yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] dcordes:
Yes no doubt a preliminary second repository is needed now we can't keep juggling diffs in forum posts and compatibility is not necessary in such early experimental stage..

Of course it would be more complicated to maintain compatibility. Still it would be much nicer to keep one HaRET in the long run.

What silverlight launcher and kernel driver do you mean ?
[Windows Phone 7 Development and Hacking] Jaxbot:
We need a Silverlight launcher that will launch the haret.exe module. Since the applications on WP7 are Silverlight based, this is really the only way without some serious end user hacks to get haret to load. It's not that complicated, though, and we could use the Silverlight interface to act as a frontend to haret if the GUI doesn't work out.

As for kernel driver, we need a driver (e.g. HTCUtility) that will allow us to write to the kernel memory.
[Windows Phone 7 Development and Hacking] dcordes:
alright get it. so you dropped some silverlight already to get the HaRET gui up ?
[Windows Phone 7 Development and Hacking] Jaxbot:
Yep, I can click on the HaRET7 app on my start menu and it loads the haret gui, which then gives me telnet access. So far so good.
[Windows Phone 7 Development and Hacking] streetster:
What should I be doing with my [DllImport("haret.exe")]? Under PE Explorer there are no Exports listed...
[Windows Phone 7 Development and Hacking] Jaxbot:
No no no, you use the DllImport Project :p

http://xdaforums.com/showthread.php?t=1006331
[Windows Phone 7 Development and Hacking] Ludacris:
I don't remember his name but some guy made use of a Silverlight-native exe wrapper to "port" Opera Mobile from Windows Mobile to Phone 7 - it only works on Full Unlocked Devices but still, this could be a start to launch HaReT from Phone 7
[Windows Phone 7 Development and Hacking] Jaxbot:
I already have HaRET launching on my WP7 :p We had this dicussion just a few posts back
[Windows Phone 7 Development and Hacking] Jaxbot:
Haven't touched it much, I have HaRET working and just need a way to lock the pages, or set the kernel mode. GoodDayToDie might know something about that, otherwise I'll do some research. If I had access to a git repo, I'd commit my changes over, but most of them go against HaRET's current dev model, so I'm a little hesitant to do anything at this point.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@jaxbot: if you can send me your current code, I'll see what I can do with it. I'm on a stock ROM, so I can't currently even launch HaRET.
[Windows Phone 7 Development and Hacking] ajlunis:
Okay, thanks for the great work guys! I know some low level C# and C++, let me know if there's any way I can help!
[Windows Phone 7 Development and Hacking] spavlin:
And that if to try to start FPUEnabler (http://windows.modaco.com/topic/293601-fpu-enabler/) or to develop analog for inclusion Kmode
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@hossam.salah: You really shouldn't even be trying to install HaRET unless you know a lot more about it than your post suggests. This isn't some "make my phone 1337" app, it's more like a hacker's toolkit for doing more with the phone. Right now, we're trying to just make it run on WP7; it'll be some time before we can do anything useful with it.
[Windows Phone 7 Development and Hacking] spavlin:
HaRET user mode fix

On the Maui all applications are started in "user mode". User mode is a protected mode, where the application does not

have full access to the processor. Most PDA's run their applications in kernel mode, most Smartphones in user mode.

In order to make the kernel booting HaRET needs access to the processor in kernel mode. Therefore HaRET uses the

coredll.dll function SetKMode(TRUE). The original HaRET did not expect that it could be run in user mode, that is why

some modifications are needed, when your device starts HaRET in user mode:

1. Modify haret.cpp

Put

extern "C" BOOL SetKMode (BOOL fMode);

SetKMode(1);

just before "hInst = hInstance;".

2. Modify network.cpp

Put

SetKMode(1);

SetProcPermissions (0xffffffff);

on line 266 and define in network.cpp

extern "C" BOOL SetKMode (BOOL fMode);

extern "C" DWORD SetProcPermissions (DWORD newperms);

That's it. Those people with smartphones need to sign HaRET with a priviledged certifate. The Maui needs no signing.

Now HaRET runs in system mode and has full proc permissions.

Lets have fun on Maui ...

Chris

Back to "Linux on the Vodofone Power Handheld (bSquare Maui)"

Last update: 11.09.2005
[Windows Phone 7 Development and Hacking] minDark:
I'm afraid it is not like that. In WP7 there is no user mode and kernel mode, you have 4 levels of privileges (4 chambers), where you can put your app. SetKmode and SetProcPermissions/GetProcPermissions are no longer available, you should call CeAllocAsynchronousBuffer() to marshal the buffer of the caller into the virtual memory of the kernel. In my opinion, the only way to have root privileges (TCB chamber), is GoodDayToDie (also MWR InfoSecurity Advisory) exploit.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
To be fair, there is technically still a kernel mode and a user mode. Everything in kernel mode (ring 0 on architectures like x86) is generally going to be TCB, but not everything TCB is kernel mode. TCB means the policy system will allow you to access anything (equivalent to "root" on *nix). Kernel mode vs user mode is implemented using hardware controls, called "rings". http://en.wikipedia.org/wiki/Ring_(computer_security). Withoug actual WP7 source I can't tell you exactly, but the kernel almost certainly runs in the "Supervisor" mode (ring) of the Cortex-A8 processors used by WP7. Most processes run in the unprivileged "User" mode. Processes running as TCB may use "System" mode, although I'm not sure what the difference between that and Supervisor is (possible options include changing Interrupt Service Routines, mappings of physical to virtual memory, and of course setting the processor mode itself). http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344k/Beidabib.html

CE5 and below made switchign to kernel mode trivially easy, (SetKMode is a syscall that just flips the processor mode bit and then jumps back to executing the program) at the cost allowing a single program to easily crash (or take over) the entire device. CE7 / WP7 seems to operate more on a NT-like approach, where only drivers are normally loaded into the kernel memory space (and it even has user-mode drivers). I believe I've figured out how to run code in kernel mode (based on the security advisory).

Chambers are ssomewhat analogous to NT or POSIX user accounts, in the sense that they identify a security entity which has a specific set of permissions. However, instead of the desktop OS model (a user has an account, and all processes the user creates are run as that account by default), each executable has a "routing" that specifies the chamber it is assigned to when run.

For the purposes of HaRET, a process probably wants to run in TCB (maximum privileges as defined by the policy system, which implements access control lists). However, that's not actually sufficient to do the stuff that it needs to do, like access the process status registers. That kind of operation is controlled by the hardware itself, and requires that the processor be in a "privileged" mode such as "Supervisor" (where I bleieve the kernel runs).
[Windows Phone 7 Development and Hacking] jessenic:
Most of you might already know this, but for information purposes I'll link this article about the "kernel mode" here: http://blogs.msdn.com/b/ce_base/archive/2007/01/29/what-is-kernel-mode.aspx
[Windows Phone 7 Development and Hacking] GoodDayToDie:
I've got Jaxbot's launcher code, and am trying to get HaRET working on my phone. The last few days have been very busy though, so I haven't had much time to spend on this.
[Windows Phone 7 Development and Hacking] spavlin:
Architecture Guide for Windows Phone OS 7.0View attachment 933874

View attachment 1033096

View attachment 933902 View attachment 933903

View attachment 933904 View attachment 933905
[Windows Phone 7 Development and Hacking] jessenic:
Yes we are, I've fixed font sizes so all fit on the screen now

Though getting into kernel mode is another thing, I hope GDTD can find an answer to this. I don't know WinCE well, but drivers run in Kernel Mode, right? What if we turned HaRET into a driver that is controlled through a Silverlight app, much like the DFT BT File Transfer.

Edit: Found this in the PDF found in the post before:
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Putting the HaRET logic into a driver is an option which has been considered, and may be the best option in the long run. However, experimenting with that will require a fully-unlocked ROM, much like the DFT BT file transfer driver does. Otherwise, you'd need to add the policy rules for the driver. I haven't yet managed to take over the policy system (although I have an idea for a potential way to simply turn it off using HtcRoot, achieving full-unlock on a stock ROM).

The CE7 source code download includes some drivers that could be used as a basis, so if somebody wants to start working on this, go ahead. Currently, only a few custom ROMs and very few phones on stock ROMs can use HtcRoot, so it would be good to explore another avenue at the same time.

I'm currently looking at re-implementing the removed (well, stubbed out) SetKMode syscall. Essentially, I'd re-implement the user-to-kernel-mode switch code myself, then modify the syscall handler function to point to the entry point of this reimplemented functionality. Then, so long as this hack was used, legacy code that expects SetKMode to work would be usable again.
[Windows Phone 7 Development and Hacking] jessenic:
But isn't WP7 more CE6 than CE7? I've read that it is CE6 with some features from CE7. So if I started working on that, should I download the CE6 or the CE7 ones? I have currently only 3G so downloading many GBs is not fast...

Edit: This seems interesting: http://www.youtube.com/watch?v=fIF9mwGoPw0
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Based on my examination of the kernel data structures and APIs, I'd say that (for Mango at least, I'm not sure about the original release), the kernel is closer to 7 than 6. It's definitely somewhere in between, though - for example, the security token is still meaningful (CE7 seems to have somewhat deprecated them, and claims all the APIs like CeRevertToSelf and such are now empty stubs) but it uses the policy system, which is brand new in CE7.
[Windows Phone 7 Development and Hacking] wheelerk:
@GoodDayToDie So does this mean you are close to Interop unlock for the HTC Titan?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@wheelerk: Sadly, no. The hacks I'm using to change things require that your phone already be interop-unlocked. A completely different kind of hack is needed to get interop-unlock in the first place.

I've tried a couple of different things, but so far none have worked on HTC's "v2" drivers, which means all gen2 HTC phones are still locked down. I'll keep looking, but it's only one of many things that I'm investigating. I certainly can't promise any time, or even that I'm close. These types of things are as much luck as skill, and require a lot of time that I have to split among multiple projects (such as trying to get HaRET working).
[Windows Phone 7 Development and Hacking] wheelerk:
Ok, thanks for the update. I would love to debrand my Titan, to get the 8107 update.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
You should be able to use the CAB sender to install updates. It actually may be safer than manually de-branding via registry edits.
[Windows Phone 7 Development and Hacking] wheelerk:
Is there a thread for that?
[Windows Phone 7 Development and Hacking] jessenic:
Right next to this thread... http://xdaforums.com/showthread.php?t=1306415

Remember to install all language packs installed on your phone or you will not be able to install any future OS updates.
[Windows Phone 7 Development and Hacking] ted973:
drivers must be signed by MS trusted cert or it won't be loaded or you should need a full unlocked rom that shutdown the policyengine.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@ted973: Two possibilities there. One is to sign the driver with our own private key, and add its cert to the root code-signing store on the phone. This can be done on pretty much any interop-unlocked phones, since it seems to be stored in the registry. The other is to disable the policy engine, or at lest add custom rules for it, using HtcRoot on a stock ROM. I'm interested in both possibilities (and am working on the second at least a little already).

My current approach is the "re-implement SetKMode" option, though. It's really a pretty simple function: get the PROCESS struct of the calling process (easy; the current HtcRoot already does this), dump its CPU context info (should be easy), set the kernel mode bit on the saved copy of the CPU flags register (very easy, unless these CPUs are *really* weird), write the CPU context back into the PROCESS struct, and trigger a context switch (exiting the syscall handler may be enough). When the caller resumes, it'll be a kernel process. This could be done directly using HtcUtility. I could also do it by subverting the syscall table, like I mentioned before - that makes the function itself simpler, but makes the setup and tear-down trickier.
[Windows Phone 7 Development and Hacking] Nitro_123:
We should try to get HaRet to run on a full unlocked ROM first like the HD2 WP7 ones and then slowly adapt everything to all other devices

Just my 2 cents
[Windows Phone 7 Development and Hacking] ted973:
maybe certs stored in "HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates".

SetKMode(TRUE) does not work on WP7?

i have downloaded your HTCRoot project but this IOCTL cmd code is disappear in 5.x Drivers, so pity.

wish you guys can port this magic tool on WP7 asap.really wish Linux can run on my Mozart & Focus.

thx!
[Windows Phone 7 Development and Hacking] Omnia7xdax:
@Nitro_123 : No,no,no,eventhough that i´m no developer of Haret and also that i have no name in this Forum i must say that this is absolutely not the way it should go,i can understand,when you first try it with the legendary htc hd2 but what i can´t understand is when you say we should focus first on some special devices,because i think (/ know),and that makes me sad is that it´ll run then first again on htc devices,and that owners of Samsung devices(like sadly in most cases) have to wait until some guys think that it´ll be so far to do it for this devices (which will be very much later than samsung users want to wait).

So for me it is the same procedure like every time,that every other one than htc users are in disadvantage :(
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@ted973: Nope. CE6 removed SetKMode (WP7 is built on a kernel that is somewhere between CE6 and CE7). The function export is still there, but it does nothing. I'm working on fixing that.

The driver-signing thing is an interesting approach to take. However, I think you'd need to monkey with the policy system, in addition to adding the cert, so for not I'm going to go with the SetKMode approach.
[Windows Phone 7 Development and Hacking] iPwn_:
Haret7

The HTC Surround has a lot of the same specifications as the HTC HD2 (leo).

So that should be a very easy start to the HaRET project?
[Windows Phone 7 Development and Hacking] jessenic:
All first gen Windows Phones have the same specs as the HD2... Hardware is not a problem, the software is. Windows Phone 7 is running on a different kernel than the Windows Mobile.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Different kernel and different software restrictions, yes. The CE6/7 kernel used in WP7 is substantially different from the CE5.X kernel used in WinMo. Additionally, WP7 restricts things like running native executables, and runs all third-party apps with very low permissions by default. Fully unlocked ROMs get around the restrictions, but not the different ROM.
[Windows Phone 7 Development and Hacking] egzthunder1:
If you are not asking or doing anything development related, stay away from posting here. Your post(s) will be removed if they are not development related.
[Windows Phone 7 Development and Hacking] shinkstor:
So, now that Heathcliffe's root tools allows root access control, would it be possible to get haret working correctly if both the launcher app and the actual native exe were granted root access? Not sure if heathcliffe's sdk will even work or be able to be ported to native exes, so would this be worth my time attempting? If I could get the exe root access, that probably won't get it close enough for haret, would it?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
WP7 Root Tools doesn't support native EXEs. It'll be some time before HaRET can work on stock ROMs. I'm still trying to get it working on custom ROMs (a bit difficult since my phone runs stock...)
[Windows Phone 7 Development and Hacking] ajlunis:
Could I send you an unlocked HD7? ;)
[Windows Phone 7 Development and Hacking] shinkstor:
Yeah, I have a full unlocked samsung focus, and since heathcliff released a policy editor, and an sdk that give you root access on it, I was thinking that maybe just messing with the security policies would allow buffer overflows into kernel memory or something. I wasn't sure what the limitations of granting root to an app actually are, but I assume it allows some more gateways for getting into a pseudo kernel mode
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@ajlunis: Well, it *would* be nice to have aphone for hacking on, separate from my main phone. My main is already an HD7, though - I just avoid custom ROMs on it until I've got a really good backup/restore system. There re probably others who need an HD7 more, though I can't deny it would make this task easier.

@shinkstor: The "policy editor" in WP7 Root Tools 0.9 isn't really an "editor" in the usual sense. It allows making changes in the policy database, true, but not arbitrary ones - specifically, it allows you to designate a WP7 TaskHost.exe-hosted (Silverlight/XNA) app to run as as TCB ("root"). This is incredibly useful, but still definitley not Full Unlock.

The typical way to get code running in kernel mode is to use a driver. For example, I could write a driver that would expose an IOCTL to user-mode applications, which would implement the SetKMode functionality (make a process run in the ARM equivalent of Ring 0). Installing a driver requires modifying policies, though. That requires TCB. OK, we've got TCB now... but while I can access the policy database, it's totally undocumented. I can reverse-engineer a bit of it - for example, I'm pretty sure I can reproduce what Heathcliff74 does in Root Tools 0.9 now - but I'm not even sure about that much.

HtcUtility gives me direct write access into kernel memory. I'm tempted to focus on Root apps for a bit, now that more people can use them, but I've been promising more work on re-implementing SetKMode for so long now that I should really give that another shot. It'll still take some time, though.
[Windows Phone 7 Development and Hacking] spavlin:
hklm/drivers/procgroup_.../udevice.exe

accountsid-

sid_udevice_tcb & sid_udevice_standard ?
[Windows Phone 7 Development and Hacking] spavlin:
How to correct?

Compiling (armv4) src/wince/haret.cpp

src/wince/haret.cpp: In function 'BOOL DialogFunc(HWND__*, UINT, WPARAM, LPARAM)':

src/wince/haret.cpp:57: error: 'createWindowTreeUpdater' was not declared in this scope

src/wince/haret.cpp:57: error: 'CREATEWINDOWTREEUPDATER' was not declared in this scope

src/wince/haret.cpp:58: error: 'destroyWindowTreeUpdater' was not declared in this scope

src/wince/haret.cpp:58: error: 'DESTROYWINDOWTREEUPDATER' was not declared in this scope

src/wince/haret.cpp:80: error: 'KillWindowTreeUpdater' was not declared in this scope

make: *** [out/haret.o] Error 1
[Windows Phone 7 Development and Hacking] ajlunis:
Anyone? This needs to keep moving. It would be an amazing hack.
[Windows Phone 7 Development and Hacking] jessenic:
I added the project to GitHub. Heres the URL: https://github.com/jessenic/HaRET-WP7

Feel free to fork and submit pull requests! Also well known devs are more than welcome to the repo admin team.

Edit: Builds will become visible here whenever someone commits and the build did not fail: http://minecraft.digiex.org/jenkins/HaRET-WP7/

Also here is the Silverlight Launcher: https://github.com/jessenic/HaRET-WP7-Launcher/

Builds for the launcher: http://minecraft.digiex.org/jenkins/HaRET-WP7-Launcher/
[Windows Phone 7 Development and Hacking] spavlin:
===== HaRET pre-0.5.3-20120415_150816 =====

...

...

Running WSAStartup

Starting gui

In initdialog

Terminating haret due to unhandled exception (pc=00000000)
[Windows Phone 7 Development and Hacking] jessenic:
What phone? What build or is it self built? If self built, what version of the CE compiler?
[Windows Phone 7 Development and Hacking] spavlin:
ace_dli.dll View attachment 1010893

gx.dll View attachment 1010894
[Windows Phone 7 Development and Hacking] Jaxbot:
Are you using the source on github, or the original source by the OP?
[Windows Phone 7 Development and Hacking] spavlin:
Replaced Rom, now GUI works
[Windows Phone 7 Development and Hacking] ONDR4SH3K:
Stupid Question but important - Which MTYPE has HTC Trophy please?

And log is in attachment.

Thanks for functional Haret7 Launcher jessenic!

Edit: Haret7 launcher: "Install latest" without internet connection closes app.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Thanks Spavlin...

I'm looking at using CeVirtualSharedAlloc to let me re-implement SetKMode. The problem is that all these functions can only be called *from* kernel mode, so I need to use the HtcUtility driver to overwrite the process's stored registers - specifically, the flag register that controls the processor mode.
[Windows Phone 7 Development and Hacking] spavlin:
.......................................

Boot Sequence Specifications

You cannot specify command-line parameters for executables. This is unchanged from previous versions of Windows Embedded CE.

Application-loading sequences are specified under the HKEY_LOCAL_MACHINE\Init registry key.

You can specify the load order of system DLLs, executables, and applications under the HKEY_LOCAL_MACHINE\Init registry key. The OS launches executables listed under this key and loads DLLs under this key into the kernel.

You can specify which DLL entry point to call when the application starts.

The startup sequence is similar to the service startup sequence in Services.exe and the registry enumerator.

This is the bringer

You can specify the load order of system DLLs, executables, and applications under the HKEY_LOCAL_MACHINE\Init registry key. The OS launches executables listed under this key and loads DLLs under this key into the kernel.

When we set HaRET in this key

---------- Post added at 10:01 PM ---------- Previous post was at 09:41 PM ----------

It cant be that hard to write a small device driver which calls HaRET which will then run in

Kernel mode, which will then boot our kernel
[Windows Phone 7 Development and Hacking] spavlin:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

http://geekswithblogs.net/BruceEitman/category/8216.aspx

http://geekswithblogs.net/BruceEitm...e-loading-a-driver-with-activatedeviceex.aspx

http://geekswithblogs.net/BruceEitman/archive/2010/02/04/platform-builder-the-k-flag-and-your-driver.aspx

http://geekswithblogs.net/BruceEitman/archive/2008/07/01/windows-ce-6.0-user-mode-kerneliocontrol.aspx

http://geekswithblogs.net/BruceEitm...minterruptenable-and-oeminterruptdisable.aspx

http://geekswithblogs.net/BruceEitm...eam-interface-driver-from-an-application.aspx

http://geekswithblogs.net/BruceEitman/archive/2009/04/12/windows-ce-opening-driver-registry-key.aspx

http://geekswithblogs.net/BruceEitm...e-loading-a-driver-with-activatedeviceex.aspx