[Windows Phone 7 Development and Hacking] Martin7Pro:
VS

Now I have got HaRET incremental version working under Visual Studio 2008. It is compiled by cygwin/make, deployed to device and started under debugger, all from VS IDE. All output (Warning, Information, Error) is redirected to VS Output window. For example now (instead MessageBox):

...

KMD1: 0xD9456944 $device\KMD1 Drivers\BuiltIn\KMDriver $bus\KMD1

ListRunningDrivers(KMD1:) returns HANDLE 0xD9456944

Load module: toolhelp.dll

WP7RunInKernelMode(kmodedll.dll, KGetProcInfo, 0x39F248, 1, 0x39F274, 576, 0x39F180, 198)

DeviceIoControl returns 1

Error: 'Haret is not running in 'system' mode. Major functionality will not be present.'

Load module: WindowTreeUpdater.dll

...

WP7VirtualAlloc, WP7VirtualFree, WP7VirtualCopy is used instead VirtualAlloc, VirtualFree, VirtualCopy. But, by error message, I mean a big part of cpu.cpp module must be tranfered to kmode_dll.cpp.

// Get Program Status Register value
static inline uint32 cpuGetPSR(void) {
uint32 val;
asm volatile("mrs %0, cpsr" : "=r" (val));
return val;
}

unsigned long KcpuGetPSR(unsigned char * InStructurePointer,
unsigned long InStructureLength, unsigned char * OutStructurePointer,
unsigned long OutStructureLength) {

TRACE_SAVE(L"KcpuGetPSR(0x%X, %d, 0x%X, %d)\n", InStructurePointer,
InStructureLength, OutStructurePointer, OutStructureLength);

if (OutStructurePointer && sizeof(uint32) == OutStructureLength)
{
uint32 * pRes = (uint32 *) OutStructurePointer;

*pRes = cpuGetPSR();

TRACE_SAVE(L"cpuGetPSR() returns 0x%X\n", *pRes);

return ERROR_SUCCESS;
}
return ERROR_INVALID_PARAMETER;
}

After it:

...

KMD1: 0xD9456944 $device\KMD1 Drivers\BuiltIn\KMDriver $bus\KMD1

ListRunningDrivers(KMD1:) returns HANDLE 0xD9456944

Load module: toolhelp.dll

WP7RunInKernelMode(kmodedll.dll, KGetProcInfo, 0x21EF248, 1, 0x21EF274, 576, 0x21EF180, 198)

DeviceIoControl returns 1

WP7RunInKernelMode(kmodedll.dll, KcpuGetPSR, 0x21EF378, 1, 0x21EF374, 4, 0x21EF2AC, 198)

DeviceIoControl returns 1

Load module: WindowTreeUpdater.dll

...

KGetProcInfo(0x21F1CE4, 1, 0x21F1F00, 576)

pinfo filled, GetProcInfo returns ERROR_SUCCESS

wVersion = 1

szProcessCore = Snapdragon

wCoreRevision = 0

szProcessorName = QSD8250

wProcessorRevision = 0

szCatalogNumber =

szVendor = QUALCOMM

dwInstructionSet = 0

dwClockSpeed = 998

KcpuGetPSR(0x21F5CE4, 1, 0x21F5F00, 4)

cpuGetPSR() returns 0x2000011F

KMD_Open

KMD_Open

KMD_IoControl entry, dwCode=9

KMD_IoControl WP7_DLL_CALL, dwCode=9

Function kmodedll.dll::KGetProcInfo returns 0

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=6

KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6

Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns D97A0000

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=8

KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8

Function VirtualCopy(0xD97A0000,0xAC0000,65536,0x604) returns 1

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=6

KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6

Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns D9EE0000

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=8

KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8

Function VirtualCopy(0xD9EE0000,0xA90000,65536,0x604) returns 1

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=6

KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6

Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns DA020000

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=8

KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8

Function VirtualCopy(0xDA020000,0xA91000,65536,0x604) returns 1

KMD_IoControl returned 1

KMD_IoControl entry, dwCode=9

KMD_IoControl WP7_DLL_CALL, dwCode=9

Function kmodedll.dll::KcpuGetPSR returns 0

KMD_IoControl returned 1

Function kmodedll.dll::KFunctionName returns 0 means SUCCESS (nonzero is Error code),

in other attempts nonzero means OK (zero is FALSE or 0 bytes).

Console works for me now:

NLEDSET 0 1 // Start vibration

NLEDSET 0 0 // Stop vibration

But very much directives must be reimplemented to driver calling still.

Better way, then functions redefining by one, will DEF_GETCPR and DEF_SETCPR macros adjustment to kernel driver using.

I tried to port PocketPutty for WM to communicate on WP7 device. But, Putty.exe not goes to WinMain function. Do you know anybody, why entrypoint may not be called? It is probably by missing linked dll or function in WP7.

I tried also to connect from Silverlight Telnet client to second device with HaRET and WiFi internet tethering running. But, message is "he remote host is actively refusing a connection" on related IP (192.168.33.1) and all ports (not only 9999). Do you know anybody, if Telnet is theoretically available by WiFi tethered connection?