yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] netham45:
Working on that exact thing right now. Should have a result momentarily.

Edit: Seems to have worked, at least for the initial test. If all goes well, I should be able to get a 100% exploit rate.

Edit 2: 3 for 4 so far, with the one that failed being because the offset was off.

Edit 3: Still getting a crash. Going to try 0x7EFF0 instead of 0x7FFF0.

Edit 4: Seem to at least be getting a higher success rate with this method.

Edit 5: Hopefully not jumping the gun, but I seem to have gotten it except in the occasions where the offset is not what I've preprogrammed. I think I've got a means to fix it when the offset is wrong, but I haven't actually managed to get a debugger attached recently when it was wrong.

Edits are fun: I've tried it 7 times now, all worked. I've never had that success rate with it before, I'm going to call this one fixed.

More edit: It's odd, it only seems to give the SYSTEM_SERVICE_EXCEPTION when I don't have a debugger attached. Guess I get to go dig through a memory dump. Does it make sense that the debugger would be shifting everything down (0x....3646 -> 0x....3644) just by having a debugger on?

Edit 8: I can say with 75% certainty that I've fixed the 0x18 bugcheck.

Edit 9: I think the bug might be caused because the debuggers I'm using in the script don't have the PDB loaded for winsrv.dll, I'm going to give it the PDB and see what it does.

Edit 10: I've found out that the crash happens reliably if the exploit is ran within a few seconds of the system booting, it seems to work best if you wait at least a minute after logging in before running it.

Edit 11: Please see THIS THREAD for what I believe will be the final version of my jailbreaking tool.
[Windows RT Development and Hacking] carguy303:
Did anyone else get a bunch of security updates on their RT device today? My vivo tab just got about 5. One for .net 4.5 and the rest were just security updates for windows rt.
[Windows RT Development and Hacking] netham45:
Microsoft pushes patches the first tuesday of every month. It's also known as 'Patch Tuesday'.
[Windows RT Development and Hacking] carguy303:
these came in today. I installed the updates on Tuesday.
[Windows RT Development and Hacking] netham45:
There were no updates released today, according to my tablet.

As far as updates go, I'm fully updated with no issues exploiting.
[Windows RT Development and Hacking] hippogr:
one question about the shellcode, i don't understand the two instructions "mov r12, 0x10e1" and "svc 1". In my understanding, we need to call ObDereferenceObject 0x80000 times to disable the codesign flag, so it should call BL NtUserSetInformationThread in the shell code. Please correct me about my wrong understandings. :p
[Windows RT Development and Hacking] clrokr:
If you look at NtUserSetInformationThread in the debugger you'll find "mov r12, 0x10e1; svc 1". It's the system call convention.
[Windows RT Development and Hacking] apatcas:
yeah dude just cause u didnt get the updates before and its getting them all now. those are weeks old btw.
[Windows RT Development and Hacking] jtg007:
Awesome work. Thanks you guys!

Any chance we could get a step-by-step for re-compiling for ARM in VS2012? I've read this thread through multiple times and still can't make sense of it. I'm still stuck at "Compiling Desktop applications for the ARM platforms is not supported."

Thanks a ton!
[Windows RT Development and Hacking] netham45:
Read the answer on http://stackoverflow.com/questions/...op-programs-be-built-using-visual-studio-2012 , it has how to get past that.
[Windows RT Development and Hacking] Wischm0pp:
While trying to install Mouse w/o Borders:

Everytime I try that, it gives me an "Error 1053: The service did not respond to the start or control request in a timely fashion"

What do I do now?
[Windows RT Development and Hacking] hippogr:
Got it. Thank you very much.
[Windows RT Development and Hacking] lilstevie:
You are asking how to implement something for sideload crack, piracy is prohibited on xda-developers and you will probably have a hard time finding someone to help you.
[Windows RT Development and Hacking] GoodDayToDie:
@lilstevie: Whoa, there. I'm usually the one getting upset at piracy around here, but there are legit reasons to hook a function export too... is there some particular reason that you suspect the code snippet in question of indicating piracy? Yes, I can see how it *could* be used that way, but I can see some other and more legit ways as well.
[Windows RT Development and Hacking] lilstevie:
I looked at the code he was referencing and it is directly from the source for sideload crack as in line for line
[Windows RT Development and Hacking] netham45:
A sideloading crack is -only- good for piracy, too. There are legitimate ways to sideload apps that are intended to be sideloaded. Developer certificates will let you run any non-store app fine (by sideloading them), and businesses can purchase sideloading keys from Microsoft (I believe the requirement is to have a VLK agreement before you can purchase them, but I'm not licensing specialist).
[Windows RT Development and Hacking] GoodDayToDie:
Yep, yep. I agree, and am not going to help that guy. It's too bad - there are legit reasons for API hooks, and now I'm going to have to be careful about discussing them because of a-holes like that.
[Windows RT Development and Hacking] Bjray:
For some reason I'm getting an error when trying to start the service "(Error 216: 0xd8) - Windows could not start the MouseWithoutBorders service on Local Computer. "
[Windows RT Development and Hacking] netham45:
Have you jailbroken your tablet?
[Windows RT Development and Hacking] Bjray:
Sorry forgot to run it! lol

Worked perfectly thanks!
[Windows RT Development and Hacking] williams37:
First of all, your work is greatly appreciated. People like you are the reason Windows RT WILL have a future.

Anyways, I have followed your directions to a T and still am running into errors getting mousewithoutborders to launch. I have tried

with your jailbreak 1.03 and 1.11.

I copied all the program files from my laptop to my tablet at C:\Program Files\Microsoft Garage\Mouse without Borders.

Then in Command prompt (admin) I run the command sc create MouseWithoutBorders binpath="c:\Program Files\ Microsoft Garage\ Mouse without Borders\To\MouseWithoutBordersSvc.exe". In services.msc I can see the service from Mouse Without borders but I get this error. Any ideas?
[Windows RT Development and Hacking] Wischm0pp:
I just put it in C:\MwoB\ so its easy to find. [EDIT] Just found your error. You have a /to/ in your file path, you should delete that. ;) But I still keep running into this Error:

Error 1053: The service did not respond to the start or control request in a timely fashion.

Anyone know how to deal with that?
[Windows RT Development and Hacking] williams37:
Wow Can't believe I couldn't figure that out. Worked perfect after deleting the service with the "\to\" in the directory, then created it again. Good luck with yours, If you haven't already tried, I would run the newest jailbreak, run sc delete on the service, and just try again. Again, thanks for the catch!:good:
[Windows RT Development and Hacking] sasquuatch:
there's a video instruction on this?

I do not understand :(
[Windows RT Development and Hacking] Darkholme04:
REFERENCE_BY_POINTER (TSDDD.dll) error

Anyone know anything about this error I get when I try to jailbreak?

REFERENCE_BY_POINTER (TSDDD.dll)
[Windows RT Development and Hacking] blacknet101:
Can this program somehow be ported?

I know not to many people are interested in this program but I would want to know if it's possible to port it over. It's called :eSword

Here is the website: http://www.e-sword.net/

I use my tablet at my church to teach and I would love to have this running on my surface since it has all the Dictionary and References, I use this on my home computer but wondering if maybe I can get this running on the Surface?
[Windows RT Development and Hacking] SixSixSevenSeven:
wrong thread.

Also that is not an open source piece of software. Without source no-one will ever be able to port it.
[Windows RT Development and Hacking] C-Lang:
Check out the Logos Bible app on the app store! :good:
[Windows RT Development and Hacking] hks25258:
hi everyone,i need help.

I want to get this file 'Arm Debuggers And Tools-arm_en-us.msi',but this file the download link(@mamaich post in page 16) http://www.multiupload.nl/OWDHZIM1S9 of file has deleted.

which friends can to reupload,very very thanks!
[Windows RT Development and Hacking] mamaich:
https://mega.co.nz/#!0pRRzKBR!Ed4B4j0Wd8ej6a8qef0yw3W8z_kWjDokn0147nRSvsU
[Windows RT Development and Hacking] hks25258:
wow!very thanks for you:D
[Windows RT Development and Hacking] seven7xiaoyang:
so，if the RT is based on snapdragon soc，you will like it ？
[Windows RT Development and Hacking] noloader:
> It honestly just feels like my Surface's value has magically increased by $300.

+1. I'd love to removes these cursed tiles altogether. They are great on a phone, but absolutely suck on a desktop computer (the tablet is docked using a powered hub with keyboard, mouse, and monitor).
[Windows RT Development and Hacking] Jacobobber:
Whenever I try to run the jailbreak it gets to: ERROR:unable to find the specified registry key or value. Waiting for uptime to reach two minutes. Then it pops up some text and quits cmd. Please help?
[Windows RT Development and Hacking] nar001:
So the new method weirdly enough doesn't work for me, it doesn't do anything. Anything else I should be doing?
[Windows RT Development and Hacking] Valerianus:
Good work. I hope to see VLC and some other open-source stuff on this eventually. Pity there was this limitation on Windows RT.
[Windows RT Development and Hacking] lettuceman44:
Gah, if I could run a Java IDE like eclipse on Windows RT, then I would buy it in a heartbeat.

Eclipse is written in Java though, so recompiling it wouldn't work in Visual Studio.
[Windows RT Development and Hacking] inexorable:
@lettuceman44 same thing for me, it's why i'm not going to buy Surface but a Windows 8 hybrid (pc/tablet) :|
[Windows RT Development and Hacking] lettuceman44:
I'm gonna hold out for a pro tablet unless someone makes an app for RT.

Like, that is literally the ONLY thing keeping me from getting an RT tablet. But, maybe there will be one.
[Windows RT Development and Hacking] int_19h:
Tried this on my Vivo RT:

> bcdedit /set testsigning Yes

An error has occurred setting the element data.

The value is protected by Secure Boot policy and cannot be modified or deleted.
[Windows RT Development and Hacking] mamaich:
Is it possible to attach the device to PC as a "mass storage" device to directly edit its partitions?

If this is possible - you can try to modify it with the following instruction:

There are several partitions on the device, that unknown partition should be one of the small partitions, it should contain "\efi\microsoft\boot\" directory or something like that (maybe "\boot" with the hidden "bcd" file).

Be warned - you may brick the device with these tests.

But I don;t think that MS would allow you to mount those partitions on PC.
[Windows RT Development and Hacking] GoodDayToDie:
Hmm... I tried a couple things, without success.

Using rundll32. I was able to build a DLL for ARM, and to run rundll32, but it refused to load my DLL. Not a big surprise, but it was possible that they were only enforcing the signature check on .EXE and other directly executable file types.

Signing the binary, and then putting my cert in the Trusted Root Certification Authorities store (the same place the Microsoft's code signing cert lives). Same result; it's as though the signature wasn't there or the cert hadn't been imported.

Boot to the command line and tried bcdedit from there; no dice.

Use the advanced startup settings to try and disable the code signing or enable test signing mode: those options don't exist. The Surface EFI boot menu *looks* cool, but is pretty useless. (Couldn't even change the default state of the damn function key...)

Mount the EFI system volume, go looking around in it. It's a pretty standard FAT32 system volume, lots of .EFI firmware and a crapload of language files, plus the BCD file. However, the BCD file is apparently held exclusively by another process; I wasn't even able to copy it.

With that said, I think there's ways around that kind of lock... if they can be done on RT, and if the BCD isn't signed somehow, and if the TPM doesn't freak out about a modified BCD, and...

Also, there's a "boot.stl" file, which may or may not be of any interest.
[Windows RT Development and Hacking] GoodDayToDie:
More adventures in bcdedit-land:

I copied out the BCD store, using the bcdedit /export command. I was then able to modify the exported store to add the testsigning value. However, when I re-imported it with bcdedit /import, the testsigning value was dropped along the way. I even copied the default Windows Boot Loader and added the testsigning value to the copy, then re-imported the store; the copy got imported fine, except that it was missing the testsigning value. Similarly, I was unable to add the testsigning value to the copy on the active store.

Looks like MS *really* doesn't want us to use testsigning. :(
[Windows RT Development and Hacking] xanderkaiber:
I had no problem turning on test signing on my development device, maybe it isn't as locked down as the surface
[Windows RT Development and Hacking] aristeua:
Hey guys, I've got a question: Can windows rt's command prompt run legacy DOS apps like windows 7?
[Windows RT Development and Hacking] Valerianus:
Only batch files, I think.
[Windows RT Development and Hacking] clrokr:
Working on it. Looks pretty solid though. Also, the RT has a TPM as opposed to the document that says it is a Pro-only feature.
[Windows RT Development and Hacking] clrokr:
I just used "Advanded Restart" to go to a command prompt, used diskpart to assign disk0\part2 to letter I and executed these:

bcdedit /store I:\efi\microsoft\boot\bcd /set {globalsettings} testsigning Yes

bcdedit /store I:\efi\microsoft\boot\bcd /set {bootmgr} testsigning Yes

bcdedit /store I:\efi\microsoft\boot\bcd /set testsigning Yes

It worked! Will keep you updated.
[Windows RT Development and Hacking] clrokr:
**** this. Something is happening before the boot loader gets control that ensures the EFI partition is intact. I can even wipe it out completely and it still boots and everything is back to normal. The "restored" file get a new timestamp though, interesting.
[Windows RT Development and Hacking] GoodDayToDie:
That would, presumably, be Secure Boot. Also, make sure that the testsigning flag actually gets set. Some of the ways I've tried to add it don't generate an error message... but they still don't add the flag, either.

I know it's possible to edit the BCD, because I've done so. I wasn't able to add testsigning, but I did create a clone of the default boot entry (with a different name). When I rebooted my Surface, it took me to a boot menu screen showing both options.
[Windows RT Development and Hacking] clrokr:
There is something checking specifically for testsigning. I'm digging through the UEFI firmware right now.

EDIT:

@GoodDayToDie: What was your method and also, what device are you using?
[Windows RT Development and Hacking] Cotulla:
Can somebody make Windows RT disk dump for me for research & development? I will very appreciate it. Privately of course :)
[Windows RT Development and Hacking] netham45:
Can you overwrite the system BCD instead of using the command-line to import it and retain that value? I'm not sure where it's stored on the surface, but it should be in a EFI\Microsoft\BOOT\ folder, possibly on a hidden volume. You may have to assign a drive letter to it (Note that I'm typing this from info on a Win 8 Pro desktop on EFI, run command prompt as admin. YMMV):

diskpart

>list volume

(We're looking for the EFI partition that has the BCD on it, on mine it's a 100MB Fat32 partition)

>Select volume #

>Assign

Check in My Computer to find the drive that was just created, and switch to it in your command prompt.

X:

cd EFI\Microsoft\Boot

copy BCD %userprofile%\desktop\BCD.bak

copy %userprofile%\desktop\NewBCD BCD
[Windows RT Development and Hacking] clrokr:
You can do what you want to the file, a reboot overwrites it.

I actually found a way to persist the changes:

1. Open a command prompt as NT Authority\SYSTEM (using the still-not-fixed Sticky Keys Bug)

2. Run regedit

3. Edit the bcd this way. The element value for testsigning is 16000049 i think. See http://www.geoffchappell.com/notes/windows/boot/bcd/index.htm

4. Edit the permissions on the "Element" key to disable write access.

You can see that it's there on the next boot, but it still isn't enabled. Also running bcdedit (even just listing the bcd, and even without admin permissions) removes this element regardless of permission settings. So don't do it.

Still digging through the UEFI Firmware.
[Windows RT Development and Hacking] netham45:
Just spitballing until I can get enough saved up for the surface, but if you use the options to disable driver signing does that allow custom kernel-mode code?
[Windows RT Development and Hacking] GoodDayToDie:
@clrokr: Wow, interesting find. I already discovered the overwrite problem, but didn't know about editing the registry. You say you were still unable to execute programs even when the BCD setting for testsigning was present? That's a shame... means something in the either the bootloader or the EFI is enforcing it. That doesn't really surprise me, I guess; Safe Boot is an EFI feature and that's supposedly what stops BcdEdit from adding the testsigning (or debug, I noticed) options directly. Still, a worthy avenue of exploration. Also, there are probably easier and less unofficial ways to get a CMD command prompt as SYSTEM (I know of a few official ways, although the option of simple impersonation from an Admin process probably would be hard to do on a Surface).

@netham45: Testsigning mode just allows executing code that is signed with anybody's certificate, instead of only with Microsoft's cert. However, there is another bootloader option - nointegritychecks - which disables driver signing enforcement entirely on "normal" versions of Windows. It might be worth pursuing that here too...
[Windows RT Development and Hacking] GoodDayToDie:
I actually have a couple ideas for doing this, but they rely on what amounts to outright security vulnerabilities in the OS.

One of them is to try flipping the testsigning mode option directly in kernel memory on a running system. This has been demonstrated to be possible on Win8 x86 with the nointegritychecks value, using a local exploit of the CSRSS process to overwrite some kernel memory. Whether the same exploit will work, or is even possible to attempt, on Windows RT... I can't say. I also don't (at this time) know where the testsigning flag is in kernel memory (although that's probably pretty easy to discover), nor whether it's useful to change it on an already-booted OS.

The other is to try and fool the signature check somehow. For example, this might be possible using the debugger; attach to a process that is legitimate and signed (say, cmd.exe) and then replace the program code with something else (the target EXE) and go to town. Of course, that isn't a real solution (unless somebody figures out how to run a debugger on RT, it requires an additional PC coordinating with the tablet) but it *might* work. Another possible option is to, instead of subbing in our own file after checking the signature, hook the signature-checking code itself (somehow) and basically spoof the result. *Waves hand* "These aren't the binaries you're looking for."

Either one will require a fair bit of research, and will probably rely on things that MS could patch fairly easily. That is (obviously) not ideal, but we shall cope. Hackers always do.
[Windows RT Development and Hacking] clrokr:
@GoodDayToDie: It seems you know a lot about Windows internals. I have read about at least a dozen different vulnerablilities in signed third-party drivers and also in Microsoft's own ones. Some of these have to exist on Windows RT as well. I have disabled Automatic Updates for the time being and also backed up the recovery partition in case that gets updated too.

I will continue digging through the UEFI firmware and the first stage bootloader (bootarm.efi). Thanks to Microsoft for sharing a firmware image with us. A vulnerability in the UEFI firmware would be great.

The Tegra3 TRM is also available on XDA, maybe i can find a way to just flash this stuff away.

Of course, the greatest thing ever would be a private key to sign stuff.
[Windows RT Development and Hacking] netham45:
Getting some fun stuff by screwing with the boot from USB stuff. I've gotten it to boot the built-on partition from the bootloader off of the USB, and it seems to fully preserve the BCD options, however testsigning doesn't seem to have any effect on running .exe's. I don't think that the bootloader on the recovery is checking kernel state, though. I'm about to try changing some string in the kernel to invalidate it and see if it still boots it.

Also, another thing, if you unplug the USB drive while it's booted from it it'll BSoD. Would a minidump do anyone any good?

Edit: Did not boot a modified kernel. A red pixel also appeared near the bottom of the screen. (Edited both ntoskrnl.exe and win32k.sys, both gave the same result.)

Edit 2: And editing the winload.efi file gives me this:

Trying to load a modified (and resigned) driver right now.

Edit 3:

/TESTSIGNING didn't seem to have any change, though I found it crashes if I try to force safemode. /DISABLE_INTEGRITY_CHECKS doesn't seem to do anything either.

Edit 4: Since playing with this my tablet now insists that I'm running Windows To Go and refuses to let me use the store. Beware, I suppose.
[Windows RT Development and Hacking] mamaich:
Regarding "The header checksum ... does not match". You should fix the checksum in PE header, it is a standard field. I usually use HIEW (hiew.ru) for this, as it calculates checksum automatically (press F8, then F3, then navigate to checksum, then press F3 and F9). Other PE editors may fix checksum too.

PE header checksum for drivers was used since NT4 (or may be even earlier), and, as far as I remember, it cannot be turned off, so you need to fix it before using a patched file.
[Windows RT Development and Hacking] netham45:
I did (using DSEO) then it whined about a bad certificate. Though I can try with hiew.

Edit: I'm stumped as of now. If anyone wants to try doing what I did, here it is:

Create recovery drive

Add entry on drive's BCD to boot to the OS (The two entries cause the menu to show)

Press F10 at boot menu on Windows 8

Enter Bitlocker Key (Get it from the URL it provides)

Edit boot options

I tried editing numerous files to no avail.
[Windows RT Development and Hacking] GoodDayToDie:
BTW, for the Bitlocker key, you can skip that step by temporarily disabling protection on Bitlocker (even if your Exchange server mandates device encryption).

Root prompt:

manage-bde -protectors -disable C:

What this does: It puts a plain-text decryption key into the Bitlocker metadata (normally, the decryption key is only stored in an encrypted form, and to decrypt it you either need to use the TPM, the recovery key, or some other so-called "key protector"). It's basically instant to do this, because the data on the disk is still encrypted. It allows Windows to automatically unlock the disk though, without you needing to enter the recovery key. However, it completely breaks the security of BitLocker. Once you're done, re-enable BL either by specifying "-enable" instead of "-disable", or by selecting "Resume protection" (or similar text) in the GUI.

Side note: this also works on Vista and Win7 (and of course x86 Win8). Very, very handy when modifying boot options.