[Windows Phone 7 Development and Hacking] fiinix:
Dump-time!

edit: Added ".c" source code file in attachment.

So, i had this de-compiled "PolicyLoader.exe" (\Windows), and now when i opened it in notepad once again i detected this (call arguments help aka ".exe /?")

Oh, Microsofties, you did not see this one coming, did you.

Modify policy rights.

System: S-1-5-112-0-0X00

My idea:

LEAST_PRIVILEGE_CHAMBER_GROUP_NAME: S-1-5-112-0-0X80

Modify to:

LEAST_PRIVILEGE_CHAMBER_GROUP_NAME S-1-5-112-0-0X00

=> <Macro Id="SYSTEM_CHAMBER_GROUP_NAME" Description="TCB Chamber Group" Value="S-1-5-112-0-0X00" />

RAW:

info: sub_15339 is "printf"

sub_15339(1, &dword_1103C);
sub_1539C(1, (int)L"%s:", (unsigned int)L"PolicyLoader.exe");
sub_15339(1, &dword_1103C);
sub_15339(1, L" Tool for reading and writing CE Policy and Account databases.");
sub_15339(1, &dword_1103C);
sub_15339(1, L"Syntax:");
sub_15339(1, &dword_1103C);
sub_1539C(1, (int)L" %s <flags> @<response file name> <XML policy file names...>", (unsigned int)L"PolicyLoader.exe");
sub_15339(1, &dword_1103C);
sub_15339(1, L" Flags begin with '/' or '-'. Specify the '@' character followed by a file");
sub_15339(1, L" name to read additional parameters from the specified response file. Any");
sub_15339(1, L" parameter that does not begin with '/', '-', or '@' is treated as the name of");
sub_15339(1, L" an XML policy file that should be loaded.");
sub_15339(1, &dword_1103C);
sub_15339(1, L" Values for flags are specified as -flag=value or -flag:value. Quotes may be");
sub_15339(1, L" used if the value contains spaces, e.g. -flag=\"value with spaces\".");
sub_15339(1, &dword_1103C);
sub_15339(1, L"Sequence of operation:");
sub_15339(1, &dword_1103C);
sub_15339(1, L" - Load any XML policy files specified.");
sub_15339(1, L" - Merge the XML files.");
sub_15339(1, L" - Optionally write a merged XML policy file. (Enabled by default.)");
sub_15339(1, L" - Optionally add the loaded data to the Policy and Account databases.");
sub_15339(1, L" (Enabled by default.)");
sub_15339(1, L" - Optionally load all data from the Policy and Account databases and dump");
sub_15339(1, L" the data to an XML policy file. (Disabled by default.)");
sub_15339(1, &dword_1103C);
sub_15339(1, L"Flags:");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -verbosity=Verbosity (abbreviation: -v)");
sub_1539C(1, (int)L" Specifies the detail of logging. Valid values are between %u and %u. Set -v=%u", 1);
sub_1539C(1, (int)L" to only display errors, -v=%u to display errors and warnings, -v=%u to include", 2);
sub_1539C(1, (int)L" informational status messages, -v=%u for verbose status, and -v=%u for", 4);
sub_1539C(1, (int)L" additional debug output. Default is -v=%u.", 3);
sub_15339(1, &dword_1103C);
sub_15339(1, L" -output=Devices (abbreviation: -o)");
sub_1539C(1, (int)L" Specifies the output device(s) for logging. Valid values are between %u and", 1);
sub_1539C(1, (int)L" %u. Set -o=%u to log to the standard output stream, -o=%u to log to the debug", 3);
sub_1539C(1, (int)L" stream, and -o=%u to log to both. Default is -o=%u.", 3);
sub_15339(1, &dword_1103C);
sub_15339(1, L" -merged=FileName (abbreviation: -mer)");
sub_15339(1, L" Specifies the name of the Merged policy XML file to be written. Default is");
sub_1539C(1, (int)L" \"%s\".", (unsigned int)L"PolicyMerged.xml");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -nowritemerged (abbreviation: -nme)");
sub_15339(1, L" Specifies that the Merged policy XML file should not be written. Default is");
sub_15339(1, L" to write the Merged policy XML file.");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -expandmacros (abbreviation: -exp)");
sub_15339(1, L" Specifies that macro references should be expanded when writing the Merged");
sub_15339(1, L" policy XML file. Default is to not expand macros. Note that if macros are to");
sub_15339(1, L" be expanded, all referenced macros must be defined in one of the loaded XML");
sub_15339(1, L" policy files.");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -canonicalize (abbreviation: -can)");
sub_15339(1, L" Specifies that all identifiers should be canonicalized when writing the");
sub_15339(1, L" Merged policy XML file. Default is to not canonicalize. Note that if");
sub_15339(1, L" canonicalization is enabled, macros will always be expanded.");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -adb=FileName");
sub_15339(1, L" Specifies the name to display for the Account database file in diagnostic");
sub_1539C(
1,
(int)L" messages. Default is \"%s\". (Note that regardless of the file ",
(unsigned int)L"cesecurity.vol");
sub_15339(1, L" name given here, the device's built-in Account database will be used.)");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -pdb=FileName");
sub_15339(1, L" Specifies the name to display for the Policy database file in diagnostic");
sub_1539C(1, (int)L" messages. Default is \"%s\". (Note that regardless of the file ", (unsigned int)L"policy.vol");
sub_15339(1, L" name given here, the device's built-in Policy database will be used.)");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -mdb=FileName");
sub_1539C(
1,
(int)L" Specifies the name of the Metadata XML file. Default is \"%s\".",
(unsigned int)L"PolicyMeta.xml");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -nowritedb (abbreviation: -ndb)");
sub_15339(1, L" Specifies that the loaded data should not be added to the Account database,");
sub_15339(1, L" Policy database, and Metadata XML file. Default is to add the data.");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -dbdump=FileName (abbreviation: -dmp)");
sub_15339(1, L" Specifies the name of the XML policy file to which all data should be");
sub_1539C(1, (int)L" dumped. Default is \"%s\".", (unsigned int)L"PolicyDump.xml");
sub_15339(1, &dword_1103C);
sub_15339(1, L" -writedump (abbreviation: -wdmp)");
sub_15339(1, L" Specifies that all data from the Account database, Policy database, and");
sub_15339(1, L" Metadata XML file should be loaded, merged, and dumped to an XML policy");
sub_15339(1, L" file. Default is to not dump the data.");
sub_15339(1, &dword_1103C);
return sub_15BEE();

__

Humanized:

I can not guaranty that the "int" values are "printf" corrected.

PolicyLoader.exe

Tool for reading and writing CE Policy and Account databases.

Syntax:

PolicyLoader.exe <flags> @<response file name> <XML policy file names...>

Flags begin with '/' or '-'. Specify the '@' character followed by a file");
name to read additional parameters from the specified response file. Any");
parameter that does not begin with '/', '-', or '@' is treated as the name of");
an XML policy file that should be loaded.

Values for flags are specified as -flag=value or -flag:value. Quotes may be used if the value contains spaces, e.g. -flag="value with spaces".

Sequence of operation:

- Load any XML policy files specified.
- Merge the XML files.
- Optionally write a merged XML policy file. (Enabled by default.)
- Optionally add the loaded data to the Policy and Account databases.(Enabled by default.)
- Optionally load all data from the Policy and Account databases and dump; the data to an XML policy file. (Disabled by default.)

Flags:

-verbosity=Verbosity (abbreviation: -v)
Specifies the detail of logging. Valid values are between 1 and 4. Set -v=1 to only display errors, -v=2 to display errors and warnings, -v=2 to include informational status messages, -v=4 for verbose status, and -v=4 for additional debug output. Default is -v=3.

-output=Devices (abbreviation: -o)
Specifies the output device(s) for logging. Valid values are between 1 and 3.
Set -o=1 to log to the standard output stream, -o=3 to log to the debug stream, and -o=2 to log to both. Default is -o=3.

-merged=FileName (abbreviation: -mer)
Specifies the name of the Merged policy XML file to be written. Default is PolicyMerged.xml

-nowritemerged (abbreviation: -nme)
Specifies that the Merged policy XML file should not be written. Default is to write the Merged policy XML file.

-expandmacros (abbreviation: -exp)
Specifies that macro references should be expanded when writing the Merged policy XML file. Default is to not expand macros. Note that if macros are to be expanded, all referenced macros must be defined in one of the loaded XML policy files.

-canonicalize (abbreviation: -can)
Specifies that all identifiers should be canonicalized when writing the Merged policy XML file. Default is to not canonicalize. Note that if canonicalization is enabled, macros will always be expanded.

-adb=FileName
Specifies the name to display for the Account database file in diagnostic messages. Default is "cesecurity.vol". (Note that regardless of the file cesecurity.vol name given here, the device's built-in Account database will be used.)

-pdb=FileName");
Specifies the name to display for the Policy database file in diagnostic messages. Default is "policy.vol". (Note that regardless of the file policy.vol name given here, the device's built-in Policy database will be used.)

-mdb=FileName");
Specifies the name of the Metadata XML file. Default is "PolicyMeta.xml.

-nowritedb (abbreviation: -ndb)
Specifies that the loaded data should not be added to the Account database, Policy database, and Metadata XML file. Default is to add the data.

-dbdump=FileName (abbreviation: -dmp)");
Specifies the name of the XML policy file to which all data should be dumped. Default is "PolicyDump.xml.

-writedump (abbreviation: -wdmp)");
Specifies that all data from the Account database, Policy database, and Metadata XML file should be loaded, merged, and dumped to an XML policy file. Default is to not dump the data.

return sub_15BEE();

We cant modify it except we are system, so using leaked ROOT dll's are still blocked to access the file. Thats where PolicyLoader.exe etc comes in.

<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/FILESYS/PRIMARY/WINDOWS/SECURITY/POLICYDB.VOL" SpeakerAccountId="S-1-5-112-0-0-1" Description="Protect the policy DB from everyone but the system">
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>