yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] fiinix:
Ok, makes totally sense for me too, because every time i searched something relevant to PolicyLoader.exe, nothing popped up.

It almost seems its running on first boot (aren't there a pre "policy.vol" installed from manufacturer?, if so, then policyLoader.exe is just a miss?) (Emulator has a pre accountdb.vol and policydb.vol).

But there is something strange about this exe;

why does it even exist?

> programmed (by Microsoft) that takes a lot of time.

> being compiled

> packed to manufactures (all?)

> and last, not even being used at all?!?

I do see future secrets in this tool.

All your 1, 2, 3, 4; very informative :)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yeah, well, it is still possible that it is being used. Launched from somewhere in the bootloader sequence. The preinstalled databases you talk about is kinda what I meant with Platform Builder. Ie, the PolicyLoader might be run during some kind of winpe initialization mode (Windows Preinstalled Environment).

I also looked into the native database access, because it might be useful for other purposes too, like pacman.edb, pimindex.vol, etc. That API was present in previous versions of WinMo. Looking at some sample-code, I think it isn't too hard to use this API. So I might write a managed wrapper for this. One thing I'm afraid of though; the possibilities I outlined all depend on the possibility that I can write a modified database back to the original location. Although I do have enough privileges to do that, I'm still afraid that the databases are "in use". And files that are "in use" might not be possible to overwrite. On the other hand, they are databases, and therefore probably opened in "shared mode". I'll try to make a test for this and ask Jaxbot, if he can test it on his test-device.
[Windows Phone 7 Development and Hacking] fiinix:
I will PM you the whole Samsung Omnia 7 update sniffed packages (Omnia 7 Update 7008-7390) (Wireshark) (binary/HEX reader is good reading it to).

Yes, i did sniff the whole update lol (before, not today) (Gotta catch em all!)

This helps us/me hack the system (havent looked so much in the packages, but it CONTAINS new policy data, meaning the tool is used somewhere)

Samlpes:

- 24A8D3BF-3337-478b-988A-1BB2BEC11EA1.policy.xml

- 8C9C0C34-B77D-45FB-9E4E-D53AC5900244.policy.xml

- c7a3d8a1-73a0-4245-b11d-48e40e8dd4b1.policy.xml

....

......

* So, yes, there are alot of them.

When updating, the device goes in to a special mode right? Zune sends an update and the phone installs.

Maybe the update manager uses it?

Why would we not be available to use it?

It runs well under normal mode.
[Windows Phone 7 Development and Hacking] Heathcliff74:
It "runs", because it is a rom-module. I saw a policy for that, but I don't remember exactly. All rom-modules have access to execute. But it doesn't have any additional privileges, because there are no policies defined for PolicyLoader.exe.

Something else. I read a document a long time ago. I just came across it again. And reading it now gives the document a whole new perspective. Get it here. Very interesting.
[Windows Phone 7 Development and Hacking] fiinix:
I'w seen this one before (i did not read serious), and i always lol so hard when i see "Microsoft

Confidential

. For discussion purposes only.", this seems legit :)

"Increased security and robustness" (Page 5)

> I certainly do say it is secure.....

edit:

Seem 100% that is used somewhere (Page 25):

* Policy Loader: Populates the Policy Database and Account Database from Policy XML

* Policy Engine: Service providing APIs for making policy decisions

edit 2:

"Microsoft, Your potential, Our passion (to block you out, we are rulers of what can run and not)"

> They forgot the last part
[Windows Phone 7 Development and Hacking] timmymarsh:
Thread cleaned, any off topic posting will be deleted.

Greetz.
[Windows Phone 7 Development and Hacking] walshieau:
PolicyLoader.exe is called in two places.

Being the SLDR when a "valid" update is passed to the phone to install, PolicyLoader can modify exiting policies etc

Cold Boot (first run).

Apart from that, it isn't used anywhere in the running of CE from what I've found.
[Windows Phone 7 Development and Hacking] XeKToReX:
So good to see you guys putting in all this effort! Keep it up!

One of the most interesting reads about WP7 I've had
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yeah, I suspected that. Thanks for confirming. :)

I'm still working on a couple of angles. I will report back when I got something.

Thanks :)
[Windows Phone 7 Development and Hacking] surrender420:
Sooooo curious!
[Windows Phone 7 Development and Hacking] futuro82:
When DFRouter running on my htc hd7 ?

I'm waiting for connection and yse my phone as modem
[Windows Phone 7 Development and Hacking] rudelm:
I tried writing to that specific path from within a normal c# app with a StreamWriter and without using the IsolatedStorage. I'm always getting the System.MethodAccessException

Of course we could try to use an OEM DLL but I thought this folder is writable to "everybody"? Or is it only possible if the app is running from SRC instead from inside the LPC?
[Windows Phone 7 Development and Hacking] Heathcliff74:
The write-method is not accessible from outside the .Net framework itself. The method is tagged with something like [SecureMethod] or something. Hence the MethodAccessException. It is not a FileAccessException. The location should be accessible for Everyone, withou hacking, so also for LPC. What you need to is go C++ (native code). Use the native Filesystem API's and call that with com-interop (use NoDo, because interop is disabled in Mango).

Ciao,

Heathcliff74.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I did more testing to get my approach for launching native executables to work. So far, no success :mad:

This is what I did:

I created a function that gets a list of all running processes (to verify if my executable is running).

I created a new set of cert/key for code-signing.

I created a new executable called "Test.exe". It only contains Sleep(INFINITE).

I copied the "Test.exe" to "\Windows"

I signed the executable with my private key.

I stored the cert in the "CA" store and in the "Code Integrity" store.

I added a policy that allows LPC apps to launch "Test.exe".

I added a policy that routes "Test.exe" to TCB.

I added a policy that allows TCB to load and execute files signed with my signature.

I added a policy that allows TCB to load and execute "Test.exe".

I created an app that tries to launch "\Windows\Test.exe", wait for 5 seconds and then requests the running processes-list to see if "Test.exe" shows up.

Unfortunately the call to CreateProcess() fails with error 0x4ec = "Blocked by policy". The problem is not that I don't have enough access to call CreateProcess(), because I have rooted my Samsung Omnia 7 and I can launch ANY other executable on my device. The problem is that I'm still missing some policies, specifically for my certificate or my executable.

WHAT AM I MISSING?

I have to think this over.......

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] marsrogers:
I dug this thread out because I am now faced with the problem.

I have a changeusbprofile.exe which is a toggle to enable video out feature on WP7 devices. The exe has been already signed by a ms because I have this out of a ASUS E600 WP7 developer device.

Check here, skip the dcTNONE_analogtv.dll part, that's for DLNA.

http://xdaforums.com/showthread.php?t=1352019
[Windows Phone 7 Development and Hacking] GoodDayToDie:
OK, minor update to the above:

The policy database (\Windows\Security\policydb.vol) is held open with an exclusive lock, as expected. However, this doesn't prevent accessing it with the CE DB functions (permissions permitting of course, which for me they do).

A few catches, though:

* The file is just a database *volume* - the actual database (the thing you call an OpenDatabase function on) is inside it. The volume in question has three of them (DBTRANSACTIONTABLE | PatternDBBloomFilter | PatternDBmultimap).

* The database appears to be a CEDB (legacy), not the modern EDB. At least, if I try and get the volume's GUID (mount the database) using OPEN_EXISTING with the legacy function, it works. If I try to use the EDB variant, or also pass the flag that makes the legacy one work like the EDB variant, I get 0x80070020 (HRESULT for ERROR_SHARING_VIOLATION).

* Since it's a legacy database, make sure you use the legacy functionality. Many of the new functions actually appear to work, if you pass the legacy version flags. If you use the version flag that it tells you to use (2 instead of 1) then you'll get ERROR_INVALID_PARAMETER. It's probably best, though, to just not define EDB and live with the warning for using a deprecated function.

* If you do want to use the EDB functions, don't just try including <windbase_edb.h>. This made the linker fail. If you define EDB and then include <windbase.h> you'll get <windbase_edb.h> as well, automatically.

EDIT: It gets better. The CEDB docs are somewhere between incomplete and wrong (they will occasionally either fail to specify critical operations, or imply that you should do something which you actually shouldn't)! The EDB docs are much more accurate, and have a "Remaks" section that contains essentially a changelog from CEDB - reverse it and apply those changes to your CEDB calls. Finally, if you define EDB, you may get results which are quite simply wrong even if the function appears to work. Just put up with the warnings (or suppress them) and don't define EDB - you'll save yourself some hassle.

I'll share the source code (it'll be a new version of the native code for the HtcRoot native code) soon, once I've learned a bit more and cleaned up some debug stuff. I really should refactor that out into its own class, but that would actually take time...
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Ugh, the policy database records are pretty opaque.

There are ~3000 of them (3262 on my phone).

Each one, so far as I've seen yet, has 4 properties, and a size between 100 and 400 bytes.

The first property is a filetime (or possibly just a longlong, there only 8-byte primitive type directly supported is Double). It's value is typically in excess of 0x8000000000000000, and the value of each byte is all over the place. Maybe it really is a filetime? Haven't tried converting it yet.

The second property is a binary blob. It's typically 64-320 bytes in length (pretty variable, though). No idea what's in it.

The third property is also a binary blob, but usually shorter (40-80 bytes).

The fourth property is anothr filetime. This one might be a special value, though; the high-order DWORD seems to always be at least 0xFFFFFF00.

I doubt I'll be able to interpret these unassisted. Time to go examine the way the policy engine works...

I've attached some source to this. It's a mess because currently it's basically just a bunch of tests strung together - I'll organize it out and put it behind proper COM APIs later. Also, apparently the longest part of running the test is marshalling a 2048-byte string into managed code (which seems odd; I've have expected that to be mostly just memory copy operations - it should be much less than a million clock cycles for the CPU, so it should take less than a milisecond - but it'll actually make my phone stutter music playback for a second or so!)

Oh FFS xda, you'll accept a .C or .H file but not a .CPP?!? Be that way...

The relevant code is in TestDatabase (), a helper function near the bottom.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Breakthrough!

Today I will change the topic title from "Status: Not possible >YET<" to "Status: Possible!".

On Custom ROMs with Full Unlock it was already possible to run homebrew executables. For stock ROMs with Interop Unlock there is WP7 Root Tools which allows Policy Unlock for Silverlight applications. But running homebrew executables like Opera Mini was still not possible.

But now I've found a way to unlock homebrew executables using policies and certificates. I need to do more research before I can implement this unlock in WP7 Root Tools, because the unlock currently still needs some manual actions. But I know it's possible now, because I have it working.

I will keep you updated on the progress for implementing this in WP7 Root Tools.

I have to thank Cotulla for helping me find a stupid mistake I made! His incredible knowledge helped me see why I thought it was not working yet :D

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] snickler:
You guys are brilliant!
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Oooh, gotta admit, I'm curious. I've been working on this as well, and haven't gotten it yet - even for built-in apps lifted from the ROM and then written back over the ROM file, whether or not I signed them with a cert I had added to my phone.

That said, well done!! Acknowledging your desire to tool-ify this within Root Tools, any info you can share that may let us begin building things using this would be great...
[Windows Phone 7 Development and Hacking] sensboston:
Great! Looking forward for release. And "yes", Cotulla is a great guy with a really good knowledge :)
[Windows Phone 7 Development and Hacking] Cotulla:
Great!

I won't tell to anyone :D
[Windows Phone 7 Development and Hacking] Jaxbot:
Fascinating... this could really make life a lot easier :p

I'll keep tabs on this; it's unfortunate that all the exciting stuff happens while I'm on my forced work absences. That being said, good job!

How exactly does this work, though? Could this allow us to run unsigned DLLs, too, as drivers? Or just execute EXEs?
[Windows Phone 7 Development and Hacking] Heathcliff74:
I'm still testing a few things. I'm not sure yet how I want to implement this. I'm thinking of simply unlocking all unsigned native executables at once, but I'm not sure that will work yet. If not, I can also add a "Mark trusted" context item for executables in the file-explorer, and executables in an application-install-folder can be unlocked when marking the app as trusted.

It was really stupid. I had it already working, but I didn't see it. The reason that I didn't see it was that I accidentally replaced my test.exe with another test.exe which only had Sleep(-1) in it, LOL! I had about 20 test.exe's floating around, so I cleaned that up a bit. But before we found out about the mistake I made we were going through kernel logs etc. But we couldn't find what was going wrong... because it was already working.

Oh. No problem, haha. Even I make mistakes sometimes :p:rolleyes: The positive thing about that for me was that I learned some new things from you :)

You could already install new drivers if you call the right api's. The problem is that you could only let them run in Elevated Rights Chamber. Not in TCB. Because there is a hard-coded rule in the policy engine that every binary that is loaded into TCB must be properly signed. But I already had an exploit for that, because I'm already letting Homebrew Silverlight apps run in TCB with the current version of WP7 Root Tools. I could apply the same hack for drivers. But if you really just want to run a background "service", I think the easiest thing is just to run an executable at startup. You can add a shortcut to the executable in \Windows\Startup and you're done. With the next version of WP7 Root Tools that should be possible.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] huismeester:
Good work Heatcliff74 and yes Cotulla is a master :)
[Windows Phone 7 Development and Hacking] BigJeff:
YESSSS this is what I've been hoping for! Root Tools 1.0 come on baby! Devs start cooking up some sweet homebrew apps :) Will this allow for other browsers and things of those nature? Or like a full file browser/downloader? Man I'm excited for these great things to come :D GO HEATHCLIFF AND COTULLA!!!
[Windows Phone 7 Development and Hacking] Nickg.:
Congratulation! This is very great thing, now the gap from custom Rom is almost null!

The possibilty to install other driver will allow several new hack
[Windows Phone 7 Development and Hacking] indiekiduk:
does this mean windows phone has finally been jailbroken?
[Windows Phone 7 Development and Hacking] Rosemberg91:
This will allow personalization as a new hack?
[Windows Phone 7 Development and Hacking] sensboston:
No, it doesn't. It only means: some "hackable" handsets (supported by Root Tools) will have ability to run native WinCE executables. But of course not all: there are a lot of other restrictions like a missing GUI libraries, missing API etc. and so on. Don't expect to have any WinMo app running on your policy-unlocked phone.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ehhhm. Many WP7 devices have been jailbroken. The RTM version of WP7 was jailbroken by the ChevronWP7 team. Back then, with that unlock, almost anything was possible.

But WP7 is not the same as iOS or Android. Android can be unlocked by changing the available source code and recompile it. With iPhones, there is only one OEM: Apple. That, and the fact that Apple doesn't know how to protect their OS, makes it a lot easier to hack it.

WP7 is very well protected by Microsoft and the OEM's. Exploits need to be found in the bootloader, Microsoft code or OEM code. Most WP7 devices have been hacked one way or the other. But in most cases, the vulnerabilities have been fixed in the most recent versions by MSFT and the OEM's. And everytime an vulnerability is fixed we need to find new exploits. So generally, you should not update your phone unless you really need to.

This new unlock will not unlock devices that previously could not be unlocked. This only brings more possibilities to devices that could already be Policy Unlocked before.

You can customize your WP7 device to some degree. There are homebrew tools for that. This new unlock does not really give more possibikities for customization.

The main reason I've been working on this, is that I want to have a good understanding of the pokicy system in WP7 and this unlock allows all types of background tasks and services, like native debugging, improved remote filesystem and registry access, etc.

Currently I'm working on 3 projects:

- New features for WP7 Root Tools.

- Unlock new HTC's and NOKIA's (no ETA!!!)

- Policy Unlock for Homebrew Executables (this project)

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] huismeester:
Hi heatcliff i hope so for the lumia 900 my fingers are crost :D
[Windows Phone 7 Development and Hacking] IzaacJ:
This could prove very useful. The implemented background service is not as near as good as it could be, that due to the restrictions Microsoft has put in.

But will it be possible for an exe to create and update a Live tile more often than a regular XAP, so it could be possible to create a real clock tile with seconds and everything? :)

Regards

Izaac
[Windows Phone 7 Development and Hacking] BigJeff:
You didn't put a "no ETA" on this project, just saying ;)
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Creating a live tile should be totally possible; we already know the API for that. Doing it in a way that won't wreck the battery life will take careful work, but is surely possible.

What I'm excited about here is a persistent background service that isn't subject to the app model restrictions. This can be used for things like automatically muting the phone in meetings (with exact timing, not the loose timing that the current background APIs give). It can also be used for things like making openVPN (a current project of mine) work on stock ROMs, which would otherwise be very difficult (technically possible if I can get the driver to load on a stock ROM, but a mess of hacks even then).
[Windows Phone 7 Development and Hacking] luka69:
Hi, thanks for your wonderfull job!!

Have any news about it? I would like to use opera with my unlocked optimus7.
[Windows Phone 7 Development and Hacking] Heathcliff74:
There's no way to predict an ETA. Depends on how much time I can spend on it. Currently working on a managed abstraction layer for the policy engine, so I can integrate my new unlocks in WP7Root Tools. Making a little progress everyday. Just bear with me.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] snickler:
thanks for taking the time to work on this =)
[Windows Phone 7 Development and Hacking] vadash:
Could this when finished help us?

http://www.xda-developers.com/windo...run-exe-code-natively-on-stock-unlocked-roms/
[Windows Phone 7 Development and Hacking] Nixeus:
Hello,

Is this project finished and integrated in WP7 root tool ?

Thanks :)
[Windows Phone 7 Development and Hacking] snickler:
Not yet. He will let us know when. It will be a new version of root tools. Please bear with him as this takes some time for him to implement it in a clean manner
[Windows Phone 7 Development and Hacking] Nixeus:
If I understand, with this project, we could execute homebrew without using the Interop Hack, is'nt it ?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@Nixeus: Not really. This will require making changes to the OS configuration that can only be made with high privilege access. Aside from custom ROMs with full-unlock (which can already run homebrew EXEs), the only ways to get this access on the phone currently all require interop-unlock. For example, WP7 Root Tools requires ID_CAP_INTEROPSERVICES so your phoen must be interop-unlocked to install it.
[Windows Phone 7 Development and Hacking] Nixeus:
I would like to re-create or port a little C/C++ application whick i have wrote for Wm6.5.

My Application used the RAS function in order to manage the DATA connection.

Can i do it ?

If yes, with com-interop ? or, is there today a easiest way ?

Is there a guide ?

Thanks a lot ,

Nixeus
[Windows Phone 7 Development and Hacking] ultrashot:
The best (in general) way today is to write a silverlight app with native COM libraries inside. Follow this guide: http://xdaforums.com/showthread.php?t=1299134
[Windows Phone 7 Development and Hacking] Nixeus:
Waw, it's a long guide ! Thanks a lot ultrashot :)
[Windows Phone 7 Development and Hacking] Heathcliff74:
FINALLY!!

STATUS: DONE! :D

www.wp7roottools.com

Ciao,

Heathcliff74
[Fascinate Q&A, Help & Troubleshooting] ireash:
I am running the Comm Rom 2.0 and when I try to use my LP pro KEY it starts FC'ing. I can use the free version of LP just not the pro? All else runs FANTASTIC with this set up......

I have OTB1.4

Any Ideas?

Thanks!!

edit:

Nevermind...As always if you read a little you usually find the answers!! Thanks to all that contribute here! btw....In the answer I ounf that a lot of people here dont use Launcher Pro....What do you use then? I like the 7 screens and the transitions, but if there is something that works better I am all EARS!
[Fascinate Q&A, Help & Troubleshooting] beenz:
I use ADW EX. The only thing it's missing from LP is the widgets, which you can't seem to get anyway lol. But it adds quite a bit, IMO
[Fascinate Q&A, Help & Troubleshooting] jaxboomstick:
I use ADW but I had LP installed behind the scenes. After my first app restore I was experiencing the same issue. On my second build of 2.0 I chose not not restore LP and didn't encounter the issue.
[Fascinate Q&A, Help & Troubleshooting] spotmark:
I've been using LP+ for quite some time. Occasionally, after a new install it will FC when you first start the phone, but when it comes back, everything is fine. I'm experiencing it now, because I just installed ComRom 2.0, but after a few days it will settle in, and not FC at all.
[Fascinate Q&A, Help & Troubleshooting] Hymizzle:
In order to use the paid version you have to remove the .apk from system/app using Root Explorer. Reinstall Launcher Pro from market. Before removing make sure you have another launcher to use.

Adw Ex and Go Launcher are way better anyways.
[EVO 4G General] engelsione:
Yup,

confirmed,June 24th. Evo3D

Sent from my Htc Evo4g
[EVO 4G General] Jye75:
Just a tad late there, buddy.
[EVO 4G General] phatmanxxl:
And what does this have to do with the EVO 4g? You could add this to the dozen or so threads already posted about this.