[Windows Mobile Development and Hacking General] cmonex:
so, i got bored so why not post a new thread. :)

as the title says, here's how to fully and permanently disable sign/cert checking in WM5/WM6, so you can load unsigned files even during boot, just fine.

i've been asked several times on how to do it

sumup: you will need IDA Pro or some other disassembler and S000 from nk.exe module in the XIP. VerifyBinary is the function to be patched.

here's the code to be modified:

- first, some example ways to find it

1. locate nk.exe string in strings tab (the lower case one, "nk.exe"), go to the code that references it, below that, enter the second BL (it's the BL in next block), that function is LoadE32, now find the xrefs for it, should have about 3-4 references to it. one of them (InitModule) will look similar to example disassembly below, where 8002D0EC is LoadE32.

2. you might be able to search for LDREQ R0, =0x80090006 though in some nk.exe's ida won't resolve that too well (if the rom base is near the 0x80090006); you could still search for 06 00 09 80 in the nk binary - but that is referenced at other places too, still maybe this might make it easier to find the VerifyBinary function.

- anyway, next, example code

.text:80030CE4 7E 00 A0 03 MOVEQ R0, #0x7E ; '~'

.text:80030CE8 4E 00 00 0A BEQ loc_80030E28

.text:80030CEC 02 00 58 E3 CMP R8, #2

.text:80030CF0 00 80 A0 03 MOVEQ R8, #0

.text:80030CF4 02 00 19 E3 TST R9, #2

.text:80030CF8 01 E0 A0 13 MOVNE LR, #1

.text:80030CFC 00 E0 A0 03 MOVEQ LR, #0

.text:80030D00 0C 30 8D E2 ADD R3, SP, #0x44+var_38

.text:80030D04 04 20 8D E2 ADD R2, SP, #0x44+var_40

.text:80030D08 70 10 84 E2 ADD R1, R4, #0x70

.text:80030D0C 0A 00 A0 E1 MOV R0, R10

.text:80030D10 00 E0 8D E5 STR LR, [SP,#0x44+var_44]

.text:80030D14 F4 F0 FF EB BL sub_8002D0EC ---> LoadE32()

.text:80030D18 00 00 50 E3 CMP R0, #0

.text:80030D1C 41 00 00 1A BNE loc_80030E28

.text:80030D20 8C 30 94 E5 LDR R3, [R4,#0x8C]

.text:80030D24 CE 20 84 E2 ADD R2, R4, #0xCE

.text:80030D28 05 10 A0 E1 MOV R1, R5

.text:80030D2C 00 00 53 E3 CMP R3, #0

.text:80030D30 BC 3C D4 01 LDREQH R3, [R4,#0xCC]

.text:80030D34 0A 00 A0 E1 MOV R0, R10

.text:80030D38 03 90 83 03 ORREQ R9, R3, #3

.text:80030D3C 00 30 A0 E3 MOV R3, #0

.text:80030D40 BC 9C C4 01 STREQH R9, [R4,#0xCC]

.text:80030D44 3A E7 FF EB BL sub_8002AA34 ---> VerifyBinary()

in the example the BL after LoadE32, sub_8002AA34 is VerifyBinary. this is what you want to patch.

if you look you can see that if it doesn't return 0 it will exit the function that has this quoted code. so just go to VerifyBinary start and patch it to

MOV R0, #0 (00 00 A0 E3)

BX LR (1E FF 2F E1)

(why not just NOP the BL to it? because it is also called when an EXE is being loaded, so we need to cover that case too. the above code is DLL load code)

- IMPORTANT: to clean some things up when it checks whether a trusted process is loading an untrusted DLL... to avoid that we'll just put everything in full kernel trust mode which is neat anyway ;)

so you should also patch the part after it returns.

example:

.text:80030D44 3A E7 FF EB BL sub_8002AA34

.text:80030D48 00 00 50 E3 CMP R0, #0

.text:80030D4C 35 00 00 1A BNE loc_80030E28

.text:80030D50 00 30 97 E5 LDR R3, [R7]

.text:80030D54 03 30 D3 E5 LDRB R3, [R3,#3]

.text:80030D58 02 00 53 E3 CMP R3, #2

.text:80030D5C CE 30 D4 05 LDREQB R3, [R4,#0xCE]

.text:80030D60 01 00 53 03 CMPEQ R3, #1

.text:80030D64 24 05 9F 05 LDREQ R0, =0x80090006

.text:80030D68 2E 00 00 0A BEQ loc_80030E28

.text:80030D6C 02 00 19 E3 TST R9, #2

1) nop the BEQ (or just put the following code in its place)

2) make sure that the byte at [R4,#0xCE] has #2 in it.

i.e patch it like this: insert two opcodes like this:

MOV R0, #2 (02 00 A0 E3)

STRB R0, [R4,#0xCE] (CE 00 C4 E5)

you can NOP the rest before the TST. do not touch the TST Rx, #2, or anything that comes after that line.

notes:

1. this will change KITL log in that it will not log module loads regarding cert checking. if you still want to log module (DLL and EXE too) loads in KITL i have another simple patch to do it if anyone wants nice KITL ;)

2. you can also patch certmod.exe (or if you wish, filesys.exe) instead of nk.exe but this way is faster and cleaner, also nk.exe changes less often than certmod (or filesys). still, if someone's interested i can post that too.

+ bonus: old news maybe but afaik it was never made public so here's how to change a WM5 kernel to "upgrade" it to WM6 (i found that method last year to make WM6 porting possible / much easier).

i've mentioned LoadE32, well this is the function you want to patch.

example code:

LoadE32() (go to somewhere at the right in IDA if you are in graph view, to find it faster)

this is the CE major/minor version check in PE header of the EXE/DLL being loaded.

ROM:80032DEC STR R3, [R5,#4]

ROM:80032DF0 CMP R2, #5

ROM:80032DF4 BHI loc_80032E34

ROM:80032DF8 BNE loc_80032E08

ROM:80032DFC LDRB R3, [R5,#3]

ROM:80032E00 CMP R3, #1

ROM:80032E04 BHI loc_80032E34

CMP R2, #5 is comparing against CE major version i.e. CE 5.x

CMP R3, #1 is comparing against CE minor version i.e. x.1 for WM5 (CE 5.01), x.2 for WM6 (CE 5.02)

so you can just change the CMP R3, #1 to CMP R3, #2 (or do it in another way if you wish), encoding 02 00 53 E3

(of course R3 is only in this example)

that's it for now, maybe i'll post more tricks from now on.