[Windows Phone 7 Development and Hacking] fiinix:
Now THATS why we have emulators with hacked console (to test remote execute).

Problem:

used \Windows\BasePolicy.xml

PID:0B6900AA TID:0B2600B2 PC=40330e4f(coredll.dll+0x00040e4f) RA=00011c70(EmulatorStub.exe+0x00001c70) SP=02ada96c, BVA=02ada9d8

PID:0D49002A TID:0C640032 PolicyLoader.exe : Info PolicyXml0000:

PID:0D49002A TID:0C640032 PolicyXmlLoadFromXml("\Windows\BasePolicy.xml")

PID:0D49002A TID:0C640032

PID:0D49002A TID:0C640032 PolicyLoader.exe : Info PolicyXml0000:

PID:0D49002A TID:0C640032 PolicyXmlSaveToXml("PolicyMerged.xml", Flags=0x00000035)

PID:0D49002A TID:0C640032

PID:0D49002A TID:0C640032 PolicyLoader.exe : Info PolicyXml0000:

PID:0D49002A TID:0C640032 PolicyXmlSaveToDatabase(P="policy.vol", A="cesecurity.vol", M="PolicyMeta.xml")

PID:0D49002A TID:0C640032

PID:0D49002A TID:0C640032 \Windows\BasePolicy.xml(78,2) : ERROR PolicyXml2301:

PID:0D49002A TID:0C640032 Unable to perform operation - the specified account already exists: CreateNew "S-1-5-112-0-0X70-0X49445F4341505F4445425547"

PID:0D49002A TID:0C640032

PID:0D49002A TID:0C640032 PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PID:0D49002A TID:0C640032 Failed: PolicyXmlSaveToDatabase(P="policy.vol", A="cesecurity.vol", M="PolicyMeta.xml"), HR=0x80004005

PID:0D49002A TID:0C640032

PID:0D49002A TID:0C640032 PolicyLoader.exe : ERROR PolicyXml0000:

PID:0D49002A TID:0C640032 One or more errors were detected during processing.

PID:0D49002A TID:0C640032

edit:

var ar = "/writedump /nowritedb" + @" \Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml";

Deployed our xml and ran %ar%

Posting error soon, need to get it to plain text.

edit:

result:

PID:0D850042 TID:0D330042 PolicyLoader.exe : Info PolicyXml0000:

PID:0D850042 TID:0D330042 PolicyXmlLoadFromXml("\Applications\Install\B2A1493F-42E1-4C0E-A5CB-EF204B677C43\Install\xdaa.policy.xml")

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 PolicyLoader.exe : Info PolicyXml0000:

PID:0D850042 TID:0D330042 PolicyXmlSaveToXml("PolicyMerged.xml", Flags=0x00000035)

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 PolicyLoader.exe : Info PolicyXml0000:

PID:0D850042 TID:0D330042 PolicyXmlLoadFromDatabase(P="policy.vol", A="cesecurity.vol", M="PolicyMeta.xml")

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 PolicyLoader.exe : Warning PolicyXml3001:

PID:0D850042 TID:0D330042 Metadata XML file not found: PolicyMeta.xml

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 policy.vol : ERROR PolicyXml2011:

PID:0D850042 TID:0D330042 Internal error - function failed: PolicyRuleOpen(805307409) (GetLastError = 1260)

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 policy.vol : ERROR PolicyXml2011:

PID:0D850042 TID:0D330042 Internal error - function failed: PolicyRuleOpen(805306878) (GetLastError = 1260)

( ... ) like 200+~ times (same error over and over)

Uses different "PolicyRuleOpen( ... )" every time tho.

PID:0D850042 TID:0D330042 policy.vol : ERROR PolicyXml2011:

PID:0D850042 TID:0D330042 Internal error - function failed: PolicyRuleOpen(805307433) (GetLastError = 1260)

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 PolicyLoader.exe : FATAL ERROR PolicyXml0000:

PID:0D850042 TID:0D330042 Failed: PolicyXmlLoadFromDatabase(P="policy.vol", A="cesecurity.vol", M="PolicyMeta.xml"), HR=0x800704ec

PID:0D850042 TID:0D330042

PID:0D850042 TID:0D330042 PolicyLoader.exe : ERROR PolicyXml0000:

PID:0D850042 TID:0D330042 One or more errors were detected during processing.

PID:0D850042 TID:0D330042

edit:

"How to fix":

* "Metadata XML file not found: PolicyMeta.xml":

[Content]: Macros etc that need to be loaded, even if we don't use them.

[Fix]: Use emulators Macro-list (> located to \Install)

<Macro Id="LOADERVERIFIER_ROUTE_BY_NAME" Description="Base path for all of the loader verifier rules that apply across all chambers" Value="policy:/LOADERVERIFIER/GLOBAL/ROUTE_TO_ACCOUNT/(+)/(+)" />

...

<Namespace Prefix="/LOADERVERIFIER">
<Authorization Id="LV_ACCESS_ALLOW" Bitmask="0x00000001" />

<Authorization Id="LV_ACCESS_BLOCK" Bitmask="0x00000002" />

<Authorization Id="LV_ACCESS_LOAD" Bitmask="0x00000004" />

<Authorization Id="LV_ACCESS_EXECUTE" Bitmask="0x00000008" />
</Namespace>

...

<Macro Id="DUASVC_ACCOUNT_DETECTION_IMPERSONATED" Description="Device Update Agent private service account for detection" Value="S-1-5-112-0-0X11-0X00000007" />

edit:

* Fixed (PolicyMeta.xml): /mdb=""\Windows\Security\PolicyMeta.xml"""