERVERIFIER/GLOBAL/AUTHORIZATION/PE_AUTHZ/NONE/NONE/PRIMARY/WINDOWS/EXEX.EXE" SpeakerAccountId="S-1-5-112-0-0-1" Description="Authorize ExeX.exe be loadable to any chamber">
<Authorize>
<Match AccountId="S-1-5-112-0-0-1" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0X01" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0X13" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0X22" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0X80-0X00000001" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0X80" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
<Match AccountId="S-1-5-112-0-0XFF" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>
</CeSecurityPolicyFile>

Added: "<Match AccountId="S-1-5-112-0-0XFF" AuthorizationIds="LV_ACCESS_LOAD, LV_ACCESS_EXECUTE" />",

because then the code: "if(SID & flag) == SID" (true) (flag: 0xFF, witch means it matches all, aka EVERYBODY)

learned from:

if( ... ) else { stop (everybody) }

<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>

edit:

Notes:

* Before policy apply [SIZE] (\Windows\Security):

- accountdb.vol (132 KB)

- PolicyCommit.xml (1,112 KB) (here we watch)

- policydb.vol (624 KB) (and here)

- PolicyMeta.xml (32 KB)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ok. But look at my xml here. I added the TaskHost-account to the ROUTE_TO_ACCOUNT too. I think you should add it.
[Windows Phone 7 Development and Hacking] fiinix:
That's odd.

while (!p.HasExited())

{

System.Threading.Thread.Sleep(100);

}

var i = p.GetExitCode();

value of i = 259
[Windows Phone 7 Development and Hacking] Heathcliff74:
System Error Codes

ERROR_NO_MORE_ITEMS 259 (0x103) "No more data is available"

It might be possible that the PolicyLoader expects some end-token or -element. But if everything else looks fine, I think it is safe to ignore.
[Windows Phone 7 Development and Hacking] Heathcliff74:
And you could also try to add one of the existing policy.xml-files with "-writedump -nowritedb" and see if that returns the same exitcode.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ok. I see what the problem is. It fails on opening the policy database with error 0x800704ec. Remember that one? Not enough privileges to open the db. We might try to copy the .vol files to our app's isolatedstorage. Then specify that db in the cmdline. Afterwards copy the modified vol back.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hmm. Never mind won't work. For storing the policies always the system policy file is used. Regardless of -pdb option. But I got another idea. Wait a sec...
[Windows Phone 7 Development and Hacking] Heathcliff74:
<PossibleBrickMode>

In HKLM\Security\PolicyEngine are some paths. Copy \windows\security folder and \windows\basepolicy.xml to our isolated storage. Change paths in registry accordingly. Now hopefully it's possible to edit the policies there.

</PossibleBrickMode>
[Windows Phone 7 Development and Hacking] fiinix:
Haha, no more 200+ spam errors (removed "/nowritedb") (emulator so what the hell if it screws up lol) (restart = fixed again =D)

New error (better this time):

It entered "PolicyRuleCreate" HAHA!

PID:0D060096 TID:0D3E00BE \Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml(3,4) : ERROR PolicyXml2011:

PID:0D060096 TID:0D3E00BE Internal error - function failed: PolicyRuleCreate(822083685, 251658240, "/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/DF23D303099CEA31D0972CE7BE50888CE813BC98") (GetLastError = 1260)

PID:0D060096 TID:0D3E00BE

PID:0D060096 TID:0D3E00BE \Windows\Security\policydb.vol : Warning PolicyXml3200:

PID:0D060096 TID:0D3E00BE Policy DB transaction was aborted.

PID:0D060096 TID:0D3E00BE

PID:0D060096 TID:0D3E00BE PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PID:0D060096 TID:0D3E00BE Failed: PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="\Windows\Security\PolicyMeta.xml"), HR=0x800704ec

PID:0D060096 TID:0D3E00BE

PID:0D060096 TID:0D3E00BE PolicyLoader.exe : ERROR PolicyXml0000:

PID:0D060096 TID:0D3E00BE One or more errors were detected during processing.

PID:0D060096 TID:0D3E00BE

edit:

As far as i can see, we have a stack-trace at line "xdaa.policy.xml(3,4) : ERROR PolicyXml2011"
[Windows Phone 7 Development and Hacking] fiinix:
I use emulator, i dont care if i **** that up so hard that it does not start lol :)

edit: Nope :) Jaxbot did that once (test phone), hard reset.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I saw that already in previous post. Plz read my last 3 posts.
[Windows Phone 7 Development and Hacking] Heathcliff74:
0x800704ec is the main problem I think. What Jaxbot did was different. He changed paths to non-existent to see if it would rebuild. I suggest we first copy to our own isostorage and then change registry to point there. We might have enough privs to modify it then.
[Windows Phone 7 Development and Hacking] fiinix:
Yes i do read all post's :)

I have tried to copy that file way to many times (with way to many path's), fails every time tho due Rule:

<Rule
PriorityCategoryId="PRIORITY_HIGH"
ResourceIri="/FILESYS/PRIMARY/WINDOWS/SECURITY/POLICYDB.VOL"
SpeakerAccountId="S-1-5-112-0-0-1"
Description="Protect the policy DB from everyone but the system">
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>

Just some info:

"(Note that regardless of the file policy.vol name given here, the device's built-in Policy database will be used.)"

How come the "PolicyXmlLoadFromDatabase" uses my cmd input file then????? (\Windows\Security\policydb.vol)

Older policy commit':

PID:0DBB004E TID:0DA1004E \Windows\Security\policydb.vol : ERROR PolicyXml2011:

PID:0DBB004E TID:0DA1004E Internal error - function failed: PolicyRuleOpen(805307433) (GetLastError = 1260)

PID:0DBB004E TID:0DA1004E

PID:0DBB004E TID:0DA1004E PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PID:0DBB004E TID:0DA1004E Failed: PolicyXmlLoadFromDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="\Windows\Security\PolicyMeta.xml"), HR=0x800704ec

PID:0DBB004E TID:0DA1004E

edit:

Current state (almost no errors):

(know how to fix a few)

PID:0D0A0102 TID:0D30010A PolicyLoader.exe : Info PolicyXml0000:

PID:0D0A0102 TID:0D30010A PolicyXmlLoadFromXml("\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml")

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A PolicyLoader.exe : Info PolicyXml0000:

PID:0D0A0102 TID:0D30010A PolicyXmlSaveToXml("PolicyMerged.xml", Flags=0x00000035)

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A PolicyLoader.exe : Info PolicyXml0000:

PID:0D0A0102 TID:0D30010A PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="\Windows\Security\PolicyMeta.xml")

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A \Windows\Security\policydb.vol : ERROR PolicyXml2011:

PID:0D0A0102 TID:0D30010A Internal error - function failed: PolicyRuleOpen(805306447) (GetLastError = 1260)

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A \Windows\Security\policydb.vol : Warning PolicyXml3200:

PID:0D0A0102 TID:0D30010A Policy DB transaction was aborted.

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PID:0D0A0102 TID:0D30010A Failed: PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="\Windows\Security\PolicyMeta.xml"), HR=0x800704ec

PID:0D0A0102 TID:0D30010A

PID:0D0A0102 TID:0D30010A PolicyLoader.exe : ERROR PolicyXml0000:

PID:0D0A0102 TID:0D30010A One or more errors were detected during processing.

PID:0D0A0102 TID:0D30010A
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yeah, I understand why policydb is protected. But why is policyloader not elevating itself to TCB? Got to decompile it. I'll be off for the night. Diner with wife and friends. Be back tomorrow. Good luck!
[Windows Phone 7 Development and Hacking] fiinix:
Most of the time we get this (the last error that blocks us from updating policy):

PID:0D0A0102 TID:0D30010A Internal error - function failed: PolicyRuleOpen(805306447) (GetLastError = 1260)

ERROR_ACCESS_DISABLED_BY_POLICY

GetLastError = 1260 (0x4EC)

edit:

fopen("rw") fails for both

"\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\PolicyMeta.xml"

and

"\Windows\Security\PolicyMeta.xml":

May be because of "\Windows\Security\PolicyMeta.xml" is "Protected" and that PolicyLoader is blocked out "\Applications\Install\" (no rights added to access that path (Rule))

PID:0C51007A TID:0C5A007A PolicyLoader.exe : ERROR PolicyXml2050:

PID:0C51007A TID:0C5A007A Unable to open file: FileName="\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\PolicyMeta.xml", opened for write, GetLastError()=1260.

PID:0C51007A TID:0C5A007A

edit 2:

Verified that PolicyLoader is blocked out from accessing \Install: (write mode) (possible read too)

<Rule
PriorityCategoryId="PRIORITY_STANDARD"
ResourceIri="/FILESYS/PRIMARY/APPLICATIONS/INSTALL/(+)/INSTALL/(*)"
SpeakerAccountId="S-1-5-112-0-0-1"
Description="ACL the application installation directory to be read + execute (so resource dlls can be read. This access is required by all who need to read an application's title">
<Authorize>
<Match AccountId="S-1-5-112-0-0X21-0X0000000A" AuthorizationIds="FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, FILE_LIST_DIRECTORY" />
<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="FILE_GENERIC_READ, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_LIST_DIRECTORY" />
</Authorize>
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>

<

__

"Got to decompile it."

- So you know, there is a de-compiled version of it on page 5 :)

Also, have fun :)
[Windows Phone 7 Development and Hacking] fiinix:
OMFG! I DID IT!

> Completed successfully.

Now just hope we can write it to the real policy.vol

Remote CMD used:

var ar = @"/nowritemerged /mdb=""\PolicyMeta.xml"" /pdb=""\policydb.vol"" /adb=""\accountdb.vol""";

PID:0CE60056 TID:0DE30056 PolicyLoader.exe : Info PolicyXml0000:

PID:0CE60056 TID:0DE30056 PolicyXmlSaveToDatabase(P="\policydb.vol", A="\accountdb.vol", M="\PolicyMeta.xml")

PID:0CE60056 TID:0DE30056

PID:0CE60056 TID:0DE30056 PolicyLoader.exe : Info PolicyXml0000:

PID:0CE60056 TID:0DE30056 Completed successfully.

PID:0CE60056 TID:0DE30056

edit:

Seems to work against real policy.vol :)

Re-configured to "\Windows\policydb.vol":

var ar = @"/nowritemerged /mdb=""\PolicyMeta.xml"" /pdb=""\Windows\policydb.vol"" /adb=""\accountdb.vol""";

PID:0CDE0052 TID:0D39005A PolicyXmlSaveToDatabase(P="\Windows\policydb.vol", A="\accountdb.vol", M="\PolicyMeta.xml")

PID:0CDE0052 TID:0D39005A Completed successfully.

PID:0CDE0052 TID:0D39005A

edit 2:

lol'd, thats kind of fail:

Completed successfully

return code still "259"
[Windows Phone 7 Development and Hacking] Heathcliff74:
Weird. Specifying with -pdb does the trick? What you did is actually what I proposed here, but I didn't think it would work, because of this:

If this somehow still doesn't do what we want, we could also try the native database access I mentioned earlier.

I also thought of something else. In the opening post I described that I added a cert to the "Code Integrity" store. But it was a self-signed. And it is possible that there is a check on that. So I should also as the Key Usage and Extended Key Usage for CA and cert-signing and then add this extended cert to the CA store too.
[Windows Phone 7 Development and Hacking] Heathcliff74:
So I assume you're still doing this in the emulator. We should now think of some policies that we can apply so we can test if this really works. I could be something like adding a high priority policy that block access for LPC. If we can't run any apps after we applied that policy, we know it works.
[Windows Phone 7 Development and Hacking] fiinix:
Yes, everything is done in the Emulator, don't want to brick my phone by mistake :)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Try to add this to the emulator:

<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/LOADERVERIFIER/GLOBAL/AUTHORIZATION/PE_AUTHZ/NONE/NONE/PRIMARY/WINDOWS/TASKHOST.EXE" SpeakerAccountId="S-1-5-112-0-0-1" Description="Stop taskhost.exe be loadable to $(TASKHOST_CHAMBER_SID)">
<Stop>
<Match AccountId="S-1-5-112-0-0X80-0X00000001" />
<Match AccountId="S-1-5-112-0-0X80" />
</Stop>

I'm not sure you can apply this, because it may conflict with existing policies and I don't know how that is handled by the PolicyLoader. If you can apply it and you can't run apps anymore afterwards, it means that it worked.

edit: Removed AuthorizationIds from XML, because it is in <Stop> instead of <Authorize> and stop-tags don't have the AuthorizationIds attribute in them.
[Windows Phone 7 Development and Hacking] fiinix:
Got some problems :/

When having no <Rule>'s at all it succeeds

> Complete success.

Having one (the taskhost thing):

Internal error - function failed: PolicyRuleOpen(805307329) (GetLastError = 1260)

May be file system access somewhere. (open as "rwb") (read + write + binary)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ok. Plz try with /pdb=""\Temp\policydb.vol""

edit: You may have to copy the orignal policydb.vol to \Temp\ first. Not sure about that.

edit2: It seems that \Temp\ needs only Standard Privs to write there.
[Windows Phone 7 Development and Hacking] fiinix:
Same error @ PolicyRuleOpen(805307329)

Corrupt database (maybe) when reading the binary, because creating an empty file and binary work that file.

We just have to try harder :)
[Windows Phone 7 Development and Hacking] fiinix:
Definitely more debug data when using "3"

edit:

Or not, just printing double :/ eh what?

/output=3:

PolicyLoader.exe : Info PolicyXml0000:

PolicyLoader.exe : Info PolicyXml0000:

PolicyXmlLoadFromXml("\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml")

PolicyXmlLoadFromXml("\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml")

PolicyLoader.exe : Info PolicyXml0000:

PolicyLoader.exe : Info PolicyXml0000:

PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml")

PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml")

\Windows\Security\policydb.vol : ERROR PolicyXml2011:

\Windows\Security\policydb.vol : ERROR PolicyXml2011:

Internal error - function failed: PolicyRuleOpen(805307329) (GetLastError = 1260)

Internal error - function failed: PolicyRuleOpen(805307329) (GetLastError = 1260)

\Windows\Security\policydb.vol : Warning PolicyXml3200:

\Windows\Security\policydb.vol : Warning PolicyXml3200:

Policy DB transaction was aborted.

Policy DB transaction was aborted.

PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PolicyLoader.exe : FATAL ERROR PolicyXml0000:

Failed: PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml"), HR=0x800704ec

Failed: PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml"), HR=0x800704ec

PolicyLoader.exe : ERROR PolicyXml0000:

PolicyLoader.exe : ERROR PolicyXml0000:

One or more errors were detected during processing.

One or more errors were detected during processing.

/output=1:

PolicyLoader.exe : Info PolicyXml0000:

PolicyXmlLoadFromXml("\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml")

PolicyLoader.exe : Info PolicyXml0000:

PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml")

\Windows\Security\policydb.vol : ERROR PolicyXml2011:

Internal error - function failed: PolicyRuleOpen(805307329) (GetLastError = 1260)

\Windows\Security\policydb.vol : Warning PolicyXml3200:

Policy DB transaction was aborted.

PolicyLoader.exe : FATAL ERROR PolicyXml0000:

Failed: PolicyXmlSaveToDatabase(P="\Windows\Security\policydb.vol", A="\Windows\Security\accountdb.vol", M="PolicyMeta.xml"), HR=0x800704ec

PolicyLoader.exe : ERROR PolicyXml0000:

One or more errors were detected during processing.
[Windows Phone 7 Development and Hacking] fiinix:
mfw i did "/verbosity=5"

ExeName "\Windows\PolicyLoader.exe"

Arg 0: "" "\Windows\PolicyLoader.exe"

Arg 1: "nowritemerged" ""

Arg 2: "verbosity" "5"

Arg 3: "nowritedb" ""

Arg 4: "pdb" "\Windows\Security\policydb.vol"

Arg 5: "adb" "\Windows\Security\accountdb.vol"

Arg 6: "" "\Windows\D62F1CFD-4536-4A6F-BC6B-84A89DB28CC1.policy.xml"

Dump - After Args::Reset():

Arg bWantHelp = false

Arg sAdbFile = cesecurity.vol

Arg bAdbFileSet = false

Arg sPdbFile = policy.vol

Arg bPdbFileSet = false

Arg sMdbFile = PolicyMeta.xml

Arg bMdbFileSet = false

Arg sMergedXml = PolicyMerged.xml

Arg bMergedXmlSet = false

Arg sOldPolicyXml =

Arg bOldPolicyXmlSet = false

Arg sNewPolicyXml =

Arg bNewPolicyXmlSet = false

Arg sDbDumpXml = PolicyDump.xml

Arg bDbDumpXmlSet = false

Arg bCanonicalizeMerged = false

Arg bCanonicalizeMergedSet = false

Arg bExpandMacrosMerged = false

Arg bExpandMacrosMergedSet = false

Arg bWriteDb = true

Arg bWriteDbSet = false

Arg bWriteMerged = true

Arg bWriteMergedSet = false

Arg bWriteDump = false

Arg bWriteDumpSet = false

Arg bUpdateDatabase = false

Dump - After Args::Parse(clp):

Arg bWantHelp = false

Arg sAdbFile = \Windows\Security\accountdb.vol

Arg bAdbFileSet = true

Arg sPdbFile = \Windows\Security\policydb.vol

Arg bPdbFileSet = true

Arg sMdbFile = PolicyMeta.xml

Arg bMdbFileSet = false

Arg sMergedXml = PolicyMerged.xml

Arg bMergedXmlSet = false

Arg sOldPolicyXml =

Arg bOldPolicyXmlSet = false

Arg sNewPolicyXml =

Arg bNewPolicyXmlSet = false

Arg sDbDumpXml = PolicyDump.xml

Arg bDbDumpXmlSet = false

Arg bCanonicalizeMerged = false

Arg bCanonicalizeMergedSet = false

Arg bExpandMacrosMerged = false

Arg bExpandMacrosMergedSet = false

Arg bWriteDb = false

Arg bWriteDbSet = true

Arg bWriteMerged = false

Arg bWriteMergedSet = true

Arg bWriteDump = false

Arg bWriteDumpSet = false

Arg bUpdateDatabase = false

Arg xmlInputFiles[0] = \Windows\D62F1CFD-4536-4A6F-BC6B-84A89DB28CC1.policy.xml

PolicyXmlCreate()

PolicyXmlLoadFromXml("\Windows\D62F1CFD-4536-4A6F-BC6B-84A89DB28CC1.policy.xml")

PolicyXmlDestroy()

Completed successfully.
[Windows Phone 7 Development and Hacking] Heathcliff74:
So adding an existing policy file doesn't return an error. Probably, because nothing is changed by applying these policies and nothing got written to the database.

I dumped and fixed the ARM versions of these files:

PolicyLoader.exe

PolicyEngine.dll

PolicyXml.dll

iri.dll

CoreDll.dll

I loaded them into IDA pro. Looking at strings, imports and exports. No calls to CeImperonateToken() or CeImpersonateProcess(). But I think the PolicyLoader process should already be running under TCB, because it's a ROM-module. So I really don't get the 1260/0x4ec/0x800704ec "Blocked by policy" errors.

When you tried \Temp\Policydb.vol, did you first copy the original Policydb.vol to the \temp folder?
[Windows Phone 7 Development and Hacking] fiinix:
"did you first copy the original Policydb.vol to the \temp folder?"

I'm on the Emulator (how to copy there) :/

Without it i cant see if there were no errors/success.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hmmm. Does look like PolicyEngine.dll does call CeImpersonateCurrentProcess() after all. And it looks up account "S-1-5-112-0-0-0", which is "TEMPLATE_USER_NAME". But what is that? Is it impersonation the current user? Is that the account of the calling process?

I do have a lead on how to invoke an exe with TCB privs. It's a Samsung exploit. But ATM I don't dare to try is, because I might brick it.

I was planning to backup some stuff and do a firmware upgrade one of these days. So maybe I can test it then.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I will also look into native database access to insert our own policies.
[Windows Phone 7 Development and Hacking] fiinix:
Seems like kernel level (S-1-5-112-0-0-0).

<Rule
PriorityCategoryId="PRIORITY_HIGH"
ResourceIri="/RESOURCES/(MATCH-CHAMBER)/(*)"
SpeakerAccountId="S-1-5-112-0-0-1"
Description="All chambers have access to their resources">
<Authorize>
<Match AccountId="S-1-5-112-0-0-0" AuthorizationIds="SCHEDULE_GENERIC_ACCESS, SCHEDULE_CREATE_PERSISTENT, SCHEDULE_ALL_ACCESS, MESSAGE_SEND, MESSAGE_RECEIVE, PROCESS_QUERY_INFORMATION, PROCESS_DUP_HANDLE, GENERIC_READ, GENERIC_WRITE, GENERIC_EXECUTE, GENERIC_ALL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE, STANDARD_RIGHTS_REQUIRED, SPECIFIC_RIGHTS_ALL, ALL_ACCESS" />
</Authorize>
</Rule>

<Rule
PriorityCategoryId="PRIORITY_HIGH"
ResourceIri="/KERNEL/(+)/(MATCH-CHAMBER)/(*)"
SpeakerAccountId="S-1-5-112-0-0-1"
Description="All chambers have access to their own kernel objects">
<Authorize>
<Match AccountId="S-1-5-112-0-0-0" AuthorizationIds="GENERIC_READ, GENERIC_WRITE, GENERIC_EXECUTE, GENERIC_ALL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE, STANDARD_RIGHTS_REQUIRED, SPECIFIC_RIGHTS_ALL, ALL_ACCESS" />
</Authorize>
</Rule>

<Rule
PriorityCategoryId="PRIORITY_LOW"
ResourceIri="/LOADERVERIFIER/ACCOUNT/(MATCH-CHAMBER)/ACCOUNT_CAN_LAUNCH/(+)/(+)"
SpeakerAccountId="S-1-5-112-0-0-1"
Description="Allow every Chamber try to load non-rom exe into its own Chamber, if not blocked by other policies">
<Authorize>
<Match AccountId="S-1-5-112-0-0-0" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

.
[Windows Phone 7 Development and Hacking] fiinix:
WP7Process p = device.LaunchEXE("ToggleDog.exe", "/Off" OR "/On"); (IDA Pro)

It added HKLM\Services\Watchdog\Enabled = 0

ASM findings:

ToggleDog: Disabling OR Enabling watchdog. Please reboot.

Is it really disabling the watchdog?

Wierd :/
[Windows Phone 7 Development and Hacking] Heathcliff74:
PolicyEngine is not even used by PolicyLoader. It only uses PolicyXml and CodeDll. PolicyXml doesn't import PolicyEngine either.

WHY DOESN'T POLICYLOADER HAVE ENOUGH PRIVS TO ACCESS THE POLICYDB WHEN WE RUN IT?

Next up: Look for references to PolicyLoader and see if I can find anything special on how it is called.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Well, that was a quick search. No references to PolicyLoader.exe found anywhere :confused:
[Windows Phone 7 Development and Hacking] fiinix:
Damn you Microsoft :/ lol

edit:

I think its called by kernel in this way:

int ROMAddress = 0x.....

(*(void (**)(void))ROMAddress)();

Yes, i know its cancer, but its valid C.