yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] Jaxbot:
Tried it with earlyharetlog.txt in the same directory. No log is spit out, and while there is no error code when running the EXE, it crashes before I can even pull the running processes list.
[Windows Phone 7 Development and Hacking] dcordes:
ok does it show anything ? loading screen or so ? it's what I expected. if you compiled haret.exe before, linload takes 2 seconds to build. It might just be the exact haret.exe ...
[Windows Phone 7 Development and Hacking] Jaxbot:
Nope, no signs that it even loads, except for the fact the Win32 API reports NO_ERROR after shell executing it.
[Windows Phone 7 Development and Hacking] minDark:
From what I saw, linload.exe cannot run under WP7 because it depends on libgcc_s_sjlj-1.dll, witch cannot be found in WP7. You can try running Haret.exe. All the necessary APIs are there, so no problem about UI related functions. Only one function is missing: SetKmode, witch is used by Haret to take kernel mode privileges, to flush the memory. In WP7 this function is not available and i don't know any workaround about this. We can try to recompile Haret from source, remove SetKmode call from output.cpp and memory.cpp, update functions ordinals in the import table for new Haret.exe to match those from WP7 coredll.dll (i'm not sure about this, maybe can work without matching ordinals) and see if we have a working GUI.
[Windows Phone 7 Development and Hacking] dcordes:
Thanks for this insight, minDark. may I ask how you found out about the missing dependencies?

It's not so nice that the kernel mode function is missing in WP7. How are we going to start the kernel without it?

I did as you proposed and compiled haret.exe without it. I just commented out lines containing setkmode. But I didn't change the ordinals stuff because I have no idea what that is.

no-kmode haret.exe with minDark's proposed kmode patch is attached. Any WP7 device owners welcome to test.

diff to current haret.git HEAD:

haret$ git diff
diff --git a/src/memory.cpp b/src/memory.cpp
index ccba659..53c0826 100644
--- a/src/memory.cpp
+++ b/src/memory.cpp
@@ -320,7 +320,7 @@ err: VirtualFree (pmWindow, 0, MEM_RELEASE);
if (slot >= PHYS_CACHE_COUNT)
{
// Go into supervisor mode
- SetKMode (TRUE);
+// SetKMode (TRUE);
cli ();
cpuFlushCache ();

@@ -333,7 +333,7 @@ err: VirtualFree (pmWindow, 0, MEM_RELEASE);

// Back to user mode
sti ();
- SetKMode (FALSE);
+// SetKMode (FALSE);
}

// Move least recently used slot to front
@@ -354,12 +354,12 @@ void memPhysReset ()
if (pmInited)
{
// Go into supervisor mode
- SetKMode (TRUE);
+// SetKMode (TRUE);
cpuFlushCache ();
// Restore the page table entries
for (int i = 0; i < 16 * PHYS_CACHE_COUNT; i++)
pmPT [i] = pmOldPT [i];
- SetKMode (FALSE);
+// SetKMode (FALSE);

VirtualFree (pmL2PT, 0, MEM_RELEASE);
VirtualFree (pmWindow, 0, MEM_RELEASE);
diff --git a/src/wince/output.cpp b/src/wince/output.cpp
index cc65d40..e4be7ed 100644
--- a/src/wince/output.cpp
+++ b/src/wince/output.cpp
@@ -276,9 +276,9 @@ prepThread()
// All wince 3.0 and later machines are automatically in "kernel
// mode". We enable kernel mode by default to make older PDAs
// (ce2.x) work.
- Output("Setting KMode to true.");
- int kmode = SetKMode(TRUE);
- Output("Old KMode was %d", kmode);
+// Output("Setting KMode to true.");
+// int kmode = SetKMode(TRUE);
+// Output("Old KMode was %d", kmode);
}

// Initialize the haret application.
[Windows Phone 7 Development and Hacking] Ttblondey:
I download it through my hd7 but when I try to open it stated this file isn't safe to open in your windows phone.
[Windows Phone 7 Development and Hacking] Jaxbot:
You have to deploy it to your phone, then execute it with native code.
[Windows Phone 7 Development and Hacking] dcordes:
Guys, I'm sorry I had no time to follow the project. If there are any recommended information to add in the first post, or if there is any other way I can help, please let me know (PM).
[Windows Phone 7 Development and Hacking] spavlin:
IN COREDLL.DLL :

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

sub_100623B0	; CODE XREF: __GetUserKData+24p

; TlsSetValue+28p ...

LDR	R12, =0xFFFFC800

MOV	R3, #0

ADD	PC, R12, #0x380

; End of function sub_100623B0

; ---------------------------------------------------------------------------

MRS	R3, CPSR

ORR	R2, R3,	#0x80

MSR	CPSR_cf, R2

MRC	p15, 0,	R2,c13,c0, 3

STR	R0, [R1,R2]

MSR	CPSR_cf, R3

BX	LR

; ---------------------------------------------------------------------------

MRS	R3, CPSR

ORR	R2, R3,	#0x80

MSR	CPSR_cf, R2

MRC	p15, 0,	R2,c13,c0, 3

LDR	R12, [R1,R2]

ADD	R12, R12, R0

STR	R12, [R1,R2]

MSR	CPSR_cf, R3

BX	LR

; ---------------------------------------------------------------------------

MRC	p15, 0,	R0,c13,c0, 3

BX	LR

============================================================

MRC p15, 0, <Rd>, c13, c0, 3	Read Thread ID User Read only Register

MCR p15, 0, <Rd>, c13, c0, 3	Write Thread ID User Read only Register

View attachment 1346580
[Windows Phone 7 Development and Hacking] spavlin:
IN NK.EXE :

sub_8051F934

MRS	R0, CPSR

BIC	R1, R0,	#0x40

MSR	CPSR_c,	R1

AND	R0, R0,	#0x40

BX	LR

; End of function sub_8051F934

ADR	R3, locret_8051FAB8

STMFD	SP!, {R3}

STMFD	SP!, {R4-R12,LR}

MOV	R8, R1

MOV	R9, R2

STR	SP, [R0]

LDR	R3, [R0]

MRS	R2, CPSR

BIC	R2, R2,	#0x1F

ORR	R2, R2,	#0x11

MSR	CPSR_c,	R2

DCD 0xE14F2000

STMDB	R3!, {R2}

STMDB	R3!, {R8-SP}

BIC	R2, R2,	#0x1F

ORR	R2, R2,	#0x12

MSR	CPSR_c,	R2

MRS	R2, SPSR

STMDB	R3!, {R2}

STMDB	R3!, {SP}

BIC	R2, R2,	#0x1F

ORR	R2, R2,	#0x17

MSR	CPSR_c,	R2

MRS	R2, SPSR

STMDB	R3!, {R2}

STMDB	R3!, {SP}

BIC	R2, R2,	#0x1F

ORR	R2, R2,	#0x1B

MSR	CPSR_c,	R2

MRS	R2, SPSR

STMDB	R3!, {R2}

STMDB	R3!, {SP}

DCD 0xE3C2201F

ORR	R2, R2,	#0x1F

MSR	CPSR_c,	R2

MRS	R2, SPSR

STMDB	R3!, {R2}

STMDB	R3!, {SP,LR}

BIC	R2, R2,	#0x1F

ORR	R2, R2,	#0x13

MSR	CPSR_c,	R2

MRS	R2, SPSR

STMDB	R3!, {R2}

MRC	p15, 0,	R2,c1,c0, 2

STMDB	R3!, {R2}

MRC	p15, 0,	R2,c1,c0, 1

STMDB	R3!, {R2}

LDR	R1, =0xC5ACCE55

MCR	p14, 1,	R1,c1,c0, 4

ISB	SY

CMP	R9, #0

STMEQDB	R3!, {R9}

BEQ	loc_8051FA48

MRC	p14, 1,	R1,c1,c2, 4

SUB	R3, R3,	R1,LSL#2

SUB	R3, R3,	#4

MOV	R4, R3

STR	R1, [R3],#4
[Windows Phone 7 Development and Hacking] spavlin:
And if you use Dual Boot Rom? :

http://4pda.ru/forum/index.php?showtopic=178627
[Windows Phone 7 Development and Hacking] Azzelio:
but we can not put WM6.5 on WP7 phones?

if we can then we can start Harent!

I'm saying stupid things?
[Windows Phone 7 Development and Hacking] Azzelio:
we can also try on our wp7?
[Windows Phone 7 Development and Hacking] iamwin:
looking forward for this to run on our WP7 device..mine is full unlocked HTC Titan. :)
[Windows Phone 7 Development and Hacking] lucasryan:
Beginning memory tracing......

Terminating haret due to unhandled exception......pc=00017b68...(?)

Haret...14 # wirq 1

Terminating haret due to unhandled exception....pc=0001b1e4...(?)
[Windows Phone 7 Development and Hacking] Martin7Pro:
Hi guys. Do not you try anybody to convert HaRET projet into visual studio? I had very much errors, but many from it is headers missing only (#include <winsock2.h> etc.), after supplement it is much better. Have you anybody experience with __attribute__ etc. converting? I mean VS developing and debugging is accustomed for much people include me.

I used:

#include <stdio.h>

#include <winsock2.h>

#ifndef __GNUC__

# define __attribute__(x) /*NOTHING*/

#endif

/*

extern const char *VERSION;

*/

extern const char *HaRET_VERSION;

/*

// Test if 'addr' is in the range from 'start'..'start+size'

#define IN_RANGE(addr, start, size) ({ \

uint32 __addr = (addr); \

uint32 __start = (start); \

uint32 __size = (size); \

(__addr - __start < __size); \

})

*/

// I mean this is not valid code for address range, two conditions must be combined.

// Test if 'addr' is in the range from 'start'..'start+size'

#define IN_RANGE(addr, start, size) \

(((uint32)addr) >=((uint32)start) && ((uint32)addr) < ((uint32)start) + ((uint32)size))

etc.

But many errors are still present.

Do you know, why those files missing, when I used Git cloning?:

c1xx : fatal error C1083: Cannot open source file: '..\util.cpp': No such file or directory

c1xx : fatal error C1083: Cannot open source file: '.\s-util.cpp': No such file or directory

c1xx : fatal error C1083: Cannot open source file: '.\s-cpu.cpp': No such file or directory

Another big problem:

#define asm __asm

...

asm volatile("mrs %0, cpsr" : "=r" (val));

error C4235: nonstandard extension used : '__asm' keyword not supported on this architecture

http://www.codeproject.com/Articles/19027/ARM-Assembly-for-eVC-with-the-Mono-Jit-Macros ???
[Windows Phone 7 Development and Hacking] Jaxbot:
Hmmm... I had HaRET compiling at one point but I *think* I was compiling it on Ubuntu in a virtual machine. I'd try to help but I think I lost my HaRET files when my hard drives got nuked.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks for info. I mean you used gcc under windows probably. Do you know, how to code inline assembler in Visual Studio and how to manage macros with variable parameters count in Visual studio? Those are two biggest problems for me now. But Visual Studio debugging possibilities are great, it can help us to make fully working HaRET WP7 version.

Another question - I am working now also on WP7 WinCE (not HaRET) shell interpreter. But, when I run script with single line, or I run shell application (it is a part of Phonmander app) under VS debugger, all is right. When I run multiline script outside debugger, Error 202 ERROR_INFLOOP_IN_RELOC_CHAIN occures everytime when second line (second ShellExecuteEx calling) is interpreted. Do you know anybody, what this error means?

____________________________

Edit: There is two different errors. Error 202 means probably: My application wants to start another application, which is allready running. For example dde applications does not return right handle to WaitForSingleObject using. Second, bigger error is very crazy: When application runs outside debugger, WaitForSingleObject after ShellExecuteEx crashes most often. Do you know anybody, how it is? Is not it work of WatchDog?
[Windows Phone 7 Development and Hacking] Jaxbot:
Well, no, I compiled it on Ubuntu :P

But anyway, hm, I really don't know; C++ was never my forte, so I never bothered learning VC++ or how VS handles things. Wish I could be more helpful
[Windows Phone 7 Development and Hacking] Martin7Pro:
Do you know anybody, what is Error 233 "At the opposite end of the forwarding no process does take place"? I am working with HaRET 3.8 version source code now. Project is compiled, deployed, but no main (WinMain, wmain) function is called, also when EntryPoint is changed to mainWCRTStartup in Project Properties. Means it application tryies to use WP7 missing API?
[Windows Phone 7 Development and Hacking] Magpir:
I dun understand any Android stuff , but what is the status of the project now?

Is anything worthwhile came about?

i will appreciate it if someone were to give me a summary as of latest progress.
[Windows Phone 7 Development and Hacking] link68759:
It ain't working. People are trying to make it work.
[Windows Phone 7 Development and Hacking] Magpir:
what i mean is that in another internet post i heard that it was working in the HTC mozart
[Windows Phone 7 Development and Hacking] dazza9075:
a quick search on google tells us that most of the comments if you trace them back far enough actually relate to this very thread, HaRET was on the Mozart and Leo, but unable to do anything, it goes on to suggest that the leo was the perfect test device for it and progress was moving rapidly...

http://www.xda-developers.com/android/week-1-field-report-haret-hardware-and-tablets/
[Windows Phone 7 Development and Hacking] Omnia7xdax:
Yeah,but the rapid in this thread seems not to exist anymore :rolleyes:
[Windows Phone 7 Development and Hacking] Martin7Pro:
Hi spavlin. From what IDE have you got your results? I am trying to make WP7 HaRET version under Visual Studio 2008, but much problems occured me. Are you using fully unlocked ROM? What version? Thanks. M7P
[Windows Phone 7 Development and Hacking] spavlin:
Mondrian (Surround,T8788) M-TYPE 4457
[Windows Phone 7 Development and Hacking] Kr3i0s:
jessenic, is it possible to pm me this version of haret that u compiled?

I have tried to complie from your source but getting this error

Compiling (armv4) src/mach/machines.cpp

make: /opt/mingw32ce/bin/arm-mingw32ce-g++: Command not found

make: *** [out/machines.o] Error 127

I am on Ubuntu 12.10 64bits
[Windows Phone 7 Development and Hacking] spavlin:
View attachment 1628746
[Windows Phone 7 Development and Hacking] Martin7Pro:
Is not something like this or this possible?
[Windows Phone 7 Development and Hacking] Jaxbot:
I'm not sure the SMD driver exists on WP7, though. However, an implementation like that would work, and this project is fairly possible (excluding any other caveats), but I have no knowledge of CE kernel drivers, which is why I haven't attempted anything.
[Windows Phone 7 Development and Hacking] Martin7Pro:
OK. I found any other materials from CE team. If I understand, OEM (I mean I not, but you know how to sign dll as OEM) driver can call ANY user callback in kernel mode. Then little signed OEM like driver can open big backdoor to kernel mode running, probably on custom ROMs only. Can you anybody exactly write here, what ALL problems defend to full WP7 HaRet function? Hi address memory allocation only? This thread is little mischmasched now, DFT thread (I love google Chinese translations in registration time) too, other web infos are unusable totally. Where is really updated WP7 HaRet source code place? Exists it for GCC only, or have you anybody MSVC project functioned? I found my last year attemp may function after any little UI changes. But, it is very old HaRet version. I mean I am not along, which have all native projects under VS2008 and want to have conzistency in here. If more people will do ACTIVE work here, we can make multiide source version and finish Linux/Android port to WP7 devices in near future.
[Windows Phone 7 Development and Hacking] Martin7Pro:
VS2008 Version

There is VS 2008 HaRET 3.8 version. Something is commented (wrong) to be compillable/linkable. Use "Pocket PC 2003 Device" for VS debugging. Do not use emulator (VS crashes). I have no free time now (too much other works). Somebody can compare and repare this old corrupted version to newest GCC fork and make "Windows Mobile 6/6.5.3" linkable version. HaRET Default.txt script runs cca 20 second on my Phone before crash, it says "EXCEPTION Reading Coprocessor" repeatedly.

EDIT: Version for WM 6.5.3 DTK added. Use 'Windows Mobile 6.5.3 platform' for compiling and 'Windows Mobile 6.5.3 Device' and ultrashot's WMDC for debugging on REAL WP7 DEVICE. All Error, Status, Output is sended to device screen area

and to VS2008 debug output windows too

, when console is not connected to COM port. Last line tried is now:

memcpy (preloader, &linux_preloader,

(uint)&linux_preloader_end - (uint)&linux_preloader);

Output: Preloader physical/virtual address: fffffc00'

Is it the same problem, what have you in GCC compiled version (memory management is not allowed to physical addresses above 0x80000000)?

EDIT2: I am really not sure, if problem of my version works stopping is related to memory management. Can you try it in VS somebody experienced? VS TRACE Output stops in any magic place:

Output: memVirtToPhys: 609 finished'

NOT TRIED, JUST FINISHED. BUT NOTHING MORE! It seems another thread does something wrong.

The most often is before it:

Error: EXCEPTION reading coprocessor 15 register 2'
[Windows Phone 7 Development and Hacking] dcordes:
Did you pass the environment vars correctly? It seems to be unable to locate the cross toolchain. Also make sure the toolchain works on your 64bit system. Double check with the howto linked on first page. Hope this helps.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Silverlight UI

Hi Friends.

It is not a fake, but I need co-operation here. I am working on non-blocking WPF managed/unmanaged interface, able to write strings (or do any more complicated UI management) to WPF objects by unmanaged functions calling. Are you anybody able to change actual non-ui HaRET version to simple dll with defined entry points? I will share interface with UI-related callbacks next weak. I have got too old HaRET version in VS2008 vorking only, newest versions have too different assembler, system calls and linking management opposite to 0.3.8. I have no time to port it or to install linux/GCC on my totally full computer. M.

____________________________

A question:

Are you able anybody change certificates to be this feature working on WP7?

_______________________

Do you anybody know CodeSourcery in relation to WM projects compiling? I tried Python script and GCC/G++ for compiling newest HaRET from Visual Studio, but compiling from downloaded CodeSourcery version seems not to be for WM, but for ARM Linux. Is CEGCC Necessary? I read CodeSourcery may be usable to WM/CE ARM compiling along.

But, VS scripting seems interesant, with Native/Managed TRACE system etc. it can allove to have FULL hybrid (Managed+Native) projects in VS 2010 for Windows Phone only, include debugging.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Is not this (and dependent the same author CE6/7 sources), what we need finally? Are you able anybody to sign it with a correspondent WP7 certificate? I mean little driver able to access processor(solved on link fully)/memory(need little add) hardware is better then rearranging all HaRet to driver etc.

If I understand good, we can:

1. To make "stream protocol driver" dll. This is the deepest driver level, enabling everytime kernel mode (second possibility is a "kernel part" of "device driver", I am not sure still, how to determine, which part is used for calling answer). This dll must export 6 strongly defined entry points.

2. To register "fake stream protocol".

3. To open "fake file" by "fake protocol" in our user mode application (or wrapper dll). This loads driver to memory, now we can call it's exported functions in the kernel mode.

4. To start kernel mode thread, communicating with application by synchronisation objects and (may be) able to call user callbacks in kernel mode (I am not sure, how can be params mapped between modes, but link above solves it).

I mean points 1..3 can be did by "normal" files and registry handling (see middle link of previous post). If not, we must use cab sender or WP7 kitchen to do points 1 and 2. May be Platform Builder is needed for point 1 (in link above it is wrote, we can use this nice feature), but I mean it is not needed, driver can be compiled as "normal" dll probably. May be "system ROM" bit could not be checked, then it can works simply on custom ROMs and with any certification hack on signed ROMs.

Will not bigger problem SD card filesystem? Have you got success with partition creating? I just go to replace my HTC7Pro SD card from 8GB class 2 to 32GB class 10, I will try to do some partitions management attempts.
[Windows Phone 7 Development and Hacking] Kr3i0s:
Its good to see someone still working on this project after the big boys seem to have given up. Keep it up Martin7Pro.

I wish i could be of any assistance but have no programming language skills. Hope to get haret running on WP7 someday.
[Windows Phone 7 Development and Hacking] Jaxbot:
That looks exactly like what we need. I came across something similar to that a while back, but I was unable to actually use it for anything, as my limited C++ knowledge resulted in me having no idea how to compile CE drivers.

As far as drivers go, it should be possible with full unlocked devices to use unsigned CE modules, as I'm pretty sure this is what DFT bluetooth does. I could be totally wrong, though. It's been a while.

Props to you, though!
[Windows Phone 7 Development and Hacking] Martin7Pro:
Hi spavlin. Have you got <pkfuncs.h> file for (any) WP7 device? I am working on kernel mode driver, but power functions etc. are OEM dependent. My first attemp (will enable physical memory access only) will use any little subset of pk functions designed inline in my own <pkfuncs.h>, but we need OEM originals probably for full device kernel access. M.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Still no success

I created and deployed driver, setted registry values, restarted phone and tried to load driver by "fake stream" demanding. Driver is not loaded. When I use the same demand for any other builtin driver, all is OK. I created driver without PB and OEM libraries, only with /DRIVER linker flag. Is it possible? How can I get dll with System and Kernel flags setted? I will clean project code and publish here.
[Windows Phone 7 Development and Hacking] ultrashot:
You don't really need /DRIVER linker flag. Default DLL config is almost good, though you have to enable DEP support, set large address awareness and add WP7's coredll.lib to input static libs.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Kernel mode driver

Hi ultrashot. Thanks for a help. I do not understand exactly. Can you see (and repair, if will you have a time) attached code (VS2008+WM6SDK used)? Does not expect any certificates too? Driver registration can be also wrong:

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\KMDriver]

"Order"=dword:00000004

"DeviceArrayIndex"=dword:00000002

"Flags"=dword:00000010

"IClass"=multi_sz:"{A32942B7-920C-486b-B0E6-92A702A99B35}"

"Prefix"="KMD"

"Dll"="KMDriver.dll"

"Index"=dword:1

This is based on IOCTL driver from post above, kernel mode callbacks are not finished now. Flags are setted to user mode now in registry settings (0x10), I am afraid to use kernel mode driver on unbackuped phone. After doing backup I will try "Flags"=0 and IOCTL/Physical memory functions calling.

I do not know, how to debug kernel or driver, there is simple diagnostic text file writing. By it KMD_Init is called from UDevice.exe, driver in user mode seems to be working. I forgot to add definition file to project settings, when cleaning code, this was all disfunction problem probably.

Output:

KMD_Init

pDriverContext->Instance 2

KMD_Init Success

KMD_Open

KMD_IoControl default, dwCode=1

KMD_IoControl default, dwCode=10303FF

KMD_IoControl default, dwCode=10303FF

KMD_Close

KMD_Open

KMD_IoControl default, dwCode=1

KMD_Close

KMD_Open

KMD_IoControl default, dwCode=1

KMD_Close

Do you know, who and why call XXX_IoControl function with dwCode=10303FF?
[Windows Phone 7 Development and Hacking] ultrashot:
http://msdn.microsoft.com/ru-ru/library/ee478991.aspx
[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks. This is probably OK now, I forgot close stream handle in older version of calling application before new one creating, Can I prevent it within the driver?

Do you thing it is safe to try this driver (newest source attached) in kernel mode? What will occcure, when driver crashes in XXX_Init function? Does not it cause phone brick (repeated restarts), when all kernel drivers are launched from NK.exe? I am not sure, if kernel exception does not call restart automatically. Is this behaviour dependent on registry values (I seen something related in registry editor, but I do not remember where)?

Can I use any dwCode values for my own operations, or all values are predefined as IOCTL_PSL_NOTIFY? I found this list only.

How to do it, please? I could not find something related to WP/CE6, only desktop windows MSDN.

The same issue. How to do it on WP application? Is Platform Builder needed? Or is it some compiler/linker switch in project?

May I use coredll7.lib from your OMXCDLL source? Is only one coredll.dll for both modes (I could not find kcoredll on my phone)? Or extract coredll.dll from Ansar's signed ROM and use impdef.exe or dumpbin.exe and lib.exe? Lib.exe seems not working on my computer for ARM compiled dlls. I designed project as WM6 dll. Will not any dupplications occure, when coredll.lib will be added?

Do you know, how to add extra partition to WP7 phone SD card?

EDIT: Attachment removed, actual source code is here.