[Windows Mobile Development and Hacking General] TalynOne:
How did you hack intshare.dll?

I took fluxist's hacked .dlls, and using a HEX editor replaced every instance of the string "RNDISFN1" (which refers to the USB device) with the WiFi identifier. If the string was too long and encroached into the "BTPAN1" string, then I moved the "BTPAN1" string over. I have no idea if this breaks the functionality of using the "Blueooth PAN" entry in the Internet Sharing app for sharing over WiFi, I haven't tested it, and you should never use it regardless. The top three occurrences of the WLAN identifier (TNETW12511 for the Mogul) are related to my USB hack, the last (fourth) occurrence of the WLAN identifier is a left over from fluxist's Bluetooth hack.

This hack is different from a fluxist's registry change .dll hack. In my hacked .dll I replaced EVERY reference to the USB device (RNDISFN1), to the WiFi device in question (TNETW12511 for the Kaiser/Mogul). So if you just perform a registry change with the original version of the intshare.dll, the "Status" messages the "Internet Sharing" app looks for/displays are related to the USB device. In my hacked version, the "Status" messages the app looks for/displays are related to the actual WiFi device. So changing WiFi IP address properties, for the 10 minute workaround, while running the non hacked version will have no effect, because the non hacked .dll version is monitoring the USB device, not the WiFi device.

For which WiFi radios have you included a hacked version of intshare.dll?

TIACXWLN1

-Artemis / HTC P3300

-Pocket Loox 718/720

-Hermes / HTC TyTN / XDA trion / MDA Vario II / VPA Compact III / SPV M3100 / Dopod CHT 9000 / Dopod 838 Pro

-Athena / x7500

TNETW12511

-HTC Titan / Sprint Mogul / Verizon XV6800 / P4000

-HTC TyTN II / Kaiser / AT&T Tilt / 8925 / P4550

-Elf / HTC Touch

-HTC Vox

TNETWLN1

-Universal / Qtek 4040 / XDA-IV / SPV M5000 / MDA-IV / i-mate 2005

-HTC Wizard / Qtek 9100 / i-mate K-JAM / MDA Vario / O2 XDA Mini S / SPV M3000 / Cingular 8125 / T-Mobile MDA / Dopod 838 / VPA compact II

WLAN11g1

-Terralogic Toughnote DA05-M Ruggedised PDA

SWLD25SP1

-E-ten Glofiish X500

-Samsung SGH-i600

GSPI86861

-Sharp EM-ONE

CheetahSDN1

-O2 XDA Flame

CF8385PN1

-O2 Atom LIFE

My device is not in the list and/or I don't know what the device name for my WiFi device is, how do I find out?

Go to Start->Settings->"Connections" tab.

Select the "Wi-Fi" applet.

On the "Network Adapters" tab, make note of the name of your WiFi device (for the HTC Mogul this is the item listed as "IEEE 802.11b/g Compatible Wi-Fi Adapter").

Using a registry editor, search the registry using the name you noted in the previous step. The second occurrence (it's slightly different from the first, it has a suffix "1" after the registry key name, and also has a "Wireless" value) will be something like this:

[HKEY_LOCAL_MACHINE\Comm\[b]TNETW12511[/b]]
"DisplayName"="IEEE 802.11b/g Compatible Wi-Fi Adapter"
"Group"="NDIS"
"ImagePath"="TNETW1251.dll"
"Wireless"=dword:00000001

Look up the name of the subkey, which is [HKEY_LOCAL_MACHINE\Comm\TNETW12511]. Of this, you’ll only need the last subkey name component (TNETW12511).

Other reading of interest:

Bluetooth specs:

http://en.wikipedia.org/wiki/Bluetooth

Internet sharing description & why Microsoft Mobile team removed Bluetooth DUN:

http://blogs.msdn.com/windowsmobile/archive/2007/04/17/why-did-we-remove-bluetooth-dun.aspx

The new dial-up network model of the WM5 AKU3:

http://www.pocketpcmag.com/blogs/index.php?blog=3&p=1415&more=1&c=1&tb=1&pb=1

A tutorial of setting up and using Wi-Fi peer-to-peer (Ad Hoc) connections between Pocket PC's:

http://www.pocketpcmag.com/blogs/index.php?blog=3&p=588&more=1

Dial-up Networking Through Bluetooth Under WM5 AKU3 / WM6:

http://www.pocketpcmag.com/blogs/index.php?blog=3&p=2121&more=1&c=1&tb=1&pb=1

Unrestricted BT PAN server with the MS BT stack:

http://www.pocketpcmag.com/blogs/index.php?blog=3&p=2230&more=1&c=1&tb=1&pb=1

Links for developers/hackers :

Sample for using Internet Sharing API:

http://groups.google.com/group/micr...4aaa543efc216f/a9c637f89b0575b6?lnk=st&rnum=1

Configurable TCP/IP Configuration Parameters in WinCE 3.0:

http://msdn2.microsoft.com/en-us/library/ms881801.aspx

Controlling the Radio Devices:

http://www.teksoftco.com/articles/article 007/radiodevices.htm

802.11 WLAN WiFi : Power Mini FAQ - Windows CE:

http://blogs.msdn.com/cenet/archive/2006/12/14/802-11-wlan-wifi-power-mini-faq-windows-ce.aspx

WiFi toggling fix:

http://forums.sbsh.net/index.php?showtopic=17139&pid=175405&mode=threaded&start=

New Windows Mobile 6 State and Notifications Broker State Values:

http://www.pluralsight.com/blogs/jimw/archive/2007/04/20/46866.aspx

Internet Connection Sharing for Microsoft Windows CE MSDN documentation:

http://msdn2.microsoft.com/en-us/library/aa924710.aspx

http://msdn2.microsoft.com/en-us/library/ms901927.aspx

http://www.microsoft.com/technet/archive/wce/evaluate/sharece.mspx?mfr=true

Thanks/Credits:

Chainfire - For his awesome WMWifiRouter application.

fluxist - For the original hack!

Menneisyys - For his blogging on the subject.

Xiou's - For his Share&KeepSharing script.

gthing - For the XDA-Developers Hermes Accesspoint Wiki.

luv2chill - Sprint Mogul Internet Sharing Connect Fix. (post by luv2chill).

electronicrice - Multi-NAI disable hacks for the Mogul

Final Thoughts/Notes:

fluxist's tutorial instructs you to set the IP address to 192.168.1.1, I instruct you to set it to 192.168.0.9. This is so it matches up to what I found in "intshare.dll". When I was testing sometimes my laptop would get a 192.168.0.0 network address, even when my mobile device was statically set to a 192.168.1.0 network address.

My expertise is in network/system administration/repair and software development. I can easily create code, but when it comes to hacking someone else's compiled code, I'm a complete novice. The ideal solution is if a one click solution could be written to change the WiFi configuration to Ad Hoc, set a static IP address, connect to the Internet with the Internet sharing app, have it stay with a status of "Connected", and reconnect on loss of connection.

I'm figuring a skilled hacker/cracker should be able to patch "intshrui.exe", where I believe the actual 10 minute time out exists, and get rid of it. When opening this file in a Hex editor, I noticed the strings "HostConnectTimeout" and "CellConnectTimeout" inside.

Another solution would be to figure out the undocumented APIs to build a new Internet Sharing application.

intshare.dll exposes the following exports: InternetSharingEnable, InternetSharingDisable, RegisterForInternetSharingNotifications, and DeregisterForInternetSharingNotifications.

ipnat.dll exposes the following exports: IPNat, LanaUp, NAT_Close, NAT_Deinit, NAT_IOControl, NAT_Init, NAT_Open, NAT_Read, NAT_Seek, NAT_Write, and NatConfigure.

The included "Share&KeepSharingViaUSB.mscr" Mortscript uses vjvolubilis.exe (available at http://www.vijay555.com/?Releases:VJVolubilis) to toggle the Wifi radio off and on, but this app is not compatible with the HTC Mogul. It would be great if someone can suggest a program that would work with Mortscript and the HTC Mogul.

--------------------

Changelog:

v0.2

Added hacked dll for "CheetahSDN1" (O2 XDA Flame)

Added hacked dll for "CF8385PN1" (O2 Atom LIFE)

Changed IP address in hacked intshare.dlls from 192.168.0.1 to 192.168.0.9 to prevent possible conflicts.

Changed "Share&KeepSharingViaUSB" Mortscript.

Added "StopSharingViaUSB" Mortscript.

v0.1

Initial Release