[Windows Phone 7 Development and Hacking] Martin7Pro:
Thanks, tutorial works well. But, I studied actual HaRET fork and I mean:

1. Kernel mode minimalisation from HaRET version >= 4.0 is usable on WinCE <= 5 version only. We must use more sofisticated user/kernel part division. Linux booting part is necessary to be in kernel mode fully probably.

2. VirtualAlloc etc. functions cannot work in this way. Can you confirm it anybody experienced (ultrashot)? I will prepare WP7VirtualAlloc, WP7VirtualFree (,Copy,...) functions, based on calling process virtual address space injection by VirtualAllocEx called from kernel mode driver. Principles (simplified, we must use more sofisticated solution) will similar to http://vinoth-vinothblog.blogspot.cz/2008/11/sharing-blocks-of-memory-between-kernel.html?m=1 article.

3. Have you got anybody experience in old WM devices IO configuration finding by WM6 HaRET version? I mean we will not able to make functioning automatised realtime HaRET scripts and we will must discovery all pins by hand. This is totally unknown work for me.

LPVOID WP7VirtualAlloc(LPVOID lpAddress, DWORD dwSize, DWORD flAllocationType, DWORD flProtect)
{
if (hKernelDriver)
{
DWORD BytesHandled;
IOCTL_ALLOC_IN IOCTLAllocIn;
IOCTL_ALLOC_OUT IOCTLAllocOut;
IOCTLAllocIn.hProcess = (HANDLE)::GetCurrentProcess/*Id*/();
IOCTLAllocIn.lpAddress = lpAddress;
IOCTLAllocIn.dwSize = dwSize;
IOCTLAllocIn.flAllocationType = flAllocationType;
IOCTLAllocIn.flProtect = flProtect;

BOOL bRes = DeviceIoControl( hKernelDriver,
IOCTL_WP7_ALLOC_ADDRESS,
&IOCTLAllocIn,
sizeof(IOCTLAllocIn),
&IOCTLAllocOut,
sizeof(IOCTLAllocOut),
&BytesHandled,
NULL );

if (bRes) return IOCTLAllocOut.lpResult;
}
return NULL;
}

BOOL WP7VirtualFree(LPVOID lpAddress, DWORD dwSize, DWORD dwFreeType)
{
if (hKernelDriver)
{
DWORD BytesHandled;
IOCTL_FREE_IN IOCTLFreeIn;
IOCTL_FREE_OUT IOCTLFreeOut;
IOCTLFreeIn.hProcess = (HANDLE)::GetCurrentProcess/*Id*/();
IOCTLFreeIn.lpAddress = lpAddress;
IOCTLFreeIn.dwSize = dwSize;
IOCTLFreeIn.dwFreeType = dwFreeType;

BOOL bRes = DeviceIoControl( hKernelDriver,
IOCTL_WP7_FREE_ADDRESS,
&IOCTLFreeIn,
sizeof(IOCTLFreeIn),
&IOCTLFreeOut,
sizeof(IOCTLFreeOut),
&BytesHandled,
NULL );

return bRes;
}
return false;
}

case IOCTL_WP7_ALLOC_ADDRESS:
KERNEL_TRACE(TEXT("KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=%X\n"), dwCode);
RetVal = FALSE;
if (pBufIn && pBufOut && dwLenIn > 0 && dwLenOut > 0)
{
IOCTL_ALLOC_IN * IOCTLAllocIn = (IOCTL_ALLOC_IN *) pBufIn;
IOCTL_ALLOC_OUT * IOCTLAllocOut = (IOCTL_ALLOC_OUT *) pBufOut;

IOCTLAllocOut->dwResult = ERROR_INVALID_PARAMETER;

HINSTANCE hLibrary = LoadLibrary(L"coredll.dll");
if (hLibrary)
{
LPFNVIRTUALALLOCEX lpfnVirtualAllocEx = (LPFNVIRTUALALLOCEX) GetProcAddress(hLibrary, L"VirtualAllocEx");
if (lpfnVirtualAllocEx)
{
// call the function
IOCTLAllocOut->lpResult = lpfnVirtualAllocEx(
IOCTLAllocIn->hProcess,
IOCTLAllocIn->lpAddress,
IOCTLAllocIn->dwSize,
IOCTLAllocIn->flAllocationType,
IOCTLAllocIn->flProtect
);
RetVal = TRUE;
_snwprintf(IOCTLAllocOut->szOutTrace, MAX_PATH-2, L"Function VirtualAllocEx(0x%X,0x%X,%d,0x%X,0x%X) returns %X",
IOCTLAllocIn->hProcess,IOCTLAllocIn->lpAddress, IOCTLAllocIn->dwSize, IOCTLAllocIn->flAllocationType, IOCTLAllocIn->flProtect, IOCTLAllocOut->lpResult);
KERNEL_TRACE(L"Function VirtualAllocEx(0x%X,0x%X,%d,0x%X,0x%X) returns %X",
IOCTLAllocIn->hProcess,IOCTLAllocIn->lpAddress, IOCTLAllocIn->dwSize, IOCTLAllocIn->flAllocationType, IOCTLAllocIn->flProtect, IOCTLAllocOut->lpResult);
}
else
{
_snwprintf(IOCTLAllocOut->szOutTrace, MAX_PATH-2, L"Function VirtualAllocEx does not exists in library coredll.dll!\n");
KERNEL_TRACE(L"Function VirtualAllocEx does not exists in library coredll.dll!\n");
}

FreeLibrary(hLibrary);
}
else
{
_snwprintf(IOCTLAllocOut->szOutTrace, MAX_PATH-2, L"Library coredll.dll does not loaded!\n");
KERNEL_TRACE(L"Library coredll.dll does not loaded!\n");
}
if (pdwActualOut != NULL)
{
/////	*pdwActualOut = (unsigned char *)(&(DllCallOut->lpResultBytes) - (unsigned char *)(&(DllCallOut->szOutTrace)) + DllCallOut->dwLength);
*pdwActualOut = dwLenOut;
}
}
break;
case IOCTL_WP7_FREE_ADDRESS:
KERNEL_TRACE(TEXT("KMD_IoControl IOCTL_WP7_FREE_ADDRESS, dwCode=%X\n"), dwCode);
RetVal = FALSE;
if (pBufIn && pBufOut && dwLenIn > 0 && dwLenOut > 0)
{
IOCTL_FREE_IN * IOCTLFreeIn = (IOCTL_FREE_IN *) pBufIn;
IOCTL_FREE_OUT * IOCTLFreeOut = (IOCTL_FREE_OUT *) pBufOut;

IOCTLFreeOut->dwResult = ERROR_INVALID_PARAMETER;

HINSTANCE hLibrary = LoadLibrary(L"coredll.dll");
if (hLibrary)
{
LPFNVIRTUALFREEEX lpfnVirtualFreeEx = (LPFNVIRTUALFREEEX) GetProcAddress(hLibrary, L"VirtualFreeEx");
if (lpfnVirtualFreeEx)
{
// call the function
IOCTLFreeOut->bResult = lpfnVirtualFreeEx(
IOCTLFreeIn->hProcess,
IOCTLFreeIn->lpAddress,
IOCTLFreeIn->dwSize,
IOCTLFreeIn->dwFreeType
);
RetVal = TRUE;
_snwprintf(IOCTLFreeOut->szOutTrace, MAX_PATH-2, L"Function VirtualFreeEx(0x%X,0x%X,%d,0x%X) returns %d",
IOCTLFreeIn->hProcess,IOCTLFreeIn->lpAddress, IOCTLFreeIn->dwSize, IOCTLFreeIn->dwFreeType, IOCTLFreeOut->bResult);
KERNEL_TRACE(L"Function VirtualFreeEx(0x%X,0x%X,%d,0x%X) returns %d",
IOCTLFreeIn->hProcess,IOCTLFreeIn->lpAddress, IOCTLFreeIn->dwSize, IOCTLFreeIn->dwFreeType, IOCTLFreeOut->bResult);
}
else
{
_snwprintf(IOCTLFreeOut->szOutTrace, MAX_PATH-2, L"Function VirtualFreeEx does not exists in library coredll.dll!\n");
KERNEL_TRACE(L"Function VirtualFreeEx does not exists in library coredll.dll!\n");
}

FreeLibrary(hLibrary);
}
else
{
_snwprintf(IOCTLFreeOut->szOutTrace, MAX_PATH-2, L"Library coredll.dll does not loaded!\n");
KERNEL_TRACE(L"Library coredll.dll does not loaded!\n");
}
if (pdwActualOut != NULL)
{
/////	*pdwActualOut = (unsigned char *)(&(DllCallOut->lpResultBytes) - (unsigned char *)(&(DllCallOut->szOutTrace)) + DllCallOut->dwLength);
*pdwActualOut = dwLenOut;
}
}
break;

struct IOCTL_ALLOC_IN
{
HANDLE hProcess;
LPVOID lpAddress;
DWORD dwSize;
DWORD flAllocationType;
DWORD flProtect;
};

struct IOCTL_ALLOC_OUT
{
wchar_t szOutTrace[MAX_PATH];
unsigned long dwResult;
unsigned long dwLength;
LPVOID lpResult;
};

struct IOCTL_FREE_IN
{
HANDLE hProcess;
LPVOID lpAddress;
DWORD dwSize;
DWORD dwFreeType;
};

struct IOCTL_FREE_OUT
{
wchar_t szOutTrace[MAX_PATH];
unsigned long dwResult;
unsigned long dwLength;
BOOL bResult;
};