[Windows Mobile Development and Hacking General] cr2:
No. I can't even imagine which device

is using it and what for.

I will suggest to change the booting logic.

The current code is ok for dumping the

complete page table, but unnecessary

complicated and buggy for just booting

linux.

Allocate the memory with VirtualAlloc and then use LockPages. Write 'memmove' in assembler and relocate the (possibly) 'discontinuous' pages to the destination.

We are also not forced to put the kernel

at the bottom of the memory.

Wince has the following physical memory allocation map/strategy:

1MB(+1MB) - kernel/buffers/page tables/etc.

ramdisk - grows upwards up to

the value given by

GetSystemMemoryDivision()/MEMORYSTATUS

The 'program' memory is allocated from

the TOP downwards. Here is some severely mess up code that can be helpful/reused (i'm not a wince expert :)

extern "C" int GetCurrentPermissions(void);

extern "C" BOOL GetSystemMemoryDivision(int *a, int *b, int *c);

extern "C" unsigned int GetFSHeapInfo(void);

extern "C" unsigned int SetKMode (int fMode);

#define LOCKFLAG_WRITE 0x001

#define LOCKFLAG_QUERY_ONLY 0x002

#define LOCKFLAG_READ 0x004

int IOCTL_HAL_GET_DEVICEID = ((FILE_DEVICE_HAL) << 16) | ((FILE_ANY_ACCESS) << 14) | ((21) << 2) | (METHOD_BUFFERED);

extern "C" BOOL KernelIoControl(

DWORD dwIoControlCode, LPVOID lpInBuf, DWORD nInBufSize,

LPVOID lpOutBuf, DWORD nOutBufSize, LPDWORD lpBytesReturned);

MEMORYSTATUS mst;

STORE_INFORMATION sti;

SYSTEM_POWER_STATUS_EX pstatus;

mst.dwLength = sizeof (mst);

GlobalMemoryStatus (&mst);

GetStoreInformation(&sti);

GetSystemPowerStatusEx(&pstatus,TRUE);

somewhere_in_data[0]=1;

unsigned long nserno;

BYTE sernobuf[1024];

if (KernelIoControl(IOCTL_HAL_GET_DEVICEID, 0, 0, sernobuf, 1024, &nserno))

{

unsigned int i;

Output (L"serno bytes: %02X", nserno);

for (i = 0; i<nserno; i++)

Output (L"%02X", sernobuf);

}

else

Output (L"serno failed: %02d", GetLastError());

Output (L"heapinfo: %08x kphy=%08x",

GetFSHeapInfo());

// SetKMode(mret);

Output (L"\n"

L"_data=%08x/%d %08x/%d rdata=%08x/%d\n",

somewhere_in_data,*somewhere_in_data,

&somewhere_in_data[1024],somewhere_in_data[1024],

somewhere_in_rdata,*somewhere_in_rdata);

Output (L"\n"

L"physiz=%08x/free %08x rdsiz=%08x/free %08x\n",mst.dwTotalPhys,mst.dwAvailPhys,

sti.dwStoreSize,sti.dwFreeSize);

Output (L"\n"

L"virtsiz=%08x/free %08x\n",

mst.dwTotalVirtual,mst.dwAvailVirtual);

Output (L"\n"

L"power: ac=%d bfl=%d bbfl=%d\n",

pstatus.ACLineStatus,pstatus.BatteryLifePercent,pstatus.BackupBatteryLifePercent);

HINSTANCE _mydll;

unsigned long i,j;

_mydll=LoadLibrary(TEXT("coredll.dll"));

for(j=1;j<1000;j++)

{

i=0;

if (_mydll)

{

i= (unsigned long) GetProcAddress(_mydll, (LPWSTR)j);

}

#if 0

if (i)

Output (L"\n"

L"hinst: %08x , %08x %08x %08x %08x %08x\n",

_mydll,

i,*(unsigned long *)i,*((unsigned long *)(i+4)),

*((unsigned long *)(i+8)),*((unsigned long *)(i+0xc))

);

#else

Output (L"\n"

L"core: %5d %08x %08x\n",

j, i,*(unsigned long *)i

);

#endif

}

#endif

int div_rdisk,div_ram, div_pagesiz;

GetSystemMemoryDivision(&div_rdisk,&div_ram,&div_pagesiz);

Output (L"Welcome, this is HaRET running on WindowsCE v%d.%d\n"

L"CPU is %hs\n"

L"Running in %hs mode; minimal virtual address: %08x, maximal: %08x\n"

L"curr_perm: %08x, memdiv: rdisk=%08x ram=%08x pagesiz=%08x\n"

L"Enter 'HELP' for a short command summary.\n",

vi.dwMajorVersion, vi.dwMinorVersion,

cpu_id (cpuGetCP (15, 0)), cpu_mode (cpuGetPSR () & 0x1f),

si.lpMinimumApplicationAddress, si.lpMaximumApplicationAddress,

GetCurrentPermissions(),div_rdisk,div_ram,div_pagesiz

);

It is pxa263 on the wiki pictures.