[Windows Phone 8 Development and Hacking] FurballTheGreat:
Disclaimer

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

This may damage your phone use at your own risk!

Introduction

The WP Telnet Daemon is a light weight server written in C++ as a static library using the native Win32 API on Windows Phone. It allows a telnet client such as PUTTY to connect from a machine on the same LAN.

View attachment 3075435 View attachment 3075436

It provides a shell similar to the dos prompt with basic commands such as CD, DIR, MKDIR, RMDIR, PS, KILL, MOVE, COPY and ATTRIB. A registry editor is provided which can be loaded by using the REG command. Finally a selection of other commands which have been created to test various APIs are also present for example NETSTAT.

Currently the daemon is packaged as a Silverlight application with two modes of operation:-

Standalone - An executable called wptd.exe which is launched calling CreateProcess and runs in the background.

In Process – The library is called directly by the Silverlight application inside a thread. The primary difference is this mode runs inside the Silverlight process.

The telnet daemon runs with the rights of the container in which it is launched therefore if the manager app is side loaded using developer unlock rights it will operate within the limits of the chamber.

The second part of this release combines WPTelnetD with the SD Card tricks that have been revealed over the past months. Using the App Repurposing Tool the daemon can be run with the rights of the target app.

WP Telnet Daemon command prompt

The command prompt is mostly similar to that offered by cmd.exe on desktop windows. The primary difference is that the WPTelnetD prompt has commands which are of use or interest when exploring a Windows Phone device.

The command which offers the most interesting possibilities right now is "reg" the registry editor. When WPTelnetD is launched from a container such as PFD a large number of registry keys are writeable. Just try typing the following from the PFD chamber ;).

reg writeable

The list command can be used to inspect current values as follows:-

D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>reg list hklm\software\microsoft\mtp
Subkeys
DeviceServices
ObjectFormats
ObjectProperties

Values
DataStore string 'c:\'
MTPDPCLSID string '{4cd7b058-ee73-4885-af9f-d8adc79b80f5}'
MtpIntermediateBufferSize dword 00046000
MTPSDName string 'SD card'
MTPStorageName string 'Phone'
UsbBuffers dword 00000003
UsbBufferSize dword 00010000
UsbEventBuffers dword 00000040
UsbEventBufferSize dword 00000040
OEMICON string 'C:\Windows\System32\DevIcon_Black.ico'
OEMAVATAR string 'C:\Windows\System32\OEMAvatar_Black.cab'
D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>

To search for a key, value name or value containing a string use the find command:-

D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>reg
Registry Editor - Type HELP for assistance.
HKLM\>find Autobrightness
Searching...
Match: SOFTWARE\Microsoft
Match: SOFTWARE\Microsoft\MCSF\Settings
SourcePath string 'HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\OEM\Brightness\HideAutoBrightness'
Match: SOFTWARE\Microsoft\MCSF\Settings\Microsoft/DisplaySettings/HideAutoBrightness
HideAutoBrightness dword 00000001
Match: SOFTWARE\Microsoft\Shell\OEM\Brightness
Match: SOFTWARE\OEM
UserSettingAutoBrightnessScaler dword 00000064
UserSettingAutoBrightnessScalerMax dword 000000c8
UserSettingAutoBrightnessScalerMin dword 0000001e
Match: SOFTWARE\OEM\Nokia\Display\ColorAndLight
Done
HKLM\>

Example Tweaks

These tweaks must be run from a chamber with ID_CAP_DEVICECONFIG. Preview for developers (PFD) is one such chamber.

Set the MTP datastore to display a lot more folders over USB

reg set "hklm\SOFTWARE\Microsoft\MTP\DataStore" string "c:\"

Set the OEM identifier used by the store

reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "NOKIA"
reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "HTC"
reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "SAMSUNG"

WP Telnet Daemon Manager App

Standalone Mode

This mode of operation calls CreateProcess to launch wptd.exe as a child process. This mode was the original one to be implemented. As daemon runs as a separate process it is not killed cleanly when the manager app exits.

The daemon will launch on port 27249 when the launch button is tapped. Once CreateProcess returns SUCCESS this will be indicated in blue text at the bottom of the screen. This is illustrated in the image below.

View attachment 3075438

In Process Mode

This mode of operation hosts the telnet daemon within the Silverlight process of the manager app.

It was added due to some problems creating child processes in certain instances. However it has the advantage that the standard WP application life cycle rules are followed (e.g. it will exit when the host application exits).

The daemon will by default listen on port 23422 when the launch button is tapped. Once listening some blue text will appear indicating as such and as soon as a client connects the status will change again. This is illustrated in the image below.

View attachment 3075437

Using PUTTY to connect

Connecting to the instance of WPTelnetD launched on your phone it is recommended that one uses PUTTY. Setting up the connection is simple but it is very important that you heed the following instructions:-

The connection type must be set to raw failing to set this will cause PUTTY to send control codes which are not understood by the telnet daemon.

The host name must be the IP address that the phone currently has on the LAN. This address can be seen on the standalone page of the manager app.

The port must be set to the port that the telnet daemon instance is listening on by default this is 27249 for standalone mode and 23422 when using in process mode.

Saving the connection into PUTTY's list of saved connections is recommended to prevent having to set these settings each time one connects.

Repurposing Existing Silverlight-based Apps (SD-Card only)

As reported previously there is a quirk in the handling of apps installed on the SD card of Windows Phone 8/8.1 devices. This allows their contents to be replaced therefore allowing the capabilities of that app to be leveraged by the replacement.

First side load the “Windows Phone Application Deployment (8.1)” or equivalent tool. It must be installed into the phones memory and not the SD Card or you will experience errors. The package you must install is:-

HostApp_1.0.0.X_ARM_Debug.appx – This package contains the App Repurposing Tool and the WP Telnet Daemon manager app in a single package. Therefore it is not necessary to deploy WPTelnetD.xap for the tool to function correctly.

Once the tool is deployed you may then install any of the following applications from the store onto the SD Card of the phone. It is critical that the target app is stored on the SD Card and not the phone:-

Preview for Developers

HTC CSDDiag

Extras+Info

Glance

Now launch the App Repurpose Utility on the phone and follow the instructions as illustrated in the image below. Note that the first time this utility is run you must choose the WPSystem folder on the SD Card, on subsequent uses the app will remember the location so you will not be prompted again.

View attachment 3075439

Assuming the process has completed without errors you may now launch the target the application that has been replaced from its normal location. Note that the title on the menu item may change to the install path of the app and the icon WILL change.

Downloads & Source

WPTelnetD Manager binary package

The telnet daemon XAP package can be downloaded from the address below. This is primarily for those who wish to side load or lack the SD Card required to use the App Repurposing Tool.

https://github.com/FurballTheGreat/WPTelnetD/releases/download/1.3/WPTelnetD.xap

App Repurposing Tool binary package

This tool can be downloaded from the address below. An SD Card is necessary for this app to function usefully.

https://github.com/FurballTheGreat/WPTelnetD/releases/download/1.3/HostApp_1.0.0.13_ARM_Debug.appx

Source

A zip of the full source code can be downloaded from the following address:-

https://github.com/FurballTheGreat/WPTelnetD/archive/1.3.zip

Finally the source can also be retrieved using git & subversion by following the instructions on the projects git home page:-

https://github.com/FurballTheGreat/WPTelnetD