yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] Myriachan:
Nice job, netham.

I'll try incorporating this into what I'm working on. My implementation works like this:

1. Start Notepad with a specific name in the title bar.

2. Attach nonobtrustively to Notepad with cdb.exe.

3. Overwrite user32!GetMessageW using a cdb.exe script.

4. Use taskkill to send a WM_CLOSE to that Notepad, causing the GetMessageW overwrite to execute.

5. The injected code I wrote with cdb.exe loads a DLL and runs it. It loads the DLL by mapping it as a file instead of an image, then marks it PAGE_EXECUTE_READWRITE with VirtualProtect.

6. The initialization sequence of the DLL fixes relocations and loads imports.

7. The DLL finds csrss.exe in the current session.

8. Open ntoskrnl.exe and ci.dll to look for the needed addresses.

9. EnumDeviceDrivers to find the ntoskrnl.exe and ci.dll base addresses.

10. The DLL injects itself into csrss.exe using NtMapViewOfSection and RtlCreateUserThread. (CreateRemoteThread can't be used on csrss.exe, because the new thread will try to connect to csrss over LPC.)

Steps 1-10 are already implemented and working. This leaves the next few steps:

11. Use the exploit to set g_CiOptions as per this thread.

12. Load the driver using NtSetSystemInformation(SystemLoadAndCallImage).

13. Use DeviceIoControl to communicate with the driver in order to set the variables we want.

14. Unload the driver somehow.
[Windows RT Development and Hacking] lilstevie:
I really don't get the point of this, we already have an established and working "jailbreak" (god I really hate this term) procedure.
[Windows RT Development and Hacking] Myriachan:
No volume button required. No 2 minute delay after boot. No hardwired addresses - the last remaining one in the .bat file, in winsrv.dll, is obviated by thread injection. Higher stability, because we're not messing with csrss.exe's existing threads. No Internet access needed, because the code can find addresses without symbols.

By the way, Windows RT does not require validate signatures on .msi files. You'll get the otherwise-never-seen yellow UAC dialog box, and then it will install. So another part of my jailbreak is that you'll install it by double-clicking an .msi file. I've tested the .msi functionality. You could then even uninstall the jailbreak the usual way.

These are just improvements to make jailbreaking more user-friendly.

I'm not a fan of the term "jailbreak" either, but it's the current one.
[Windows RT Development and Hacking] cx1:
Me either, I always rename the bat FreeRT.
[Windows RT Development and Hacking] netham45:
It's also got the benefit of not being automatic at reboot, unlike what he's talking about. I think that this is part of the reason that MS decided it wasn't a security issue because it requires user interaction every single boot, and a malicious program couldn't possibly install it silently.
[Windows RT Development and Hacking] Denis_63:
Wow, a lot of news, GOOD news!!!

Myriachan

First, that .msi container doesn't need signature for installing - this fact simplifies installation process! And now, if anyone wants to create programs for non-JB devices with Win RT on board, all he needs - is to make out the program in .msi formfactor. Magnificently!!!

Heavenly!!! When ordinary users (like me) will obtain user-friendly variant of your product? Next moment - will your variant of JB be persistenet, or non-persistent, just like actual (Netham45)? If even non-persistent, it won't be the problem with those perfect features ))) We'll place it in auto-startup ;)

Netham45

About unsigned drivers. Should unsigned drivers be recompilled for Win RT (ARM), or non-modified drivers for Win7 (8) usage is possible (in .msi variant or by right-button clicking on .inf file) ??? And, also, when your usefull decision with user-friendly interface will be available for ordinary users???

Guys, thanks for your work and for your help from all Win RT users community :good:
[Windows RT Development and Hacking] lilstevie:
I was referring to what he was talking about
[Windows RT Development and Hacking] netham45:
We've been able to use MSIs for a while, I documented it in the desktop apps thread, I believe. I've even posted some MSIs (MWB, DosBOX). They're just a pain in the ass to deal with right now, and most people don't feel like it.

His jailbreak will also be non-persistent. The persistence is because we are not saving any changes to Windows files, but only overwriting bits in memory (which are reset on next boot). I would love to have a persistent JB, but we just don't.

Unsigned drivers need to be compiled for Windows RT. That should be obvious, it's an ARM process and kernel-space has no knowledge of any JIT languages, so everything is compiled into assembly before being ran. x86 assembly will not run on ARM.

As far as the kernel exploit, it's available in the latest version of my jailbreak (1.2.0). There are also some other tweaks in there (registry-based startup, cleaned up how I check for admin, etc...), but since there are no ARM-compiled drivers available it's not really required to update right now.

And I was referring to my jailbreak in relation to his.
[Windows RT Development and Hacking] Denis_63:
Clear... but what about uselessness of "Vol -" button pressing? Its the great step forward, I think :good: Automatical startup will be the solution for non-persisting ;)

Sad, but true (c)... but what about non-system, for example, peripheral drivers - printers, scanners etc. Its very simple, does peripheral drivers also need recompilling? :crying:
[Windows RT Development and Hacking] lilstevie:
Ah right.

Personally I think it is a great step back, the step requiring you to press "vol-" is one of the reasons microsoft aren't as interested in patching the exploit at this point in time, the more "Automatical" it becomes, the bigger the chance of it being used malliciously becomes, at which point microsoft will be forced to act (infact it would be rather irresponsible of them to not patch it at the first signs of mallicious use).

Yes
[Windows RT Development and Hacking] Myriachan:
That's not really what unsigned .msi files allow. Being able to use an unsigned an .msi file doesn't allow bypassing the signing protection for programs. It mostly lets you make scripts that install files to your system and modify the registry. It does not let you actually run .exe files installed in this way. Using an .msi would work well for installing the jailbreak itself.

Well, it depends on the definition of "persistent". Sure, it wouldn't allow unsigned boot-start drivers. It would still mostly transparently run the jailbreak as an automatic-start service. A console window would probably flash for a second, since until you log in, you're seeing session 0.

How difficult would it be to show "Jailbroken" in the matter that "Test Mode" shows up in the lower-right corner of the desktop? I never determined how that feature works. Also, how hard is it to add audit messages to the Security log? I think that at least making the jailbreak's presence known is important. If someone could remove such a watermark, they could already do the same thing as we're doing, but in a malicious context.

By the way, while I appreciate that you've quickly accepted me as "one of the boys", I'm female. :)
[Windows RT Development and Hacking] Denis_63:
seriously

OMG, I don't believe everything so badly and fearfully with M$. I don't really think M$ to know about xda indeed :cool:
[Windows RT Development and Hacking] Myriachan:
It's no more irresponsible than it is on x86 Windows. The same bug works on both x86 and ARM, yet Microsoft didn't fix it there, either. The exploit doesn't allow anything more than is already possible on PC.

To me, it seems like Microsoft's security team disregards the marketing team in many ways. As Raymond Chen has many times put it, the jailbreak exploit can only work once you're already on the other side of the airtight hatchway. You have to have Administrator access in the first place, so their security team doesn't see it as a true security hole. Just my hypothesis on the topic.

Another thing that might work is to sign the jailbreak .msi with a normal Authenticode certificate. Since that signing check appears to ignore the kernel and ci.dll's configuration, it might show a green UAC screen for such signed .msi files. This would be a further deterrent, since malicious software doesn't often have such a signature, and would show the yellow screen instead. (Of course, how many users pay attention to it...?)

---------- Post added at 01:42 AM ---------- Previous post was at 01:32 AM ----------

The jailbreak's press coverage said it was made by people on this forum, so Microsoft knows.
[Windows RT Development and Hacking] netham45:
This. It would likely be rather trivial to find some code path in csrss that we could detour to allow us to run it at a whim, but the user interaction likely has a play in MS's response to the jailbreak. It was intentional, I believe by myself and other devs, that we didn't look for a way around it. The two minute pause is in a similar boat, imo.

Edit: I don't believe that comparing it to the desktop will have any impact on MS. I agree, it is no more dangerous than on desktops, but then again, MS is actively trying to avoid the cat and mouse game that security vendors have had with virus writers since widespread usage of the internet came about. I think that, ethically speaking, intentionally limiting users is not the right path to achieving that goal, but it is probably the most effective means. Remember, it's more than just what is right and wrong (or, responsible or irresponsible) with the jailbreak, it's also a game of staying under MS's radar so they don't patch us out. The last thing we want is them to pull an Apple and actively fight against us.
[Windows RT Development and Hacking] Myriachan:
Or avoid detouring anything at all, like mine.

Your point stands, however. I just think that an alternative means of not drawing unwanted attention from Redmond while improving user friendliness is possible.
[Windows RT Development and Hacking] netham45:
You're detouring user32!GetMessageW. </semantics>

But, really, the only issue I have with your methodology (other than it being a tad complex, and thus error prone, but mine has that same issue), is that it cuts out some of the things that I think have kept MS off of our backs.

On that note, what do you find that's not user friendly in my tool? I thought it was rather straightforward. It doesn't have a clean GUI and whatnot, but it does what it does in a simple means.

On a totally different idea, I wonder if we could create a service that gets ran at start that just does something like run a script host (or even just a batch file) that waits for a file or other means of instruction (could a named pipe be opened from CMD? echo < \\.\pipe?) to get created that could then fire off the automatic jailbreak, then it could be theoretically controlled from a nice clean Metro app.

I literally spent about 30 seconds deciding on that, I didn't realize it was going to be the most contested part of my tool.

Also, in hindsight, I should have named it an unlock, since that's what the WP crowd generally uses.
[Windows RT Development and Hacking] Myriachan:
I meant not detouring anything in a critical system process =)

Yes, a service could create a named pipe like that. Though cmd doesn't seem to like \\.\ stuff, I bet cscript doesn't care, and batch files can always run cscript as needed.

Accessing such a pipe could also be done through a Metro program if you put an ACE for "ALL APPLICATION PACKAGES" in the pipe's ACL. The bigger problem would be making a Metro application that anyone could run without a developer certificate. If you used the jailbreak code to disable Metro signature checking, that'd open up app piracy.

Installing a simple tile on the start screen that ran a batch file would work. It could even be installed by an .msi file, and there exist ways to have a full tile bitmap for a desktop program.

Even if you wanted to stick to .bat files, you could make the whole installer a single file. Trickery with cscript can be used to output executable files from a textual hex dump, and cscript can be generated by batch files.

cscript can't do arbitrary binary files with the lockdown in RT, but it can do Unicode text output. If you write a file in Unicode mode, cscript will prepend a UTF-16 BOM. To get around this, write the conveniently-ASCII letters MZ to the file in ANSI code page mode, which works for all Windows system code page settings, then open the file in Unicode mode for append. Write words with ChrW(&H1234). As long as the file's size is even, this technique works.
[Windows RT Development and Hacking] netham45:
It'd probably be better making the file a zip (zips exist in the bottom of the file, completely independent of what's at the top) and making it extract itself. I think one can call explorer to have it extract a zip, but I'm not sure.
[Samsung Galaxy W I8150] imadiu:
Any CM9 users experiencing a stoppage in time? What I meant was, the clock at the top right corner of the screen doesn't move but the clock in your lock screen does. Is there a fix for it? What I can do is to, change the font of the am/pm to normal and back to small
[Samsung Galaxy W I8150] [iop]wah:
not sure about the clock stopping, but with your other question about the font size you can go to:

Settings+System+Status Bar+AM/PM style+choose small...
[Nook HD, HD+ General] dtonlinux:
Hi,

I m thinking about picking up a HD+ for home use as the HD goes everywhere with me. Wondered if anybody had both at all? Also apart from cpu clock speed are there any other hardware differences??
[Nook HD, HD+ General] leapinlar:
Of course I have both. I use both for developing. But other than developing I use them for different things.

The HD is super as an ereader. It is lightweight and very easy to hold for long reading sessions. It is very mobile also.

The HD+ is great for reading magazines and just general surfing. I use it as my main device since typing and other things that require a large screen are very handy.

They both operate equally fast. I personally don't notice any big speed differences. But I am not a gamer either. I would say the only things you will notice is screen size and mobility.

Sent from my Nook HD+ running CM10 on Hybrid SD
[Nook HD, HD+ General] dtonlinux:
Thank you for replying, I should also take the opportunity to thanks for all you work on removing the limits of this piece of hardware :) I am tempted by the larger one too, I don't game really so it's mostly for surfing etc where at home the big screen would be nice.
[Nook HD, HD+ General] docfreed:
I have an HD+ now and thinking of getting an HD also. Does the HD also have the magnetic on/off switch or the screen? And how is battery life.

And of course thanks for your great contributions to this forum!
[Nook HD, HD+ General] blazingwolf:
Yes, the HD has the magnetic on and off. Battery life for mine has been pretty good. I usually get a couple of days before having to charge. I'm using the CM10.1 hybrid.
[Nook HD, HD+ General] xviralx:
How would you rate the HD for reading comics? Currently torn between a HD and HD+. My primary role for this device will be for reading comics(Marvel, DC etc). I am currently using a cheap 800 x 480 reso 7 incher to read them which I find extremely troublesome. I'm guessing 7 inch would be too small to not require zooming in even with the high resolution on the HD?
[Nook HD, HD+ General] libertus77:
I concur with all Leapinlar said. I have one of each in my household. The HD+ is mine, so that's my primary. I do long for the HD at times when just reading, but the HD+ isn't too bad. Just have to come up with a good holding position.
[Nook HD, HD+ General] dbh369:
Let for me was getting a case that would hold the hd+ in both landscape and portrait modes.
[EVO 4G Q&A, Help & Troubleshooting] flint6:
I am rooted s-on, have been flashing roms for about a year. I have downloaded a couple of recoveries renamed them pc36img, but when i boot into recovery and try it use them it parses them. Is this because of s-on?
[EVO 4G Q&A, Help & Troubleshooting] CRIME INC.:
Yes. Download,Flash Image GUI,by Joey Krim from Google play. Then download the image file for the recovery you want and flash it that way.
[EVO 4G Q&A, Help & Troubleshooting] flint6:
thanks alot.
[EVO 4G Q&A, Help & Troubleshooting] CRIME INC.:
Make sure its the image file you download to flash. There available in smelkus's thread.
[EVO 4G Q&A, Help & Troubleshooting] hondafreak513:
Or he can use diablos new one..
[EVO 4G Q&A, Help & Troubleshooting] flint6:
image file? as in unzipping the zip file?
[EVO 4G Q&A, Help & Troubleshooting] hondafreak513:
No the file will have a "name_PG36IMG.zip" just delete the name part and put the pg36img.zip on the base of the SD card and go into boat loader and let it unload...
[EVO 4G Q&A, Help & Troubleshooting] flint6:
Will do. Thanks again
[EVO 4G Q&A, Help & Troubleshooting] flint6:
worked like a charm...this will make flashing roms alot easier.
[Galaxy S III Q&A, Help & Troubleshooting] chiupc94:
I have installed BBS to monitor my battery usage and I found out that I have No data connection and No or unknown signal or 100% ratio. My s3 is on slimbean 1.0 and my battery drain is unusual.
[Galaxy S III Q&A, Help & Troubleshooting] DjeMBeY:
It's normal, check kernel and partial wakelocks instead.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Twan199:
I was running SlimICS v4.2 for a few months, didn't have any problems.

But yesterday my battery was empty and when i charged the phone, it went to download mode.(downloading.. Android dude with shovel)

So to get out of download mode I pulled the battery, but it didn't work. Next I flashed it back to stock(2.3.3), the phone finally started and everything looked normal, but now everytime when i turn the phone off it goes into download mode. The only way to fix it is to reflash every time. So is there a way to get out of download mode without having to reflash everytime? (and reinstall all my apps and passwords etc)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Mairo:
which recovery mode you use? Have you tried to change recovery mode?

a few months ago I´m stuck with getting out from recovery mode (" reboot system" boot me back recovery mode) . I use old TWRP and then I instlled latest version and then it workt.

Just one idea.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Twan199:
I use CWM recovery. But I'm unable to boot into recovery. When I press the power button to turn it off and after that hold the combination to go into recovery mode, it goes into download mode.
[Defy General] todda7:
Hello.

I'm looking for a fast, stable and batterysaving everyday ROM for my Defy+ (red lens) phone.

This is NOT a 'best rom' question, I just want some input to find a ROM among all these GREAT options which is best suited for my needs. As there are loads of ROMs and versions, I'm hoping somebody else have been in my position and have a ROM to recommend!

I have tried Mokee, which was very fast, but a little buggy (dialer FC-ed when 3g) and not very well supported (yet) on Defy+.

Before that I ran the newest Quarx CM10 4.1.2 nightlies, but most of them have some irritating bugs (Wifi ch 11 not working, ringtone bug etc), and I don't want the hassle of having to upgrade the phone every week.

CM9, CM10, I really don't care as long as it is fast and stable.

Before that I ran the Pikachu-rom from TweetyPeety. It looked very nice, but developement is not continued and besides the not-so-great speed there were some bugs unfortunately.

Today I tried the newest CM9 (12-11-18) from Epsilon, but the batterydrain was bad compared to Mokee.

Thanks!
[Defy General] nedywest71:
If you want a STABLE rom for DEFY than only back to stock GB and MS2G or CM7.

I have also tried many of the CM10 but if Reability, Speed and Battery is TOP agenda than only GB for now.
[Defy General] todda7:
Like this http://xdaforums.com/showthread.php?t=1140839?

Newest version in first post, right?

Thanks!
[Defy General] eagleeyetom:
There is no such thing.

Thread closed.
[General Questions and Answers] andress.cz:
Hi,

I have seen here on forum patched versions of Google wallet so any device is supported. Can someone give me instructions how to patch similar app I have from my service provider and bank? Or patch it for me? I need it to accept different phone model (One X instead of galaxy s3). I attach the app. Thanks for any info.

Edit: I've tried editing build.prop but either it checks device in different way or I edited wrong variables or input wrong values
[Galaxy Tab 2 Q&A, Help & Troubleshooting] qaysy:
hi

can anyone guide me plz? i want to update my P5100 to official jelly beans manually as the update Via KIES is not available in my country as yet and neither My Country is listed in update receiving list,

My tab has the following details

GT-P5100

Android Version 4.0.3

Baseband Version P5100UBLD4

Kernel Version 3.0.8-365113-user se.infra@SEP-97 #1

Build number IM74K.P5100UBALD4

the tab belongs to Trinidad and Tobago region but i am residing in Pakistan, what and how i should do to update it to Official jelly beans ?

Regards and thanks in andvance
[Galaxy Tab 2 Q&A, Help & Troubleshooting] RavenY2K3:
Your in the wrong forum, but if you go here http://www.samsung-updates.com choose your model, you'll be able to flash any ROM for your device that you want via KIES?
[Galaxy Tab 2 Q&A, Help & Troubleshooting] qaysy:
Galaxy tab 2 P5100 official manual jelly bean update guide required

thnx

but my prob is i want to update it to jelly bean and the flash available for my tab according to firmwere is ice cream sandwich only. i just wanted to know can i put any other baseband firmwere on my tab or not
[Galaxy Tab 2 Q&A, Help & Troubleshooting] k1mu:
You're still in the wrong forum. And no, you can't put "any" other firmware on your tab - you can only install firmware for the specific model that you own.

Please ask in the Galaxy Tab 2 forums.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] RavenY2K3:
Here's a direct link to the P5100

http://samsung-updates.com/device/?id=GT-P5100

Looks like there are loads of Jelly Bean firmware available, you can flash any of them but obviously there are differences between them, regarding the region they're from.

There may already be one out for the region you're in/from you could flash that, then any subsequent OTA firmware for that region will apply to you. You will probably have to do a full wipe though for the CSC to be applied..
[Galaxy Tab 2 Q&A, Help & Troubleshooting] qaysy:
thnx guys

Thanks Guys

and sorry for being in a wrong room :)

i have put my question in galaxy tab 2 forum. any help would be appreciated. though i got my answer from Raven Y2K3 but i just want to cement the idea of putting different baseband firmwere on my tab. i am newbie in flashing things so pardon me for irritating you guys. thanks again
[Xperia Z Q&A, Help & Troubleshooting] wolvie77:
HI! all. I'm interested in this phone but want to confirm if this phone supports app2sd.
[Xperia Z Q&A, Help & Troubleshooting] ethan3686:
yes it does
[Xperia Z Q&A, Help & Troubleshooting] Dsteppa:
Let me guess, both of you didn't do any research.

*Cough* Dev section :confused: *Cough*