[Windows Phone 7 Development and Hacking] WithinRafael:
(I'm only two days into WP7, so don't smack me too hard.)

While attempting to debug some Windows Phone 7 behavior via RustyGrom's unlocked images, I stumbled across the whole "/h/ttps issue". This forced me to re-look at how the original mod was performed.

The original method, as outlined in this blog post, involves manipulating the read-only portion of the system registry -- default.hv. Doing so invalidates its baked in signature, wrecking havoc (manifesting itself as broken /h/ttps and other assorted crappiness).

To work around this, I instead made a change to an internal function within AppMetadata.dll, causing all requests to blacklist to return empty handed. (A one byte change at 0xAC8A, 75->EB.) That unlocks the applications on the splash screen.

To unlock the "settings", however, is a trickier matter and involves those irritating "SecureItem" values and the parsing code within SplashSettingsDll.dll. (If you're wondering what the GUIDs mean, there's a translation to canonical names in 8C9C0C34-B77D-45FB-9E4E-D53AC5900244.rgu).

Themes = {165705CD-200B-4b23-961D-E3F66F844514}
Sounds = {92F34415-4D78-4430-9933-D2DEEA0C9D3D}
FlightMode = {1DEF9B7D-2322-40eb-A007-16A75D5CDA62}
Accessibility = {C5A90F1C-112F-43d3-8C80-C5D1746F3B68}
WiFi = {291A7CF3-48C4-4319-A6F6-E4BABFCCB8E8}
Bluetooth = {BFBBBF37-35E3-447b-BE65-DFC149EF614F}
Location = {41954AAF-E1C4-4b81-A5EC-A5C8961FE34C}
CellularConn = {FD427838-F373-40a3-9FEC-76C6CFFAFC04}
Accounts = {87F5E764-4AB3-4664-B2A3-BE00A2E8AF4A}
Brightness = {B7AFEE4D-7738-48df-8CA4-588D14AE256B}
TouchKeyboard = {071692BE-EC17-463e-94C7-64FB874A6180}
Regional = {E37398A2-CEAD-423c-9EC2-F43251C0B2CE}
DateTime = {9CB05CAE-D2CF-4409-8E64-352DD8F6FDE2}
PhoneLock = {37966764-79C8-4090-A8CF-FB65D638E529}
Updates = {C956380A-087F-4548-A5F6-CEF3616A55DA}
About = {9DAD8821-3F8C-474f-AB2B-D120BA03AFDC}
Speech = {7D878951-E418-46a3-AF6B-DCB45CD375B9}
Contacts = {2D267C1E-C53A-4718-8032-FAC545DDDF8C}
Photos = {864AAEB9-9419-40f9-BA88-03E986859450}
Messaging = {D651D70D-B141-4d71-8FFB-1004C24FB12B}
Phone = {83171528-D3B9-49b6-BC05-BBB3B4B25460}
IE = {A7DD1D7D-C7CA-4566-A5E7-015C7940276E}
Maps = {21EF1D0A-5EBE-4056-9622-2D9615C967E1}
Search = {90A593C1-F945-4bf7-AB56-A999E425F16F}
OfficeMobile = {5962CFCF-8008-4d55-B048-BDCDD7A90EAB}
Games = {B193A538-115B-4789-93D1-F3981B9D7B11}
Radio = {18916419-df98-4042-bb27-6ae39dbc3310}
FindMyPhone = {1691B767-686D-4934-A844-C0057C6024A0}
Feedback = {BF0D001A-1988-4cf3-81E1-16A1CCAB5DA3}
Marketplace = {1D36BBB8-9EEE-4e30-A72B-77ED9CFF11D1}

Unfortunately, Microsoft decided to put required data in these SecureItem values. It appears this data drives what order the application shows in the Settings list and/or the "type" of task. (Unsure about that last bit.) If this data is empty -- for example, I skip over all the SecureItem parsing -- the item vanishes.

I wrote some assembly to simulate returning order data, in an incrementing fashion (10, 20, 30, ...) -- which was fun -- but utterly useless. I'm obviously not putting this data where it wants it to be. I believe the second parameter to an internal function that handles enumerating all the SecureItems (va 41415066/offset 0x4266) is some sort of structure (with two members?) that's key here.

Without a debugger, probing this structure is nearly impossible -- I'm open to ideas here... The only idea I have is making the application crash on "executing" those members, then using the output window to get the values... but this'll be super difficult to pull off.

(If you could convince a mod to lift the restrictions on my account, that'd be wonderful. I can't post links or do anything useful.)