[Windows Mobile] hilaireg:
Changing the Remote API (RAPI) Policies

Security policies are used for configuring security settings that are then enforced with the help of security roles and certificates. They provide the flexibility to control the level of security on the device. The policies are defined globally and enforced locally in their respective components. The security policy is set during boot by executing a .provxml configuration file. This provisioning file is in ROM and contains the default setting specified by the OEM. The provisioning document is an Extensible Markup Language (XML) file that is assigns security settings to the device.

The Remote API (RAPI) enables applications that run on a desktop to perform actions on a remote Windows Embedded CE-based device. This includes the ability to manipulate the file system on the remote device, including the creation and deletion of files and directories. Additionally, the Remote API (RAPI) functions can be used to create and modify databases, either in the device's object store or in mounted database volumes. The Remote API (RAPI) applications can also query and modify registry keys as well as launch applications and invoke methods on the remote device.

Typically, the mxipupdate_oemoperators_100.provxml file contains the default security policies that will be applied to the device. To allow unrestricted access by remote applications to implement ActiveSync operations on Windows Mobile powered devices, we need to change the default security policy settings that pertain to the Remote API (RAPI).

For the purposes of this guide, we will add or change the following unsigned policy setting ID’s:

ID 4097: Unsigned Prompt Policy = 1

* IMPORTANT *

Policy settings may appear in other files. You may wish to perform a search through .TXT, .RGU, and other .PROVXML files using the keywords such as: security, policies, policy.

Tools Required

The following tools are required to edit .PROVXML files.

UTF-8 Text Editor

Procedure

The following procedure will add/change the unsigned policy settings to permit the installation of unsigned .CAB files.

Navigate to the C:\XDA\MY_KITCHEN\OEM\OperatorPkg\ folder.

Verify that the mxipupdate_oemoperators_100.provxml is not set as Read Only.

Launch your UTF-8 Text Editor.

Use the Search feature to find the following section:

<!--337.01_SecurityPolicy-->

Ensure that the following lines are present in the section:

<!--337.01_SecurityPolicy-->

<characteristic type="SecurityPolicy">

...

<parm name="4097" value="1" />

...​

</characteristic>

Save the changes to the mxipupdate_oemoperators_100.provxml; ensure that the file is saved in UTF-8 format.

Exit your UTF-8 Text Editor.

Verify that the mxipupdate_oemoperators_100.provxml is set to Read Only.

Tip

Make a backup copy of the mxipupdate_oemoperators_100.provxml file before editing; delete the backup file when done.

Observe the line formatting and spacing in the mxipupdate_oemoperators_100.provxml file.

When saving the file, select the Save As menu option and put quotes ["] around the file name so as to avoid additional file extensions.

References

Security Policy Settings for Windows 6.x Mobile-Based Devices

http://msdn.microsoft.com/en-us/library/bb416355.aspx

Security Policy Settings for Windows 5.x Mobile-Based Devices

http://msdn.microsoft.com/en-us/library/ms889564.aspx

What Do The SmartPhone Policy ID's Mean

http://www.xs4all.nl/~itsme/projects/xda/smartphone-policies.html

Remote API (RAPI)

http://msdn.microsoft.com/en-us/library/aa920177.aspx