yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] ultrashot:
never thought about it

I am busy, so I don't read your source. You may need to build a ROM having package with MKHS flags for that dll.

You can.

Both can be regulated in project config.

yes;yes.

You're baking it wrong. Look at attachments.

No, but only one small bug may occure - but you won't hit it.

"QUESTION SPREE!" (Unreal Tournament's voice)

no.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Kernel mode success

Then, I returned MmMapIoSpace calling to driver and tried it in both modes:

User mode ("Flags"=0x10):

KMD_Init

pDriverContext->Instance 2

KMD_Init failed to allocate pGPIO (Error 0x87)

Kernel mode ("Flags"=0x0):

KMD_Init

pDriverContext->Instance 2

KMD_Init Success, MmMapIoSpace returns 0xBD040008

KMD_Open

KMD_IoControl default, dwCode=1

KMD_Close

It seems working. I will prepare usable driver for physical memory operations, include WP7 installator and publish here.
[Windows Phone 7 Development and Hacking] Martin7Pro:
I will publish usable driver as soon as possible. I need functionality request from HaRET chefs. Is read/write physical memory block needed only?

In near future there will dll (opensource probably) and installing/using tutorial only here, no installer XAP.

I am working on desktop-like native installer, but it is too much work. I must finish:

1. registry library with reg files interpreting and automatical backup of changed keys (for uninstaller),

2. batch files WP7 interpreter library (cmd.exe seems not working, but I have finished simple "popen" WP7 alternative last weak to make own console shell).

3. native and managed wrappers for both libraries,

4. managed-native WP7 callbacks system (for Silverlight UI controlled by native code etc.),

5. Silverlight application for easy universal installation/uninstallation of any native applications, drivers, services etc.

When it will finished, installator of this driver will easy 5 minutes work (writing very simple install.reg and install.bat files only). But I have no time to make it all, I urgently need cooperation of experienced native coders. Only w.i.n.c.o and pdaimatejam cooperates now, ultrashot give me very usefull help sometime, but nobody from us have free time to finish it all.
[Windows Phone 7 Development and Hacking] Robbie P:
Hi Martin7Pro, I have posted a help request with link in Recognised Contributor forum. Lets hope someone replies:fingers-crossed:

Well done mate:)
[Windows Phone 7 Development and Hacking] Martin7Pro:
Physical memory is readed by driver, but data block is not sended to calling app.

I have got driver alpha version finished. When it reads any bytes from physical memory, writes it to output virtual buffer. In return time called application breaks (and crashes after any timeout). I will make more diagnostic output and will send codes here.

I readed somewhere output DeviceIOControl buffer must be NULL or greater then input buffer everytime. Is it true information?
[Windows Phone 7 Development and Hacking] ultrashot:
It is implementation dependent - output buffer may be NULL as long as you doesn't use it, or input buffer may be NULL as well.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks. My question was another: I readed somewhere, that CE6+7 contains mistake, which causes error, when outbut buffer is not NULL, but smaller then input buffer. But, I could not find article with this information now.

BIG REQUEST: Please, give higher priority to native VS2008 debugging repair. All those problems could be quickly sollutable, when code tracing and variables inspect will working. I have no time to write own debugger remote part.

Problem of driver testing application crashing seems to me in "this" pointer corruption - probably stack is overwrited in DeviceIoControl calling time. This is one minute diagnostics when full VS debugging is working, but very problematic when not.
[Windows Phone 7 Development and Hacking] jessenic:
Wrote a quick tutorial on building HaRET on Windows: https://github.com/jessenic/HaRET-WP7/wiki/Setting-up-Cygwin

Also here are the automatic builds from my HaRET repo: http://minecraft.digiex.org/jenkins/HaRET-WP7/
[Windows Phone 7 Development and Hacking] spavlin:
http://www.2beanet.com/wince/src/COREOS/NK/index.html

Kernel's interface to the event logging functions.

User-mode visible ARM specific structures and constants

generate API calls to the ROM Patcher system handle

NK kernel loader for EXE/DLL

NK Kernel scheduler code

and more...
[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks, it is a nice link. But, we have got interface given with jessenic, universal kernel mode driver solution is stil in testing phase (based on similar principle, as you refer, only mostly simplified, able to be used universally in WP7, compillable from within VS and GCC too without Platform Builder and allowing to run any non UI code part in kernel mode). This, maximally next weak, it will published here. This not means automatically HaRET working, but, the biggest obstacle is overcomed now. I must vork very much today, but on weekend I can give two hours to universal driver finishing, no more is needed probably now. Sorry for the leak, I work 24 hours per day now, my actual job in industry realtime programming is significantly heavier then wm/wp one and a lot of european factories wait for my results.
[Windows Phone 7 Development and Hacking] Robbie P:
Hi jessenic, I thought I would try your build 16 on my HD2 running WP7. I put the haret.exe on the 200mb fat16 partition along with an sd android build. I used wp7 root tools by heathcliff74 on explorer mode to run the .exe

I get the following first screenshot when I click on haret.exe

I get the second (1) screenshot after changing default.txt to startup.txt (used on sd android builds for hd2) and pressing "Run"

Hope this helps, and Thanks:good:

Edit; have attached haretlog.txt
[Windows Phone 7 Development and Hacking] Martin7Pro:
This is just problem of kernel mode, which we try to solve now.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Reading attached zipped source codes on WP7 device

I sometime want to read my (or others) source codes from attached zip files (for example from last post here now) on device. I have got Dynamics 2 ROM with integrated zip manager, but only docs and txt files are associated to WP Office by default. The simpliest way is to register all source code formats for office reading (and editing + saving too). See (and use) attached reg file, if you want. Using winthout warranty, for your own risc. Attached file is unicode, to be simply tapped in Phone Commander to registry updating. After phone reboot you will see all associated files with MSWord icon and you can tap to them to read/edit/write to \My Documents\ subdirectory. You can also inspect \Application Data\Volatile\zipview\ subdirectories for temporary opened zipped files. All downloaded files (include zips) you can find in \Windows\Profiles\Guest\Temporary Internet Files\Content.IE5\ ... subdirectories and use for example Phone Commander for offline copying/inspecting/editing them. I will add all those important directories to bookmarks Phone Commander next version menu.
[Windows Phone 7 Development and Hacking] jessenic:
Hey Martin7Pro, could you help me with this: https://github.com/jessenic/HaRET-WP7/commit/9043fe732dff1e53e79c4b5fef732d3c307aaf1a

I cannot get it to work. DriverOut log says "Library kmode_dll.dll does not loaded!" when I call a kernel mode command. I have to admit I have never done C++ before :P
[Windows Phone 7 Development and Hacking] jessenic:
I am aware of the warnings, they are only warnings, not errors.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Kernel Driver loaded, VirtualAlloc succesfull, HaRET is working, Linux is not loaded

VS 2008 output (include HaRET 0.3.8 messages):

....

ListRunningDrivers(KMD1:) returns HANDLE 0xBD612504

Error: EXCEPTION reading coprocessor 15 register 0'

Error: EXCEPTION reading coprocessor 15 register 0'

Load module: fuzzyime.dll

Unload module: fuzzyime.dll

Load module: fuzzyime.dll

Load module: TIPCADAPTER.dll

Output: Physical kernel address: a0008000'

Error: EXCEPTION reading coprocessor 15 register 2'

The program '[0x18170062] haret.exe' has exited with code 1067 (0x42b).

Kernel mode driver output:

KMD_Init

pDriverContext->Instance 2

KMD_Init Success, MmMapIoSpace returns D8880008

KMD_Open

KMD_IoControl entry, dwCode=6

KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6

Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns D88A0000

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=8

KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8

Function VirtualCopy(0xD88A0000,0xFFFF80,65536,0x604) returns 1

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=10303FF

KMD_IoControl default, errorneous dwCode=10303FF

KMD_IoControl returned 0

KMD_IoControl entry, dwCode=10303FF

KMD_IoControl default, errorneous dwCode=10303FF

KMD_IoControl returned 0

KMD_Close

Source Files Zip: I do not know why, but I must compile Kernel Mode Driver with WM6.0 SDK to be working in WP7 device. All another dlls and appplication can be compiled with WM6.5.3 DTK.
[Windows Phone 7 Development and Hacking] Martin7Pro:
VirtualCopy function added

Hi jessenic, there are new libraries. You must register driver (reg file in last post), use first WP7LoadDriver(); before all another and replace all VirtualAlloc, VirtualFree and VirtualCopy calling to WP7VirtualAlloc, WP7VirtualFree and WP7VirtualCopy. And, if necessary, all other parts between SetKMode and UnsetKMode transfer to dll and call by mechanism from older posts (this is what I did not do in HaRET 0.3.8 still). See /DriverOut.txt file to inspect, if (and how) driver works. In your debug output (are you able to redirect OutpuDebugString output to HaRET console? If not, I can make version with redirecting to file) may be shown the line: ListRunningDrivers(KMD1:) returns HANDLE 0x... (nonzero value!).

See my last post, if WP7VirtualAlloc and WP7VirtualCopy parameters are OK from HaRET (I do not know).

haret.cpp:

...

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,

LPTSTR lpCmdLine, int nCmdShow)

{

hInst = hInstance;

WP7LoadDriver();

...

First attachment contains necessary files only, needed to 3rd project kernel driver using. Full source code is added to last post.

Edit: I added full binaries of 0.3.8 version for everybody trying. Testing app can load and hold kernel driver in memory, if your application does not load it.

You may try basic HaRET directives, Linux loading (default.txt) still crashes. Do you know anybody, what means "EXCEPTION reading coprocessor"?
[Windows Phone 7 Development and Hacking] jessenic:
I did register the driver and it works fine, but it is not loading my kmode_dll.dll. Also we are not going to get anywhere with such old HaRET as it does not have the Qualcomm specific stuff needed on all WP7 phones.
[Windows Phone 7 Development and Hacking] Martin7Pro:
How did you detect dll is not loaded? Can you copy OutputDriver here? Can you inspect your dll if it exports needed function and does not link any UI API function? Is not problem in UNICODE FULL dll name parameter?

When you use my example dll instead your one by the same way (calling from your application with dll and function names in parameters), is it loaded? If not too, problem seems in calling parameters.

Yes, I seen it. Do you know solution? Newer processor obviously contains old processor instruction set, is not it here too? Can it be solved by adding processor name only to known configurations?
[Windows Phone 7 Development and Hacking] jessenic:
From \DriverOut, it says "Library kmodedll.dll does not loaded". It loads your SimpleKernelDll1.dll fine. Here is the source: https://github.com/jessenic/HaRET-WP7/blob/kmodedll/src/kmodedll/kmode_dll.cpp

The dll does import MessageBoxW, I cannot figure out why it does that. Dll attached.

There are processor specific assembly code in latest HaRET that I am trying to get working, it should work on WP7 phones.
[Windows Phone 7 Development and Hacking] Martin7Pro:
This is problem probably. I am not near of the computer, I will try more on the evening. Have you got any switches in GCC compiler/linker? See old ultrashot's post here and proj file (in text viewer) from my example dll project. Can you try to make totally small dll, exporting one very small function only? Or, better, to recompile my example dll source under GCC with given structures as parameters?
[Windows Phone 7 Development and Hacking] jessenic:
Got it working now, forgot -s from the linker arguments
[Windows Phone 7 Development and Hacking] spavlin:
GitHub for WP

View attachment 1794608
[Windows Phone 7 Development and Hacking] Martin7Pro:
OK. I am not sure with this code part:

bool InitKMDriver() {
return WP7InitDriverAPI() && WP7LoadDriver(L"Drivers\\BuiltIn\\KMDriver");
}

bool DeinitKMDriver() {
return WP7DeinitDriverAPI() && WP7UnloadDriver(L"KMD1:");
}

WP7InitDriverAPI can be called after driver loading. It can be preload in booting time by registry settings, or WP7LoadDriver must be called first (and after it WP7InitDriverAPI is not needed, because it is called from WP7LoadDriver).

WP7UnloadDriver can or can not be called, but if yes, it must be caled after WP7DeinitDriverAPI (it seems OK in your code, but WP7DeinitDriverAPI can fail when first InitKMDriver function fails).
[Windows Phone 7 Development and Hacking] jessenic:
I have fixed it already: https://github.com/jessenic/HaRET-WP7/blame/master/src/wince/kernelmodestuff.cpp
[Windows Phone 7 Development and Hacking] jessenic:
Thanks, Martin. Could you register to GitHub and then fork the HaRET-WP7 repo so you could push changes to your fork? It would make code sharing easier.
[Windows Phone 7 Development and Hacking] Martin7Pro:
Yes, I will do it, but later, I have no time today. First I want to make VS project for GCC HaRET sources, able to find definitions, callers graph, intellisense etc in VS (working now for me, without only Compile/Debug), but invoke cygwin compiling from within VS. Do you know, if cygwin can be run with parameters to be started any script under cygwin and after finishing cygwin will stopped itself? It is probably basic info, but I have no time now to study documentation. I will prepare (and give to GitHub) also version for express VS version in future to be usable by all. There will any hack of SDK+DTK+DDK necessary probably to be all WM/CE(/MFC) definitions accesible from VS Express.

Is this OK?

C:\cygwin\bin\bash.exe -l -c "~username\haret_compile.sh"

where "haret_compile.sh" will contain "cd HaRET-WP7" and "make" lines?

How do I determine cygwin to exit after script finishing? "exit" last line in script only?

To compile I must delete "out" directory everytime before "make". Is it a normal behaviour, or can I set any switch to compile chaged sources only?
[Windows Phone 7 Development and Hacking] jessenic:
Try C:\cygwin\bin\bash.exe -l -c "cd HaRET-WP7 && make clean all"

Edit: You should not need to delete out anymore, I just fixed the Makefile so it fully supports incremental builds.

You can use make clean to remove out directory or "make clean all" to clean before compiling. I suggest to use Eclipse as an IDE, it has autocomplete (Ctrl+Space) and "go to definition" and other stuff like VS does. Screenshot: http://i.imgur.com/iwbt9Zq

I attached my Eclipse C++ settings. Select File>New>Makefile project with existing sources and point it to the HaRET-WP7 directory, close (unload) project and unzip my settings. You need to fix the paths from project settings or from the settings files as I am currently using Linux.

Edit3: My Samsung Omnia 7 reports funny processor info:

Seems that Samsung has been too lazy to fill the correct info :P
[Windows Phone 7 Development and Hacking] Martin7Pro:
Good work, I added attached libraries to my VS project. May be AHI... functions must be marshalled to driver, but it may not be problem now.

...

Registering command ATIDBG

...
[Windows Phone 7 Development and Hacking] spavlin:
View attachment 1808700

View attachment 1808721
[Windows Phone 7 Development and Hacking] spavlin:
http://ronney47.hubpages.com/hub/hackingwindowsce

View attachment 1809071 View attachment 1809200

http://read.pudn.com/downloads124/s...8233/notihook/notihook/common/ceundoc.h__.htm

http://www.codeforge.com/read/39596/ceundoc.h__html

ftp://ftp.icpdas.com/pub/beta_version/VHM/wince600/at91sam9g45m10ek_armv4i/cesysgen/sdk/inc/kfuncs.h

http://forum.dlang.org/thread/86lk08wnco.fsf@sd-15251.dedibox.fr
[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks. How do you extract those dlls? From any ROM or is used dlls extracting possible from runtime?

Have you got coredll.lib, aygshell.lib etc., etc., equal to WP7? First one I have got from ultrashot, but I have no time to make more myself without sources.

Have you got any native debugger working? I am able to see file/TRACE output only now. It is better then nothing, but now I must prepare any output, wait five minutes for cygwin recompiling, deploying and starting HaRET on device, it is very slow working. Even device needs reboot mostly after HaRET actual version starting, it is very frustrated to make very much attempts and to wait everytime any minutes for result. Kernel mode has file output possibility only now. I tried PellesC compiler/debugger too. It is able to stop on first breakpoint (in user mode), but without variables inspecting (stack is shown, then local variables are instectable, but very difficilly) and remote debug server crashes immediatelly.

Do you understand all HaRET code? In my output "Not registering command ..." message is shown often (not so often as on beginning, but so often to be HaRET fully working probably), but I could not find reason in HaRET macros system without full debugging.

Edit: I found PellesC debugger settings to be able inspect all (local and global too) variables. But remote debugger hangs totally or crashes after first breakpoint stopping still. It seems Microsoft eDbgJit.exe using. It is probably "after crash" reason only. Other wrapper must be above debugger running probably (something like Microsoft edm2.exe), but I could not find it. Process rapiclnt.exe crashes on additional debug attempts, but I am not sure if it is debugging related or connection only and if it is WM6 or WP7 feature. May be all debugging is implemented by RAPI here without any special remote debugger. By this answer poide.dll works on device as debugging server, but how can I protect it againts WP restrictions? Need not be rapiclnt.exe or poide.dll patched similarly to edm2p.exe? At least one brekpoint working (include all,

not only previously added

, variables watching) is a small victory, but phone reconnetcing is necessary everytime after it. I will try to port all HaRET to PellesC project. Some usefull informations may be here and as usually. Edit: rapiclnt.exe crashes everytime, when PellesC debugger want begin new debug session, but old (unfinished) debuggee runs on device.

I could not find anything about mobile debugging under Eclipse. Is it working?
[Windows Phone 7 Development and Hacking] ultrashot:
Funny that you have time to write big posts with many question marks but don't have 1-2 milliseconds to generate lib.

1) there are no undocumented MS oalioctl exports that can help you.

IOCTL_HAL_GET_CACHE_INFO

IOCTL_HAL_GET_DEVICE_INFO

IOCTL_HAL_GET_DEVICEID

IOCTL_HAL_GET_UUID

IOCTL_HAL_UPDATE_MODE

IOCTL_PROCESSOR_INFORMATION

IOCTL_HAL_GET_CELOG_PARAMETERS

IOCTL_HAL_GET_POWERONREASON

HTC added some, yes.

If you want to implement your own oalioctl (though you _must_ wrap stock library - it is device specific!), I may share some details.

2) oalioctl is in XIP - good luck replacing it without reflashing.
[Windows Phone 7 Development and Hacking] spavlin:
http://www.codeproject.com/Articles/205617/Debugging-Managed-Applications-in-Windows-CE-Devic

edm2.exe,eDbgJit.exe

When debugging starts, the OS design prompts for edm2.exe. The user has to browse the folder where edm2.exe resides in order to proceed with debugging. edm2.exe can be obtained from two locations:

For Visual Studio 2005 applications

C:\Program Files\Microsoft Visual Studio 8\SmartDevices\Debugger\target\wce400\armv4i

For Visual Studio 2008 applications

C:\Program Files\Microsoft Visual Studio 9.0\SmartDevices\Debugger\target\wce400\armv4i

View attachment 1809536
[Windows Phone 7 Development and Hacking] Martin7Pro:
May be it is a problem of my wrong english. I do not want to write own oalioctl. I want to use full existing oalioctl (or another CE/OEM API) instead of HaRET low-level functions, which cause a big instability of my phone now (I must restart, or it is restared itself so often). Do you know, if every/any informations, wanted by HaRET diagnostic functions, are accesible by any standard Kernel API?
[Windows Phone 7 Development and Hacking] Martin7Pro:
The biggest question again

Yet once for somebody knowing HaRET code:

What do we need to do to be HaRET fully working?

We have got just now: Kernel driver and its wrapper, allowing

any code part

working in Kernel mode.

But, what are HaRET parts necessary to move to kernel part dll? Those parts must be

independent

of other code. Any virtual space areas (mapped physical) can be shared only to user mode application.

I mean the biggest candidate is

memPhysMap

function. Probably all memory.cpp module may be moved to kernel dll and

memPhysMap function only

must be exported to user mode application, with returned pointer sharing to user mode virtual space.

Am I right?

Can we implement really all low-level requests by this one exported function?

Is neccary memory caching in memPhysMap function? When it will simplified to uncached physical memory access for testing phase, will it too worst performace cause? I mean actual memPhysMap code causes instability of my phone, but I am not sure and I do not understand fully this code (areas before wanted physical address are allocated due to caching, or due to any standard page sizes mapping?). Is memPhysMap excluding cashing equivalent of something like VirtualAllocCopyEx(...,Address/PageSize,(WantedAreaSize+Address%PageSize+PageSize-1)/PageSize,...)+Address%PageSize?

Why are couples of VirtualAlloc/VirtualCopy in other modules (cpu-s3c24xx.cpp, uart.cpp) followed by VirtualFree nowhere? Is it code part

without return

(rebooting is possible only)? Can be used here

VirtualAllocCopyEx

calling by driver export (just implemented in driver)?

If this is really all, implementing is simply. But I do not believe it too and I am afraid to hard reseting or bricking of WP7 device(s). I did not publish my actual HaRET code/executable, because it is very ustable now.

What is about assembler functions? Are implementable all in user mode, when using shared virtual pointers? And final Linux loading? Must be this all in kernel mode, or can be the minimal last part only?
[Windows Phone 7 Development and Hacking] spavlin:
SetKMode HD2_WM6

View attachment 1818285