yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] mamaich:
I'm playing with a 2Gb+ install.wim file, technically - a disk image. You have it on recovery partition.

Regarding the "catalogs". Yes, you are right. Files in SxS are not signed, but this gives us nothing. Sha256 hash of files is stored in manifest (Windows\WinSxS\Manifests), and manifest file is signed (\Windows\WinSxS\Catalogs). So we can't modify them, at least unless we can specify our own certificate for checking. And I see that at least some of the certificates are hardcoded in ci.dll.

There is another possible "hole": appication compatibility database (*.sdb files inside windows\appatch dir). SDB files can be edited on a desktop with an "application compatibility toolkit" (version 6.0 is a part of AIK since Windows 8). Desktop version refuses to load ARM SDB files, this can be fixed by patching 2 checks in EXE (but drvmain.sdb still cannot be edited). This is just a sort of an idea, as I don't know which compatibility hooks are present in RT and what do they allow. It may be possible to get out of metro sandbox with it (if "IgnoreShims" and similar hacks are present).

One more hole is abusing "Arm Debuggers And Tools-arm_en-us.msi" from W8 ARM SDK. Uploaded it to http://www.multiupload.nl/OWDHZIM1S9

According to strings, this MSI should contain a native ARM WinDBG executable. If it is present, and if you can run it - you can do everything you need: edit memory, attach to running processes, patch their code (but only in user mode, so no ntoskrnl patching).

There are several more ideas, but I'll check them myself when I'll buy a device (only next year).

Regarding "getting desktop Apps to RT". x86 apps cannot be run, as CPU is different and OS gives us several limitations like the requirement of relocs section in EXE.

I've already made a working prototype of a tool that emulates x86 CPU (dosbox and bochs are used as 2 CPU emulation plugins) passing wrapped WinAPI calls to an underlying OS. Now what is is needed - a "desktop-unlocked" RT device to make some testing and debugging. I'm developing it on PC, and simple programs are already working. First versions of this tool would be freeware and partially opensource.
[Windows RT Development and Hacking] GoodDayToDie:
Remote debugging on ARM is already available, and gives the same access as a local WinDBG except for the inconvenience of needing an additional PC. Incidentally, via the debugger, it's already possible to make trivial (and possibly not-so-trivial) changes to the execution of a loaded program. In theory, that could be used to run arbitrary programs (load a signed app, then after the signature verification, use the debugger to load the code of a different app and invoke the new app's entry point).

One possible option to take advantage of this is to write a TIFKAM app that uses the debugger APIs. Normally, the AppContainer would prohibit such an app from attaching to non-AppContainer processes, but it *may* be possible (via the Local Security Policy editor, which has a policy for granting specified accounts the ability to attach a debugger to any process in any user account) to bypass that restriction.

That's a kludged approach, and I'd much rather find one that makes use of something like TestSigning mode (even if it requires a kernel-mode exploit), but it may work nonetheless. Once we get even a single non-sandboxed unsigned (or custom signed) app running, it should be possible to use it to launch additional apps through one method or another. If that first launch has to be done via a remote PC, so be it... not ideal, but it would work.
[Windows RT Development and Hacking] netham45:
Don't forget that you could attach to the remote debugger as if you were a remote client by just requiring network access.
[Windows RT Development and Hacking] mamaich:
Update: regarding app compatibility toolkit. There are only few shims in RT (unlike several thousands in desktop 8): WinRTTestShim, FakeMalformedURI, DisableKeyboardAutoInvocation, "shim engine off" and "WindowsXPAppsHelpMechanismBlockedTestApp.exe" tests from XP. None of them can be abused.

Local debugging at least would give you an ability to locally execute WinDbg scripts, say, to patch csrss.exe in memory.
[Windows RT Development and Hacking] clrokr:
Scripting is nice, but at this moment we just need to find the right place in the kernel to patch.

I seem to have found a nice place, running some tests right now...
[Windows RT Development and Hacking] samco08:
just a little message to send you good vibes!

and wish you good luck in your research.

I read this thread every day and I hope sincerely that you find a solution!

Good luck.
[Windows RT Development and Hacking] xsoliman3:
"I've already made a working prototype of a tool that emulates x86 CPU (dosbox and bochs are used as 2 CPU emulation plugins) passing wrapped WinAPI calls to an underlying OS."

I was thinking of a similar idea to cretae an x86 XP user mode environment. Emulate the x86 instructions but catch win32 apis and 'thunk' them into Windows RT equivalents.

---------- Post added at 11:30 PM ---------- Previous post was at 11:25 PM ----------

[How does the VS2012 environment and developer certificate sign Metro/Modern Apps? Does it just sign the package, and only applicable if the package is run in an App container.

I was wondering if we could use its signing mechanism to sign a desktop ARM app somehow (still only with the transcient developer certificate, but good enough for our purposes)
[Windows RT Development and Hacking] netham45:
The executables in the packages seem to be completely unsigned, I've edited them and they still run. As far as I can tell there are no signature checks when a process is executed with low integrity.

Edit: WinDBG on ARM seems to be incapable of connecting to a usermode process, even with administrative privlidges. All it gives is

"Could not attach to process XXX, HRESULT 0x80B00002

Could not attach to the application process from ARM architecture device."
[Windows RT Development and Hacking] Gotroot:
I do have to say thank you to all that is working in this thread. I just picked the Asus vivo up and am very willing to test !! I don't mind making a few bricks for research so please pm me if needed... Good luck
[Windows RT Development and Hacking] yokuyuki:
Subbed. Very excited to see where this leads to for my Surface RT. Thanks to all the devs working on this!
[Windows RT Development and Hacking] netham45:
I was looking for some more kernel-level vulns, apparently there's another font parsing exploit (MS12-078, CVE-2012-2556). It was patched in the update on the 11th, but it should be removable. This tweet was all I found on the internals of it, but it should be a decent start.

Edit: I'm not too good with the whole ASM thing, but here's what I got IDA to spit at me (For win32k.sys from the ARM version, file is dated Nov. 14th):

.text:00161AA4 ; =============== S U B R O U T I N E =======================================
.text:00161AA4
.text:00161AA4
.text:00161AA4 bVerifyMacTable ; CODE XREF: bComputeIDs+126p
.text:00161AA4 ADDW R3, R2, #0x106
.text:00161AA8 CMP R3, R1
.text:00161AAA BLS loc_161AB0
.text:00161AAC
.text:00161AAC loc_161AAC ; CODE XREF: bVerifyMacTable+12j
.text:00161AAC ; bVerifyMacTable+1Cj
.text:00161AAC MOVS R0, #0
.text:00161AAE BX LR
.text:00161AB0 ; ---------------------------------------------------------------------------
.text:00161AB0
.text:00161AB0 loc_161AB0 ; CODE XREF: bVerifyMacTable+6j
.text:00161AB0 LDRH R3, [R0]
.text:00161AB2 REV16 R3, R3
.text:00161AB4 CMP R3, #0
.text:00161AB6 BNE loc_161AAC
.text:00161AB8 LDRH R3, [R0,#2]
.text:00161ABA REV16 R3, R3
.text:00161ABC CMP.W R3, #0x108
.text:00161AC0 BHI loc_161AAC
.text:00161AC2 MOVS R0, #1
.text:00161AC4 BX LR
.text:00161AC4 ; End of function bVerifyMacTable
[Windows RT Development and Hacking] xsoliman3:
I noticed that as well, and can't explain it

Luckily the VS2012 Remote Debug Monitor (running on ARM, in admin mode) can attach to other processes ok and debug and potentially on-the-fly modify them.
[Windows RT Development and Hacking] clrokr:
It can. The network protocol doesn't seem too complicated either, so maybe we can script it.
[Windows RT Development and Hacking] mamaich:
Can you launch a new app from ARM debugger to debug it?

If you can - you may use this trick: http://msdn.microsoft.com/en-us/library/a329t4ed(v=vs.71).aspx
[Windows RT Development and Hacking] clrokr:
I can confirm that the registry key works in general (on ARM), but I haven't tested this scenario.
[Windows RT Development and Hacking] xsoliman3:
No. That gives the same strange error about not being able to create process from ARM architecture device

I'm still looking into why they can't attach to or start a process

The Remote Debug Monitor (running as admin) can attach

Also for info, tried getting a standard (signed) desktop app to load a hacked dll, but it wouldn't have it and give error about incorrect image hash / digital signature
[Windows RT Development and Hacking] GoodDayToDie:
@xsoliman3: Yeah, the check is enforced on LoadLibrary and variants as well as on CreateProcess. I tried it (using rundll32 and an ARM-compiled compatible DLL) and it didn't work (this was mentioned earlier in the thread, but it's long).

You could try modifying the local security policies to make it so that any user can attach a debugger to any process. This is dangerous, but it might help with the local debug issue. Otherwise, it may be worth exploring the differences between the local and remote debugger attach process. Can you debug the debugger?
[Windows RT Development and Hacking] xsoliman3:
Tried invoking a win32 api from PowerShell on RT as per

http://www.exploit-monday.com/2012/05/accessing-native-windows-api-in.html

but got the"Cannot invoke method. Method invocation is supported only on core types in this language mode." as per the comment in

http://jeffwouters.nl/index.php/2012/10/windows-rt-has-powershell/
[Windows RT Development and Hacking] smx06:
Another stupid idea:

- to sign arm desktop app (or even driver) with Verisign (Semantec) purchased certificate (like we do for x64 drivers and so on).

(sure some people here have access to such certs to test this)

i.e. Does winRT allow only MS internal certificates?
[Windows RT Development and Hacking] netham45:
We can self-sign and add our certificates to the certificate store, but it still doesn't run them. A paid cert shouldn't be any different.
[Windows RT Development and Hacking] clrokr:
Yes, code integrity policy requires signing level "Microsoft" which is the highest.
[Windows RT Development and Hacking] x0n:
powershell 3.0 constrained language mode

Yeah, you're out of luck there - constrained mode means no property setters (but getters ok) nor any method calls for .NET and only a subset of permitted cmdlets (no add-type for dynamic code for example.) There is a white list of CLR types allowed, but nothing exploitable AFAICT. I've spent a fair amount of time on this already. CScript/WScript is also reasonably locked down at first glance.

-Oisin
[Windows RT Development and Hacking] netham45:
Since the debugger is already capable of injecting/running custom code we don't really need to look for a vulnerability in the scripting engines. It wouldn't get us anything new.
[Windows RT Development and Hacking] x0n:
Well, I had spoken too soon - after I had read through this thread, I had a few ideas and I just spent the last two hours with the remote debugger to remove a lot of the restrictions from a live instance of an elevated shell. But you say it doesn't get you anything new, so that's ok. Good luck!
[Windows RT Development and Hacking] netham45:
I'm not saying that there's anything wrong with hacking it (It'd be interesting to have a full Powershell & Scripting host), just that any vulnerabilities in it won't lead to anything we don't already have.
[Windows RT Development and Hacking] x0n:
I'm curious to know why debugging desktop applications is allowed at all on WinRT since we cannot develop them officially. It seems to me a quick "fix" for Microsoft is to modify the ARM remote debugging tools to deny clients from attaching to desktop apps. Since the tools themselves are signed, this couldn't be circumvented.
[Windows RT Development and Hacking] netham45:
My guess is that the RT system was designed from the start to support desktop mode apps, and the signature checks were shoehorned in at the last minute. MS had been flipping around on what it supported in desktop mode for quite some time until they finally announced, I believe in July, what it would be.
[Windows RT Development and Hacking] Slymayer:
CotullaCode (The guy who ported WP7, WP8 and Windows 8 RT on the HTC HD2) managed to compile and run 7Zip on the Surface, I asked him how, here are his answers :

https://twitter.com/CotullaCode/status/287271124222492673

https://twitter.com/CotullaCode/status/287270807179231233

But, what is this LEORT thing ? (I'll try to find out myself until someone answers...)
[HTC One X] kalitza:
Is there any way to fix wifi issue with an flashable zip or something, or is just possible to solve by getting into hardware?

Cheers
[HTC One X] Louisblive:
Since it is a Hardware fault, you cant fix it without replacing/reparing the antenna. :(

regards Louis
[HTC One X] _deleted_:
You should explain what your claim your WiFi issue to be. Describe it more and we'd be able to explain whether its the radio you are using (a software zip fixable route) or a hardware fault (death grip maybe).

Sent from my HTC One X
[Galaxy S I9000 Q&A, Help & Troubleshooting] jackryder:
Hi,

I'm looking to root my i9000 galaxy s. Its running firmware version 2.3.6, Baseband I9000XXJW4. Ive tried rooting via SuperOneClick CF Root using Odin, But nothing is working! All i want is to root my phone! Please could someone help me, by providing me downloads and step by step or whatever you have to do to try to get my phone Rooted!

Please help!

Thanks!
[Galaxy S I9000 Q&A, Help & Troubleshooting] xsenman:
you can try other rooters on My Android collections link below, or it may be easier to just flash a semaphore or CF Root kernel with Odin to install superuser app on your phone
[Galaxy S I9000 Q&A, Help & Troubleshooting] jackryder:
Hi, ive gone into your tooters on your profile and it just sends me to download links which i dont understand as im a 'noob'. Please could someone just send me to a thread or something or tell me what to do as its getting frustrating, ive followed tuts on youtube, on here ad nothing is working

please help!
[Galaxy S I9000 Q&A, Help & Troubleshooting] Oct-Al:
Root gt-i9000 xxjw4

I rooted my phone using this link: http://www.theandroidsoul.com/xxjw4-root-and-clockworkmod-recovery-for-galaxy-s/

Take a look.
[Galaxy S I9000 Q&A, Help & Troubleshooting] jackryder:
Sorted out :) It was my drivers, they needed updating ive rooted and installec a custom rom :victory:
[AT&T Samsung Galaxy S II Skyrocket SGH-I727] xxsicknessxx:
What's the point does it slow the phone down a lot? Is it helpful anyone on here use it
[AT&T Samsung Galaxy S II Skyrocket SGH-I727] iHenry:
I used Cyanogenmod 9 and encryption with my Galaxy Skyrocket. I upgraded to Cyanogenmod 10 and encryption is broken. Hope they get it fixed soon, because I really need it. If no fixes come out I may be forced do downgrade back to v9 to that I can enable encryption again.
[Samsung Galaxy Nexus] cpatel529:
I cracked my screen on my galaxy nexus and looking for replacement. If anyone has a galaxy nexus (mine is GSM version) that doesn't work but screen and digitizer are functional, please let me know. Thanks!

Chirag
[Defy Q&A, Help & Troubleshooting] Confidential:
sorry for the title, this is defy plus (+)

please help me!! i am extremely nervous since buying this phone took a lot of saving.

i was trying to install CM 9, the instructions were a bit confusing specificly this line:

i just assumed he missed a few letters when saying "DO NOT FLASH KERNEL ZIP"

so i flashed CM9 kernel. then i got this error: in a black screen

with a few other things Like "battery ok" and stuff

"Err:A5,70,00,00,23"

so i downloaded an SBF from this list http://sbf.droid-developers.org/umts_jordanplus/list.php

DEFYPLUS_U3_4.5.1-134_DFP-161_HE_SIGN_UCADEFYEMARAB1B80AA004.0R_PDS03C_USAJRDNGIBRPRNIL_P010_A021_M001_Service1FF.sbf.gz

and flashed with RSD lite using these instructions

and in step 8(i waited till it says "pass") i was looking at my phone, it had a white led, looked at it for a few seconds and tried to hold the power button to turn it on or something. then it disconnected from the RSD lite.

then i disconnected from usb and tried to turn it on. but nothing.

please help. i really need this phone.
[Defy Q&A, Help & Troubleshooting] Confidential:
bump

bump.

please, i really need your help! i'm sorry if i did "light" investigation in search of an answer, i did a mistake twice following guides.

and i want something more specific for me. (i have BL7)
[Defy Q&A, Help & Troubleshooting] Confidential:
was an idiot and tried to flash a lower level BL,

flashed BL7 and it's all good now.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] splotz:
Hi,

often I want to sort my videos recorded by the PVR with my Tablet (ed.: Easier seek and rename)

and watch it also on my big TV via HDMI (less complicated atm then to stream it).

So I need the USB-Stick connected to it and the HDMI, too.

Is there some kind of adapter providing this with the SGN10.1 ?

Regards

Splotz
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] splotz:
Not possible ?

ed.:

I found the pinout of the SGT10.1.

edit: Its SGT 7", but maybe the same pinout

http://xdaforums.com/showthread.php?p=14612129

Looks like it could be possible to use "all" things..

Hope there will come a dock or keyboard dock to use it like a full port netbook.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] splotz:
Or is there already a multimedia dock available ?
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] toenail_flicker:
Don't think so.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] splotz:
Something like that for the Note 10.1... wanna have...

http://www.pocketables.com/2010/08/dell-streaks-proprietary-connector-is-actually-pdmi.html

(these pins are different, but it should be easy to build something similiar if samsung did not "lock it down" in some way)

ed.:

Here is something about how to build your own cables.

http://xdaforums.com/showthread.php?t=1155065
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] mano42:
The only thing I really liked about asus TF300 was the ability to easily connect usb hdd (even ntfs) to the dock while it was connected to TV through micro-hdmi. I set up a bluetooth keyboard and mouse and managing the tablet on the tv was a peace of cake. But I returned it because the performance sucks on TF300. I really wish there were some similar dock for the note tab too.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] Nefariouss:
I think the Note can connect to the allshare cast dongle with is wireless mirroring. To basically the same thing. Or if you have a newer Samsung tv it connects wirelessly. to it as well.

Not sure if you can connect a usb hdd to the Note though through the usb connector.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] splotz:
Thx, thats true.

But I am looking for hardware connectors for HDMI, USB, Charging and Audio at the same time. Like a "real" Multimedia Docking Station / Cable.

Usable everywhere with HDMI TVs, etc...

(Maybe the SGN10.1 has also analog TV+Audio out as I saw some adapters for Galaxy Tab with these connectors)
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] endhalf:
Soo, it's half a year later... I'm looking for the same solution as the OP... I want to be able to connect my Note to a HDMI monitor, then have at least 2 usb ports (mouse and keyboard, third one would be nice) and be able to charge it at the same time. I'm looking online for a cable that would allow that but it seems impossible. Is there any hope for Note to be an interactive center?

There is one solution though... I could buy the wireless hdmi dongle, then bluetooth mouse and keyboard (does Note support 2 devices through BT at the same time?) and thus leave the charging port free but that's not so good option considering that I wouldn't be able to plug even USB stick through such setting. Still, that would cost a lot more than I'm willing to pay for it since I don't have BT keyboard nor mouse and the wifi gadget is too expensive if you ask me.
[Galaxy Note 10.1 Q&A, Help & Troubleshooting] fencelizard:
hdmi and usb at same time?

the diagam posted under 'build your own cables' shows all the connections on the 30 pin connector, but doesnt yet show which wires hook to an hdmi cable, or how to hook up hdmi.

further confusing is the fact that none of the labels for the pins on the samsung connector match any of the signals listed in the hdmi Wiki page.

would someone who has opened an hdmi adapter or dock please post wiring info for an hdmi hookup?

please? or perhaps high res photos of both sides of a dock connector board?
[Galaxy S II Q&A, Help & Troubleshooting] MajorAly:
Hello guys,

I have been encountering this problem since I can't remember when. I started using PA Jelly Bean ROM for my Galaxy SII I9100 from the 1.992 Version. I'm on 2.10 now.

I have been encountering this problem ever since and I run the phone in default mode, meaning no tablet or phablet mode and no other settings tweaked either.

The problem is that when I expand the notification bar, the Remove All Notifcations icon on the top right is barely visible. You can check the image below:

Anyone else who has encountered the same problem and was able to fix it?

Apart from this, one also cannot use WI-FI DIRECT and the smileys in video mode crashes the camera app.

Thank you in advance. It is really an amazing ROM.
[Galaxy S II Q&A, Help & Troubleshooting] Jokesy:
This is ParanoidAndroid General questions and answers: http://xdaforums.com/showthread.php?t=1881156

Ask your question there

Swyped from my Samsung Galaxy SII
[HTC ChaCha] elias17:
i have an htc status from AT&T and unlocked with lebanese sim card can i unlock the bootloader ??? can i treat it like an htc chacha ?? or they are different ?? can i use the chacha developement on my status ??
[HTC ChaCha] Alex C.:
*sigh*... a little bit of Google search would've given you the answer.. they are basically the same phone, branded under a different name... there are a few hardware differences, but that's only because of different network regions..
[HTC ChaCha] elias17:
i know the differences :/ all i want it to know is that can i flash chacha roms on status ? cdma evo 3d roms dont work on gsm evo 3d see why i asked ? thx in advance
[Sprint HTC EVO 4G LTE] gdrocks:
Using Deck's CM10, modifying the apk files and am able to flash them properly (although sometimes Phone.apk decides it doesn't want to work anymore after modifications...)

I modified both Phone.apk and MMS.apk to change the default icons, but they don't seem to be taking after I flash them to my phone. I still see the default icon for both (blue phone for Phone and green message for MMS) I did get the notification bar to change for MMS, which is some progress.

I check contacts.apk, but didn't see any relevant image files in there. Where should I look to modify these images?
[Sprint HTC EVO 4G LTE] one_love_420:
Why modify the apks? Make a theme that changes them, that is the best way to change them and doesn't mess with the actual apks. But which images are you changing. Our phones are xhdpi
[Sprint HTC EVO 4G LTE] gdrocks:
I changed ic_launcher_phone.png in the xhdpi folder in Phone.apk and ic_launcher_smsmms in xhdpi in MMS.apk

Here is what it looks like so far: http://imgur.com/a/TTmJF#9

How would I make a theme over the stock launcher? Would I still be able to theme the status bar icons?