yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] (nico):
Thanks Rafael.

This is nice! How do I do the opposite? I need to create a string in unmanaged and use it from managed code Do I just have to use [out] instead of [in] in your example?

This is much simpler that my method :)
[Windows Phone 7 Development and Hacking] WithinRafael:
Yep, it should match the direction indicated in your COM library's IDL. It basically just drives how Marshaller handles copying of memory, pinning, etc.
[Windows Phone 7 Development and Hacking] ajhvdb:
You guys are smarter the me at this, obviously, but is there a site where you share your code? because i'm smart enough to use existing code and make something happen.. :)
[Windows Phone 7 Development and Hacking] athompson:
Have you checked out ZuneBoards? They've done some work in this area already with their OpenZDK, which looks similar to what we may need to do. Their method of breaking out of the CLI virtual machine is different than ours, but a lot of what they've done is what we want to do, too.
[Windows Phone 7 Development and Hacking] athompson:
One thing that doesn't work are the typical WinCE graphics functions:

GetDC(NULL) ;

GetDesktopWindow();

LineTo();

GetClientRect();

That is they work, but the root window is empty! 0 wide and 0 tall. The drawing engine (unsurprisingly) is elsewhere.
[Windows Phone 7 Development and Hacking] athompson:
Have you gotten anything to compile yet?

Check this one out: http://dl.dropbox.com/u/4165054/PhoneNetworkingSample.zip

And see if you can get it to compile (I would make it an attachment in this post but it's jmmorril's code). I've been using Visual Studio 2008 and the WinCE 6 refresh to compile the com dll: http://www.microsoft.com/downloads/...3A-A651-4745-88EF-3D48091A390B&displaylang=en

Then I copy the com dll over to my visual studio 2010 Windows Phone project, ready to be used. There are probably better ways, but you need to find out at least some way of doing it.
[Windows Phone 7 Development and Hacking] (nico):
I've managed to create a basic Registry Viewer, readonly for the moment.

For now, I didn't manage to get access to root path, so the first 2 levels are hardcoded.

Download it here: (link removed, see below)

Edit:

Updated version here: http://bit.ly/eEZ0Uf
[Windows Phone 7 Development and Hacking] ceesheim:
wow man nice work :) , could you also make a file explorer ?

edit: here is a direct link http://www.xda-developers.ch/download/?a=d&i=7061084002
[Windows Phone 7 Development and Hacking] WithinRafael:
I plan on implementing all the API available via carrier drivers. So yeah, that seems to cover the registry, filesystem, and various radio stuffs.
[Windows Phone 7 Development and Hacking] Arktronic:
Zed-PM, eh? ;)

By the way, is anyone working on LG-specific homebrew? If not, I may be able to help there.
[Windows Phone 7 Development and Hacking] WithinRafael:
Haven't heard much, would be awesome start if you could dump at least a directory listing/drivers. Maybe start with the web server XAP.

PS: I just stumbled on another driver (windiag.dll) that gives us way more goodies to play with. Think screen capturing, more registry control, etc. Oh boy, I'm totally reverse engineering this now.
[Windows Phone 7 Development and Hacking] kuerbis2:
Rafael,

have you seen the HybridLibrary.dll from Microsoft with the namespace Microsoft.MobilePartner.Utilities.HybridUtilites?

Looks like there is a SIM Facade which allows one to get IMEI and IMSI. There are actually two nativ DLLs included "Navigon.HybridUtility.dll" which looks like it comes from MS and a "Navigon.SilverServer.arm.dll" which looks like the navi kernel.

[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("6C181A41-F5DC-4672-A106-694FBD6032F4")]

internal interface ISIMFacade

{

[return: MarshalAs(UnmanagedType.BStr)]

string GetIMSI();

[return: MarshalAs(UnmanagedType.BStr)]

string GetIMEI();

}

There are a few others. The Navigon GPS app (only available in the de-DE marketplace) might have a few hints on what's already available.

It is also the only app I've seen up to today which uses

<Capability Name="ID_CAP_NETWORKING_ADMIN" />

<Capability Name="ID_CAP_INTEROPSERVICES" />

in the WPInteropManifext.xml instead of the WMAppManifest.xml.

Let me know if this interests you.

Regards,

-tobias
[Windows Phone 7 Development and Hacking] WithinRafael:
Looks like that's an interface to another carrier-specific driver. What carrier are you on? I'm interested in adding support for it. Can you join Freenode/#xda-devs ? There's a web-based chat client if needed (http://webchat.freenode.net/)
[Windows Phone 7 Development and Hacking] oOp:
hi.

what you are thinking about using old wince libs in wp7? do you think its feasible?

For examlple: http://nightlies.videolan.org/build/wince/branch-20101231-0301/
[Windows Phone 7 Development and Hacking] indiekiduk:
Sorry I don't have the Navigon xap handy, are the capabilities inside the interop tag?
[Windows Phone 7 Development and Hacking] hounsell:
WPInteropManifest.xml and WMAppManfest.xml from the Navigon App.
[Windows Phone 7 Development and Hacking] WithinRafael:
I'm going to add those to my manifest, and then try accessing RIL API. If that works... then my library isn't going to be so useful after all ;)
[Windows Phone 7 Development and Hacking] indiekiduk:
does either of the navigon dlls call RIL functions?
[Windows Phone 7 Development and Hacking] WithinRafael:
Yep. Directly. No device driver.
[Windows Phone 7 Development and Hacking] indiekiduk:
You can open RIL1: fine without anything special in the interop manifest. Not tried RIL_Initialize yet.
[Windows Phone 7 Development and Hacking] WithinRafael:
Yeah, sadly we're stucking having to GetProcAddress a bunch of that stuff due to lack of headers/libs.
[Windows Phone 7 Development and Hacking] indiekiduk:
It's all in the preview DDK, which is still available as a free download but not sure for how much longer so might want to grab it now:

http://www.microsoft.com/windowsembedded/en-us/products/windowsce/compact7.mspx
[Windows Phone 7 Development and Hacking] WithinRafael:
Oh yeah, I downloaded this too. Whoops, forgot. Cheers.
[Windows Phone 7 Development and Hacking] indiekiduk:
Just a small update today: I built a WM6 C++ console app and copied it from a xap installation folder to \Windows using the HTC file copy method. Tried to execute it using the RemoteExectuter posted app but it crashes. Investigated using popen or system to execute from my COM dll instead but so far not managed to get anything to compile, even ShellExecute isn't available.
[Windows Phone 7 Development and Hacking] athompson:
Wait, you should be able to compile it, right? That's just getting the function calls to the right places. You can write your own header files if you need to (like the guys at Zuneboards). The hard part is getting it to run, whether the function you need to call is installed on the device or not.
[Windows Phone 7 Development and Hacking] indiekiduk:
I thought it would just run because the other exes in \Windows aren't signed. Maybe they have policies though?
[Windows Phone 7 Development and Hacking] obelix:
I'm looking for the FileSystem.rc2 resource file which is missing from the FileSystemSample.zip sample. Is that part of the project or does it come from something else?

Thanks.
[Windows Phone 7 Development and Hacking] jambi92:
anyone this deep into hacking windows phone 7 have any info i could use to write a script or modify the os to enable a external keyboard via usb micro usb converter. C++ wouldnt be a problem and c# is fine too but where would i place that file to enable it or just where would i start in general?
[Windows Phone 7 Development and Hacking] WithinRafael:
So, Chris Walsh and I tested this whole Interop flag crap. The carrier just stupidly put the flags in both manifests. Removing them does not affect the application and I can call RIL* API in my COM DLL just fine.

Lame.
[Windows Phone 7 Development and Hacking] l3v5y:
Does RemoteExecute crash, or your console app?

There are other parts of the Microsoft.SmartDevice.Connectivity library that would give more feedback on remote application running, I just haven't had time to investigate them enough, but can do if it would be useful.
[Windows Phone 7 Development and Hacking] indiekiduk:
RemoteExecute crashes, any chance you could post the source code so I can debug why?
[Windows Phone 7 Development and Hacking] l3v5y:
I'll post the source when I get my main PC back, though it's fairly self explanatory :)
[Windows Phone 7 Development and Hacking] athompson:
That is probably true. Each app that comes preinstalled has an associated entry in some xml, in the leaked ROM. I haven't put the effort to understand it completely, but if you have write access to /Windows it might be worth looking into.
[Windows Phone 7 Development and Hacking] indiekiduk:
I actually tried replacing a file that would have a policy entry, I used the zip file viewer exe actually. This is a trick from Windows Mobile that you can replace a XIP file, essentially temporarily hiding the original. However RemoteExecute still crashes, I'm going to try to figure out other ways to execute on the phone instead.
[Windows Phone 7 Development and Hacking] kuerbis2:
indiekiduk, attach visual studio as debugger to the RemoteExecute process. That will give you the exception which caused the crash. Actually it looks like that RemoteExecute does crash whenever an exception occures. In my case the exception was "device not connected or registered".

Source-Code for RemoteExecute is somewhere in this forums. All it does is actually calling LaunchProcess from Microsoft.VisualStudio.DeviceConnectivity.Interop.ICcConnection. You can use reflector.

Another way would be the COM_dlls from HTC, LG or Samsung (correspondig to you test device) to launch an application directly from the phone.

regards,

-tobias
[Windows Phone 7 Development and Hacking] l3v5y:
As I said, there's very little error handling, mostly because I was attaching a debugger anyway.

The l3v5y.WP7DT.SmartDevice.Connectivity library in the RemoteExecute (and the Microsoft.SmartDevice.Connectivity library) are both basically wrappers around Microsoft.VisualStudio.DeviceConnectivity.Interop.ICcConnection (and a few other things), there are other process launching functions in there, but the LaunchProcess works more reliably.
[Windows Phone 7 Development and Hacking] (nico):
I'm currently trying to write to registry on my HD7.

However, it seems I can only read less value using HTC DLL, and write only some values.

For example, I can read DumpDirectory in System\ErrorReporting\DumpSettings, but not CurrentAccent in ControlPanel\Themes.

Of course, I can never write using my lib, but can sometimes write using HTC lib (for example 'Ship Build' in Software\HTC).
[Windows Phone 7 Development and Hacking] n0psl3d:
That's because that key is write only to TCB and that HTC driver is running as elevated only.

<Rule PriorityCategoryId="PRIORITY_STANDARD" ResourceIri="/REGISTRY/HKLM/CONTROLPANEL/THEMES/(*)" SpeakerAccountId="S-1-5-112-0-0-1" Description="Allow write access to Themes only to TCB">
[Windows Phone 7 Development and Hacking] (nico):
Damn. Thanks.

Where did you find those policies?
[Windows Phone 7 Development and Hacking] n0psl3d:
\Windows\Security\PolicyCommit.xml is what I think is the combined policies for each module combined in from that package when the database is initially created at build time.
[Windows Phone 7 Development and Hacking] indiekiduk:
Can't unfortunately because HTC's LaunchAP method from HTC.Shell.Registry.dll takes a product ID rather than an exe path:

public bool LaunchAP(string szProductID);
[Windows Phone 7 Development and Hacking] domineus:
so that's how htc checks whether it is a true wp7 device from the htc.shell.registry.dll

so then I'll ask, where is the product ID stored?
[Windows Phone 7 Development and Hacking] indiekiduk:
Yep so if you wanted to run the HTC hub on another manufacturer's device then you could edit the IL to return true for the isHTC method.

The product ID is stored as the directory name within Applications that the xap was extracted to. It probably also is put in the registry.
[Windows Phone 7 Development and Hacking] domineus:
That's what I was thinking because it didn't make any sense for the carrier ID to be embed THAT deeply...so whose gonna be the person to test it? I don't have the tools to do it currently sadly... =( that and the hd space =/ however could it be safe to assume that the htc specific apps calling on the htc ID could all be altered to work since the application is returning that this is a true htc device? I must say this is quite fascinating
[Windows Phone 7 Development and Hacking] indiekiduk:
Unfortunately not, because they are all dependent on HTC app support drivers which are only on HTC devices. This bool method is just an added layer of safety to prevent an unhanded exception or crash on a non htc device, most likely done at the app start.
[Windows Phone 7 Development and Hacking] domineus:
...htc's get all of the fun

even if their device design sucks
[Windows Phone 7 Development and Hacking] attilah:
Can you post the tools binary, which you used to convert from the module directory to PE file?

On the other hand, AppUtil.dll for the APU1 device is even more interesting. The COM dll in Samsung's NetworkProfile app is using a subset of that driver...from the strings I've seen it can do "anything", directory creation, file enumeration, file read/write, registry access too.

Thanks.
[Windows Phone 7 Development and Hacking] lyriquidperfection:
hi do you have the name of the samsung dll, I am going to create a wrapper to easily allow execution of the functions. Then i can use it to build an app and do a little research.

Sent from my OMNIA7 using Board Express
[Windows Phone 7 Development and Hacking] attilah:
The names of which dll's? :-)
[Windows Phone 7 Development and Hacking] lyriquidperfection:
the samsung dll that allows access to registry and file read and write. Do u lnow the name of this dll so i can reference it in viaual studio?:)

Sent from my OMNIA7 using Board Express
[Windows Phone 7 Development and Hacking] attilah:
Maybe you got something wrong.

Here is the thing: AppUtil.dll and WinDiag.dll are 2 drivers within the rom, where the debug strings are very interesting in terms of functionality.

However we DO NOT have COM dlls which are using the registry or the file IOCTL calls from those drivers and because of this we've to reverse it somehow...but unfortunately we don't have the PE binaries for those DLLs just the rom embedded modules :-( which makes it impossible to rebuild a PE binary and reverse it with IDA.

With different executables in the ROM we can only reverse about 15 functions of the APPUTIL.DLL driver :-( but those functions (IMEI reading and other) are already available in other form, so no real gain there...
[Windows Phone 7 Development and Hacking] attilah:
Successful provisioning xml execution

Every Samsung owner knows about this regkey: HKLM\Software\Microsoft\FieldTest with values

ManufacturingProvXmlPath=\\windows\\DiagnosisApp_1.provxml

ManufacturingAppTaskURI=app://d881566c-f6ae-df11-8a2f-00237de2db9e/_default

I played around with modifying these keys and here is what I've found out.

When you dial ##634# the phone is executing the provision xml specified at the above location and if that succeeds launching the given app.

I tried to deploy provxml files to the Ringtones directory but the device can't provision those xml files :-((( and yet I don't know any other possibility to copy files to the device into other directories.

So if I modified the app url and uninstalled the diagnosis application and dialed ##634#, the diagnosis app was deployed and MY application launched :-)) so I guess that this is somehow a step forward...we will see.

Is there any way to deploy xml files to the device??? since after that I guess that we can provision "anything"...
[Windows Phone 7 Development and Hacking] lyriquidperfection:
Is there any way to rebuild s000... s001... etc... back to a DLL file after being extracted from a ROM?
[Windows Phone 7 Development and Hacking] attilah:
That's what I'm talking about...some info is missing to correctly rebuild a PE binary from those files. Search here in the forum, there is an extensive discussion already about it.
[Windows Phone 7 Development and Hacking] lyriquidperfection:
damn it! back to the drawing board then! :)
[Windows Phone 7 Development and Hacking] denominator77:
Happy reverse-engineering, lyriquidperfection! ;)

View attachment 487828
[Windows Phone 7 Development and Hacking] ceesheim:
can you tell us how you get that file (from the .xap?)

or did you recmod the module ?
[Windows Phone 7 Development and Hacking] denominator77:
1. FixRecMod.exe your_dll_folder

2. LordPE -> PE Editor -> choose the recmoded dll -> get ImageBase value -> add the value to BaseOfCode and BaseOfData -> Save&OK

Sometimes ImageBase is not properly restored by FixRecMod.exe. If IDA has not identified any imported function, then try the following steps to fix the addresses:

1. Go to .pdata segment

2. There will be a list of "Function start" and "Function end" definitions

3. Take the first "DCD 0xNNNNZZZZ ; Function start"

4. In the most cases ImageBase will be 0xNNNN0000

5. Run LordPE and update ImageBase, BaseOfCode, and BaseOfData

View attachment FixRecMod.zip
[Windows Phone 7 Development and Hacking] lyriquidperfection:
you sir are a genius!

Sent from my OMNIA7 using Board Express
[Windows Phone 7 Development and Hacking] denominator77:
Sometimes ImageBase is not properly restored by FixRecMod.exe. If IDA has not identified any imported function, then try the following steps to fix the addresses:

1. Go to .pdata segment

2. There will be a list of "Function start" and "Function end" definitions

3. Take the first "DCD 0xNNNNZZZZ ; Function start"

4. In the most cases ImageBase will be 0xNNNN0000

5. Run LordPE and update ImageBase, BaseOfCode, and BaseOfData
[Windows Phone 7 Development and Hacking] lyriquidperfection:
Take a look here at post #6

http://xdaforums.com/showthread.php?t=910439

I loaded the AppUtil.dll into DLL Export Viewer and most of the functions arent listed that the user posted. Any ideas?
[Windows Phone 7 Development and Hacking] denominator77:
They are discussing COMRilClient.dll. You can find it inside DiagnosisApp.xap. Just open DiagnosisApp.dll in Reflector and look into Samsung.Phone.RIL namespace.
[Windows Phone 7 Development and Hacking] attilah:
No success with reversing AppUtil.dll and WinDiag.dll

Yesterday I opened up the denominator77 provided rebuilt DLLs and I started out from the debug string for CreateFile and other operations and it turned out that they're referenced from a jumptable (switch statement in C) but the procedure which referenced the jumptable itself has no xrefs, so those functions are probably part of a bigger .lib but no IOCTL is defined for them :-(((

If I'm right...now we're back at square one... :-(
[Windows Phone 7 Development and Hacking] denominator77:
What did you look exactly? I do see IOControl in both drivers. windiag.dll requires mannual attention to fix some references. But apputil.dll looks completely decoded by IDA.
[Windows Phone 7 Development and Hacking] attilah:
I've located the debug strings for the CreateDirectory operations in windiag, then xref-fed the string...it turned out that there is a jumptable with functions (probably handling 1 ioctl code) and that function which is using that jumptable is not referenced there are no calls to that function :-(
[Windows Phone 7 Development and Hacking] denominator77:
I see what you are trying to trace. Is it sub_EE631308? Anyway, use binary search to find address of a function which looks like not referenced. windiag uses indirect calls very often.

First links of the chain: sub_EE631308 <- sub_EE62C0E8+C <- sub_EE633FD4+6C0...
[Windows Phone 7 Development and Hacking] indiekiduk:
Ok so just now we can't modify the permissions that apps run as. Ideally we would like to make TaskHost.exe run as TCB instead of LPC so that our apps can have full permissions. I'm pretty sure TaskHost is the container that runs the silverlight dlls you see. Anyway we can't modify these permissions because they are stored in the ACL database, not in the registry, however it appears than in the registry you can edit the user account that a driver or service is launched with. So my idea is as follows:

1. Build a native service DLL that listens for window messages and does something that requires full privileges, e.g. use the wlanapi.

2. Install the service dll using the HTC copy methods, and use provxml to setup the registry, adding a ProcGroup entry as 1 (I think its 1 for TCB).

3. Make a .net app that uses a COM dll to send window messages and receive replies from the service.

My worry is that if dlls don't have an entry in the ACL database they might not be executable at all, however if not then this has a slight chance of working, don't you think?
[Windows Phone 7 Development and Hacking] attilah:
Thinking further...

Yes, it's sub_EE631308.

It turned out to be a useful idea (probably you already did this search yourself) since at EE623290 I can see some kind of table, probably an IOCTL code to function mapping and the table begins at dword_EE6232B4 referencing the table which contains the pointer to our function. And it is used from DiagMMI_Init()...

Windiag seems to be a message queue based diagnostic component which can post and receive instruction messages thru a queue.

I will apply this binary search "best practice" to the readfile and writefile debug messages, maybe it turns out something useful for us...