yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] mamaich:
By the way, if you'll download (without install) windows updates and then look into the \windows\softwaredistribution\download directory - you'll find lots of CAB files (files without extensions are CABs) containing drivers with corresponding PDB files!!! For example all broadcom and lots of nvidia drivers have PDBs inside.

PDB files would greatly simplify their reverse engineering and exploiting. For example I'd first look at the the "NVIDIA memory driver"... :) This would be needed when MS would close the current security hole that is used for unlocking.

And one of the updates contains UEFI firmware. It is partially not encrypted, as I see lots of strings like "/home/jamzhang/uefi/CryptoPkg/Library/OpensslLib/openssl-0.9.8l/", so we can start analysing it, maybe we'll find something interesting inside, for example holes in recovery mode that would allow us to convert our devices to development. Of cause uefi is signed, so we can't modify it.
[Windows RT Development and Hacking] netham45:
No, they're full debuggers. It looks to me like the debugging tools had on-device debugging disabled purposefully, possibly in an attempt to proactively stop things like this.
[Windows RT Development and Hacking] bob_blah:
Do you think it will be possible for Firefox or chromium to be compiled for RT?
[Windows RT Development and Hacking] netham45:
It's possible. I'd wager FF is more likely, as the DirectX dependencies can be turned off easier in it.

And, here's the metro app I made to display the kernel base address. To install:

Extract zip onto tablet, right-click on 'Add-AppDevPackage.ps1', click Run in Powershell, follow all prompts.

(Note: You may need to run powershell as an administrator and switch to the directory to run the script, in which case you'll also need to run 'set-executionpolicy unrestricted' before you can run the script)

(Screenshot):
[Windows RT Development and Hacking] apatcas:
Anyone got a compilled copy of putty for ARM laying around?
[Windows RT Development and Hacking] netham45:
http://xdaforums.com/showpost.php?p=36394854&postcount=225
[Windows RT Development and Hacking] apatcas:
Sorry completely missed that. Running good. Wow.
[Windows RT Development and Hacking] martyj999:
total noob question! SILVERLIGHT?

Is it possible to get silver light working on the surface at some point with these developments, I thought this was one if the most ridiculous things to be missing of the surface? Thanks.
[Windows RT Development and Hacking] netham45:
I doubt that we'll see silverlight or any .net other than 4.5, it would require MS to actively port it over.
[Windows RT Development and Hacking] edembowski:
It worked on the 10th try, the exploit seems to be opportunistic. A few questions:

- Is it possible to have the metro app output the base address to a text file?

- If so, shouldn't it be possible to get the value, and then call the 'runExploit.bat' from the metro app using runas?

Thanks
[Windows RT Development and Hacking] netham45:
-Yes, if I wanted to implement save handling ( would require file browsers and whatnot )

-No, Runas cannot be used from Metro apps. Appcontainers cannot escalate permissions.
[Windows RT Development and Hacking] edembowski:
OK, that makes sense. Another way to do it would be have a script in the start up folder launch the metro app, have the app write to the test file as it launches and then exit.

Once control is returned to the script, it can run the exploit reading the text file for its parameters and then unlinking the file when done. Since the launch would return immediately, you can test for the existence of the file as an execution check.

From a script by name:

http://superuser.com/questions/4334...pplication-from-the-command-line-in-windows-8

As a custom URI handler (getkernelbase:// or whatever)

http://www.itsjustwhatever.com/2012...apps-from-a-desktop-shortcut-or-command-line/
[Windows RT Development and Hacking] sparven89:
Network possibilitys

Is just me, or isn't this a perfect time to get 3/4g modems to work properly?

I know some providers has released RT-support for their modems, and I'm not counting on mine to release some soon.

So is someone up for the job? I'm not that experienced with programming on this level, I belong more on an architechture-level ;)

But I still can provide all runtime-files you need.

Hardware specs: HUAWEI E398 4G USB MODEM

Provider: Tele2
[Windows RT Development and Hacking] netham45:
That's unlikely to happen without manufacturer cooperation. Not to mention that kernel space is still signed with this exploit.
[Windows RT Development and Hacking] djboo:
im fairly certain i can apply some tricks ive done before on surface to make this a single click affair. Stuck in a car at moment, fear someone may beat me too it heh. You should be able to get the cmd to run a batch auto and you can then do a run as with powershell. You can also save to that folder without user interaction from metro, but that isn't needed anyhoo as you can pipeout the getkb.exe output then pipe itback in.
[Windows RT Development and Hacking] netham45:
I'm working on automating it right now. I've used a simple jscript script to send a voldown keypress and I'm going to see if I can't make the metro app just log the code to %TEMP% and make the script read from it.

Edit: Damnit, jscript can't send keystrokes without the unlock.
[Windows RT Development and Hacking] Lexsym:
uh oh, I tried running the exploit using the metro app that returns the kernel base address. I didn't run the file as admin, I thought I was an admin level user already, I thought it worked because I didn't bsod or anything. I pressed enter twice when prompted to do so and then it closed. I downloaded and tried to run that compiled putty file for arm and no such luck, it still gave me an application verified failed signature. So I this time right-clicked on the batch file and made sure I clicked on the run as administrator. This time around upon pressing the volume down button that it resulted in a BSOD (oh no!). So after the automatic restart process I tried running as administrator again and no such luck. Same result ensured,

Simple steps:

1. install and open metro app

2. open batch file (not right click and run as admin)

3. enter the 4 hexadecimal digits (caps and spaces included) into batch file prompt.

4. press enter.

5. press volume down.

6. press enter.

Result: nothing;

After:

1. open batch file via run as admin

2. enter the 4 hex digits

3. press enter

4. press volume button.

result: bsod;
[Windows RT Development and Hacking] netham45:
Give it a few more tries, there's a bug where one of the offsets changes, I don't have an automated solution to solve for it yet.
[Windows RT Development and Hacking] djboo:
poweshell can.
[Windows RT Development and Hacking] netham45:
How? The only method I can find (using system.windows.forms) tells me that I can only invoke methods on core types.
[Windows RT Development and Hacking] djboo:
Be home in ten,will be all over this. Got a previous project that should have all the missing peices
[Windows RT Development and Hacking] Lexsym:
CURSE DMA!

Also, after manually restarting (and installing updates :eek:), it worked and I opened putty! So now to get my own apps recompiled for arm, I have to download, and install windows 8, and then redownload vs2012 pro? if so, does vs2012 pro on windows 8 come with or do I have to download the windows 8 sdk or something?
[Windows RT Development and Hacking] netham45:
Download VS2012, you'll have to export the .libs for the .dll's you want to import (since most all of the .libs for arm are missing you'll need to do a number of system ones), and do some tweaks on VS2012 to allow ARM desktop apps. Search through this thread, all the info you need should be there.

Kk, I'ma grab a bite to eat, but I'll be back in 15 or 20 minutes.
[Windows RT Development and Hacking] djboo:
god damn, when i wrote this it was without a surface (but for a surface) - so some of the experiments i did worked - but not on surface - including the sendkeys. balls. got some ideas, the getting the user to push the volume button wouldnt be the worst thing in the world.

did you get the metro app launching the bat ok, and did you get admin rights ok? i can solve the latter easily and the former shouldnt be too tricky.

btw, dont forget, not only do we have powershell and BAT files, but another tool in our arsenal is VBScript.
[Windows RT Development and Hacking] netham45:
JScript was what I tried first, it gives an error saying it can't instantiate objects.

Also, I haven't tried launching it from a bat. I should be able to just give it a filetype handler then open a file of that type, though.
[Windows RT Development and Hacking] djboo:
Im getting pretty much same results as you with every different method i know, and it seems WinRT wont do it either :(

it wouldnt be fun if it was easy tho.
[Windows RT Development and Hacking] Malte1234511:
I got my Kernel Base!! :) I just clicked on "get developer license" and just had to enter my MS account data and i got a license for a month? Is that normal, it was free :))) now putty works :)
[Windows RT Development and Hacking] netham45:
Yup, that's how it's done.

Edit: Here's what I'm going to do for automating the metro app:

Register a file handler

Create a file w/ that extension from the bat, call it

The metro app will write the 4 bytes for the offset to it and immediately quit out.
[Windows RT Development and Hacking] Malte1234511:
Thank you for this!!

Btw is there any Chance to get this working on non "developer unlocked"?! devices?
[Windows RT Development and Hacking] djboo:
CreateProcessA( "C:\\Windows\\System32\\cmd.exe"," /K echo test > test2.txt",NULL, NULL, 0, 0, NULL, NULL, &si, &pi);

CreateProcessA(NULL, "cmd /C echo test > c:\test.txt", NULL, NULL, 0, 0, NULL, NULL, &si, &pi))

These should allow you to run the batch with no file handler stuff etc - and be able to send the KB as an arg. Not tested, will do so now.

[edit] writing to c:\ obviously didnt work, but it pings happilyish (the ping fails, but the command is running - batch files next - did you share the code for ur version that got the KB and i missed it or was it just the exes?

[double edit]

CreateProcessA(NULL, "cmd /K runExploit.bat", NULL, NULL, 0, 0, NULL, NULL, &si, &pi); <-totally worked - just trying to squeeze in some UAC elevation now.

---------- Post added 10th January 2013 at 12:00 AM ---------- Previous post was 9th January 2013 at 11:19 PM ----------

were you able to launch cscript from the cmd window that the metro app provides? I get a couldn't load settings error, and the usual fix (registry key permissions) isn't resolving it.
[Windows RT Development and Hacking] lilstevie:
There is no such thing as "developer unlocked". Getting a certificate to install an unsigned metro app is free and non-warrantee voiding
[Windows RT Development and Hacking] djboo:
not strictly true. Im sure ive read qualcomm have windows ARM tablets that are not locked down this way. but these arent available to the public. Infact, read the early posts on this thread - one poster had one im sure.
[Windows RT Development and Hacking] lilstevie:
yeah, but I would call them development devices not developer unlocked as they more than likely never had secure boot turned on in the first place :)
[Windows RT Development and Hacking] GoodDayToDie:
That's a development device, as in a device used to develop the system. "Developer unlock" (as used on Windows Phone) is most analogous to the "Windows Developer License" (as in, the powershell command show-windowsdeveloperlicenceregistration) which is free and takes only a moment to set up.
[Windows RT Development and Hacking] pontusbredin:
Perhaps not even a solution, but how about copy and paste. The clipboard is not restricted between Modern UI and the Desktop, is it? Just as a way to transfer information.

And thank you all for working on this!!!
[Windows RT Development and Hacking] djboo:
at the moment it looks like you will need the Metro launched CMD for getKernelBase (or nethams metro based getkernelbase) and a normal CMD for everything else as the metro launched one cant run stuff like runas/cscript etc.

Best idea at the moment is the metro one runs, pipes getkernelbase output to %TEMP% and then you run a batch from desktop which reads it in from %TEMP%.

not a million miles better than what we have, but at least no copy/paste or manual typing.
[Windows RT Development and Hacking] netham45:
I've got a Metro app now that writes back to the file that called it, provided you run an icacls on the file first to give it permission to write (I gave up trying to get the hodgepodge system that Metro's file handling is to work, it keeps claiming I only have read privs to it), I'm just trying to get it to quit out cleanly after running.
[Windows RT Development and Hacking] pontusbredin:
I was thinking;

1. Start nethams metro based getkernalbase that puts the base address in the clipboard.

2. Start the runExploit.bat as admin that in turn gets the base address from the clipboard.

I'm sure you will find a better way. Just a suggestion.

Best regards
[Windows RT Development and Hacking] djboo:
metro/wp8 is my day job. tell me what you need and ill make it happen.

unless you need it in c++. and then ill run away, mostly confused ;) (im a c# dev)
[Windows RT Development and Hacking] netham45:
I needed to open the IStorageItem passed by the file association handler to open for writing, but I don't believe it gives permissions to write to it by default. I needed it in C++ too.
[Windows RT Development and Hacking] djboo:
its a good plan, but if im not mistaken, clipboard is out of bounds as its 'System.Windows.Forms.Clipboard' - we dont get proper windows.forms till after the hack.
[Windows RT Development and Hacking] netham45:
I've already got a solution done and working (for the most part).

1) Create file with extension that calls Metro app when loaded

2) run icacls on the file to give ALL APPLICATION PACKAGES read/write perms

3) run it, it'll launch the app which uses POSIX-style fopen to write to it then exit after 250ms

4) Get number out of file
[Windows RT Development and Hacking] djboo:
in c# at least, you should be able to get the full path from the storageitem, close it, create a new stream with write access to overwrite it.

---------- Post added at 12:55 AM ---------- Previous post was at 12:52 AM ----------

is there any reason why the code you are using to get the KB couldnt be in the same app that opens the cmd?

if so, you could have (pseudoish code)

string KB = getKB();

CreateProcessA(NULL, "cmd /K runExploit.bat " + KB, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);

and boom, the batch file has access to the KB and the only thing the user needs to do is hit volume key

[edit] i know why, because that command line is almost useless and cant be admin. ignore me.
[Windows RT Development and Hacking] lilstevie:
This is probably the best way, You are restricted to files within the the users library paths, and that have been created by your app by default
[Windows RT Development and Hacking] djboo:
indeed - the CMD launched via metro has a totally different %TEMP% from a normal CMD (and thus any other batch file)

this means you can hardcode the paths in the exploit batch and it pretty much works as a simple two step process (run metro app, run exploit bat) but it sounds like nethams approach would be neater.

[edit] more thinking out loud than anything... theres no reason why the file stuff couldnt be done in c# and the exploit stuff be called from that right? we have full pinvoke etc. So while this is possible in c++, the file stuff is much easier in c#. I will attempt to make a project that opens a file and edits it in c#. Even if we just use that as a base for making a c++ version, its gotta help.

[edit x2] one caveat of the limited access - removable media. an SD card will always be D:\ and can be written too fairly easily given the right permissions.

[edit x3]

protected override async void OnFileActivated(FileActivatedEventArgs args)

{

var t = args.Files[0] as StorageFile;

await Windows.Storage.FileIO.WriteTextAsync(t, "Hello from VS "+DateTime.Now.ToString());

App.Current.Exit();

}

that totally works (took so long because i was trying a much more convoluted way of doing it first) works from anywhere on the system. just about to try on surface, but the other stuff i tried was giving me the permission errors u were getting.

---------- Post added at 01:45 AM ---------- Previous post was at 01:06 AM ----------

seems too basic to share, but here...

https://dl.dropbox.com/u/923802/FileHandler.rar

POC, run it then quit it. make a 'teext' file anywhere on system as in 'bla.teext'

double click it, you will get a small message and the date/time.
[Windows RT Development and Hacking] netham45:
I tried pretty much the direct C++ equivalant of that and it gave me access denied. Is the file in the library path? I was purposefully trying with a file outside the library path (I put it in c:\temp.)
[Windows RT Development and Hacking] djboo:
my best guess is you didnt set up the association right. try it in the documents folder too - before i had the filetype set up right, it was telling me that failed due to permissions. its like once you have it associated, you get a free pass. I will try in some other places now for you tho.

{edit} - ok, c:\ didnt work... but %TEMP% totally did. and its the right temp folder, so that should work.

{edit 2}

just did a little test:

batch:

echo poop >test.teext

type test.teext

test.teext

ping www.google.com

type test.teext

output:

C:\Users\James\AppData\Local\Temp>test

C:\Users\James\AppData\Local\Temp>echo poop 1>test.teext

C:\Users\James\AppData\Local\Temp>type test.teext

poop

C:\Users\James\AppData\Local\Temp>test.teext

C:\Users\James\AppData\Local\Temp>ping www.google.com

Pinging www.google.com [173.194.67.99] with 32 bytes of data:

Reply from 173.194.67.99: bytes=32 time=28ms TTL=47

Reply from 173.194.67.99: bytes=32 time=34ms TTL=47

Reply from 173.194.67.99: bytes=32 time=30ms TTL=47

Reply from 173.194.67.99: bytes=32 time=32ms TTL=47

Ping statistics for 173.194.67.99:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 28ms, Maximum = 34ms, Average = 31ms

C:\Users\James\AppData\Local\Temp>type test.teext

Hello from VS 10/01/2013 01:57:46

this is pretty much exactly what you need right?
[Windows RT Development and Hacking] netham45:
Yea, but as I said, I've already got it working using my method, heh.
[Windows RT Development and Hacking] djboo:
i cant just sit here and twiddle my thumbs tho! ;)
[Windows RT Development and Hacking] Lexsym:
I'm trying to figure out what it is that I'm doing wrong. I'm trying to compile notepad++ from the source code found on the website using vs2012 to be ARM ready, so I can use it on my surface. I set the platform to compile for ARM (wasn't there originally so I clicked on the "<New..>" option. I use "Build Solution" (probably not right), and it gives me this error that I'm unable to solve:

1>LINK : fatal error LNK1181: cannot open input file 'comctl32.lib'

Here's a screenshot of what my properties look like:

On another note, when it is compiled for ARM, is it an .exe file that is output or is it another type of file?
[Windows RT Development and Hacking] netham45:
As previously said at least twice MSVC2012 doesn't have the .libs you need. You need to use a program to generate them. Search through the thread for info.

Also, there's a copy HERE, though I did not compile it, I don't know who did compile it, and I have not used it.

Edit: Just tried it, seems to work fine.
[Windows RT Development and Hacking] yokuyuki:
Right now, you still lose it when you reboot, right?
[Windows RT Development and Hacking] netham45:
Yes, the current exploit will never persist past a restart.

I'm working on getting it down to running one bat and pressing volume down to patch it on a reboot, though.
[Windows RT Development and Hacking] programabd:
P.S. not really useful here, but see below - a quick way to get kernel32.dll HINSTANCE and still have it pass the store cert (because VirtualQuery is legal for store apps you can do VirtualQuery of VirtualQuery :) )

HINSTANCE GetKernelInstance()

{

MEMORY_BASIC_INFORMATION mbi = {0};

VirtualQuery(VirtualQuery, &mbi, sizeof(mbi));

return (HINSTANCE)mbi.AllocationBase;

}

of course you can do GetProcAddress of everything now (once you GetProcAddress of GetModuleHandle)
[Windows RT Development and Hacking] netham45:
So, good news and bad news for my all in one script:

The good news is I have it all being handled by the bat file. Start it, wait for it to get everything, press voldown, then hit enter, and done.

The bad news is that most of the BSoDs caused by it can't be solved (Probabally 14 out of 15 BSoDs I get from it are DEREFERENCE_BY_POINTER(0x18), which is due to kernel memory being in a state we both can't check for and can't control.)

I'm not sure why the 0x18 bugcheck seems so much more common with my app over the debugger, but I can't really fix for it.

The other BSoD that it causes (I can't remember exactly what it was, SERVICE_EXCEPTION or something of the sort) can be solved, but it's infrequent enough I don't want to bother with it.
[Windows RT Development and Hacking] advancedservers:
Doesn't that mean your making extra calls to routines that dereference the object???
[Windows RT Development and Hacking] netham45:
Yes. There are two possible values for the byte, 0x00080101 and 0x00080000. We need the 8 to be a 0, and if the 101 isn't there we hit that bugcheck.

Basically, we can control the address that csrss looks for when it decrements it's object counter, and we set it to be that address in kernel space, and call it 0x80000 times to set the required signing level to 0.

Edit: I'm thinking about it, and I don't really see a reason we can't call it <0x80000 times, just to get the one byte we need to 0x0, and leave one of the other ones at 0x1 or something.
[Windows RT Development and Hacking] advancedservers:
So we could just change the first byte and leave the rest?
[Windows RT Development and Hacking] netham45:
Yes, we need the '8' to be a '0'. Since we cannot access non-aligned memory, though, we have to decrement it 0x80000 times.
[Windows RT Development and Hacking] GoodDayToDie:
Pardon if I misunderstood, but why *not* decrement it oh, 0x7FFF0 times? That way, if it was 0x80101, it will now be 0x00110 (which is maybe not ideal, but depending on what those other bytes represent it might still work) and if it was 0x80000, it will now be 0x0000F (which again may be less than ideal, but won't be the fully zeroed-out value).