yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] (nico):
I could... but I think jmorrill was working on it.

@jmorrill: if you read this, are you still working on File System access?
[Windows Phone 7 Development and Hacking] jmorrill:
Here's what I have on the file system code. It's not complete and running short on time to finish.

http://dl.dropbox.com/u/4165054/FileSystemSample.zip

I didn't do any "write" code yet, but should be enough to read files and list out directories...which right now seems to be "\Windows". :)

-Jer
[Windows Phone 7 Development and Hacking] ajhvdb:
Excellent!! I downloaded it and tried to compile it. Offcourse didn't work but reading the latest messages go it working except the recompile of the VS2008: FileSystem.dll

1>.\FileSystemppc.rc(125) : fatal error RC1015: cannot open include file 'res\FileSystem.rc2'.

Do you have that file?
[Windows Phone 7 Development and Hacking] ajhvdb:
And for others who are willing to share there info! Below are the steps to compile and debug this on your phone:

> Unzip the file

> rightmouse on \Assemblies\Microsoft.Phone.InteropServices.dll>properties

> unblock and make it read-only

> delete \FileSystemSample\FileSystemSample\bin\debug\Microsoft.Phone.InteropServices.dll

> Create a batchfile with the lines below and modify the path to the dll

C:

cd\Program Files\Microsoft SDKs\Windows\v7.0A\bin

sn -Vr D:\_PROJECT\WP7\_Source\_Homebrew\FileSystemSample\FileSystemSample\Assemblies\Microsoft.Phone.InteropServices.dll

pause

> run the batchfile as administrator

> rename the "FileSystem - Copy.dll" to "FileSystem.dll"

> Open FileSystemSample.sln

> check the references

> Compile and debug

Look at the debug output..! Thanks again. :)
[Windows Phone 7 Development and Hacking] ceesheim:
thanks man but could you make a .xap of it (I am still a noob in this things :( )
[Windows Phone 7 Development and Hacking] ajhvdb:
It's not a file explorer. It's the start of a possible file explorer.

Why don't you install the development tools and try to compile it. Then you can see why a xap isn't an option now :) it will start but nothing shows without the debugger,
[Windows Phone 7 Development and Hacking] ceesheim:
LOL , I told you so ,I am a noob :)

I tried that and it didn't work so thats way I asked it here , but tanks for explaining way it isn't working .
[Windows Phone 7 Development and Hacking] (nico):
I've started a File Explorer app using my own filesystem lib, and I'm disappointed on the number of access denied I get.

For example, I can't access \My Documents or \My Documents\My Ringtones.
[Windows Phone 7 Development and Hacking] (nico):
I've updated my Registry Viewer app (added access to controlpanel registry).

I've also included the source code of both the native lib and the app itself;

Warning: the code is sometimes really bad as I've discovered COM with this project :)

A work in progress of my FS lib is also included.

You can find everything here: http://bit.ly/ed1Sz1
[Windows Phone 7 Development and Hacking] ceesheim:
would you like to share it ?
[Windows Phone 7 Development and Hacking] (nico):
I'm currently working on write support for the registry app.

Does anyone have an idea on a registry key with write access?

I've tried several keys (including ringtone settings) with no luck.
[Windows Phone 7 Development and Hacking] n0psl3d:
Try the error reporting registry keys:

HKEY_Local_Machine\System\ErrorReporting\DumpSettings

DumpDirectory for example.

I have write access to these using a HTC driver, not tried using the win32 api calls.
[Windows Phone 7 Development and Hacking] (nico):
Access denied.

It's not a surprise HTC apps got better access than we do :)

Has anybody found if access level is determined through signing certificate or anything else?
[Windows Phone 7 Development and Hacking] n0psl3d:
Yeah, it seems to be determined by the certificate which the application is signed with. The loadverifier seems to enforce the security policies at load time. Each application gets it own chamber with ACLs depending on what the chamber is.

The OEM apps seem to bypass the policy restrictions because their drivers are signed with the TCB cert and if there is nothing in the security policy to stop you making the driver call it is allowed.
[Windows Phone 7 Development and Hacking] (nico):
By the way, could you share your code using HTC drivers?
[Windows Phone 7 Development and Hacking] davux:
I've extended jmorrill's code to include the Winsock functions to listen. The example proves that one may listen on port 80.

One problem with this library right now is that it is IPv4 only. I tried to make things generic but that was quite hard, I'm also really not very familiar with native Winsock anyway.

dl.dropbox.com/u/12359/PhoneNetworkingSample_with_listen.zip

[edit] and here's a really simple (and really hacked together - you've been warned) webserver!

dl.dropbox.com/u/12359/wp7_webserver.zip

The code is definitely *preview quality* - I pulled it together just now because I don't think I'll be able to work on this for a few days, so it'd be a starting point but I'm sure it's buggy.
[Windows Phone 7 Development and Hacking] ceesheim:
Thanks for sharing .
[Windows Phone 7 Development and Hacking] ajhvdb:
yes, thx.

I found a C# simple webserver code already. Maybe you can use that: http://dl.dropbox.com/u/14396192/SimpleHttpServer1.1.zip

Maybe im wrong but what im thinking is create a basic webserver, show the external IP address on the device, I user types in this IP adress on his Desktop PC and connects to the device, the webserver sends a silverlight application to the desktop and ....
[Windows Phone 7 Development and Hacking] xanderkaiber:
This is excellent progress guys! I'll grab the source and take a look this evening. Hopefully I can help somewhat.

Sounding very promising so far :)
[Windows Phone 7 Development and Hacking] xanderkaiber:
Just got the filesystem sample deployed and running.

Nice work guys :)

Gonna put a bit of UI together for it
[Windows Phone 7 Development and Hacking] indiekiduk:
Have you tried using this ;-)

ID_CAP_LOADUNSIGNEDNATIVEDLL:Capability to load unsigned native dll into chamber's process space

Unfortunately its not in the manifest schema so has to be added by decompressing the xap and install manually. Which is a pain because means you can't debug.
[Windows Phone 7 Development and Hacking] n0psl3d:
I did notice that yeah, not tried it myself yet. Does it work? However, for what I want to do its not going to help to elevated privileges to the level required... since its still going to be loaded into the LPC chamber space.

Also, For what its worth, the load verifier module also sets and gets the developer unlock status :-)

Thinking of JTAG debugging and patching out some of the checks in the bootloader if possible..
[Windows Phone 7 Development and Hacking] itmgmg:
Hi Sir,

I can deploy on Phone Emulator, but when running the application, 'the network request' error is throwing in fileSystemIo = new FileSystem Class() as FileSystemIO; code.

Help me please!
[Windows Phone 7 Development and Hacking] jmorrill:
The native ARM COM dlls will not run in the emulator.

-Jer
[Windows Phone 7 Development and Hacking] link8506:
Hi,

I built a web server too :rolleyes: (and ftp server coming soon!)

unfortunately, because of sandboxing, it is not very useful...

http://xdaforums.com/showthread.php?t=879077

I will make it open source when I will have cleaned the code (there is many unused lines of code coming from the WM6 version of wifi remote access that make the source code look more messy than it should be)
[Windows Phone 7 Development and Hacking] kroukes2000:
TouchXplorer by Julien Schapman, the developer of TouchXperience coming soon

[YOUTUBE]<object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/57XWYlcZxGM?fs=1&hl=fr_FR"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/57XWYlcZxGM?fs=1&hl=fr_FR" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>[/YOUTUBE]

Source: http://pocketnow.com/windows-phone/touchxplorer-windows-phone-7-file-explorer-demoed-coming-soon
[Windows Phone 7 Development and Hacking] ajhvdb:
Nice, he must know a htc dll we can use?
[Windows Phone 7 Development and Hacking] JoeTheFro:
I have used the touchxp and the storage mode trick to extract the HTC hub, if anyone wants it so they can start goin through the dlls, pm me and i will shoot you a link... i would post up, but not shure how happy HTC would be if the XAP was floating around.
[Windows Phone 7 Development and Hacking] ceesheim:
could you tell how you got it from your phone ?

where did you copy it (and In what did you renamed it) on the phone (\My Documents\Zune\Content\?)
[Windows Phone 7 Development and Hacking] ajhvdb:
Where is this trick explained? I have send you a PM :o
[Windows Phone 7 Development and Hacking] ceesheim:
Tip: How to access files copied from your PC using mass storage hack

Go to \My Documents\Zune\Content in TouchXplorer, you should find your files somewhere here renamed by Zune with a short name, as well as all your synced content. Then copy it on a safe place like \My Documents and rename the file with its original extension. Hopefully I will work on a simpler way to do it and without needing any hack.

and this:http://www.biggtech.com/software/mi...-wp7-smartphone-just-like-usb-drive_3714.html
[Windows Phone 7 Development and Hacking] JoeTheFro:
To do this the other way around, i created a simple txt file and put in some basic text ( "This is the file you are looking for" ).

Dropped it onto the phone. Snagged whatever file i wanted from the device and replaced the text file with the real one. Then i plugged the phone back in and grabbed it out.
[Windows Phone 7 Development and Hacking] ajhvdb:
I read this 10 times but still don't get it. sorry. :o

Could you explain these steps again?
[Windows Phone 7 Development and Hacking] JoeTheFro:
best i can do for yah,

To get off phone ( this uses the disk mode registry trick )

You need to create a dummy file on your pc that matches the file you want to rip from the phone.. so in my case i created a txt file called HTCHub.xap and i put it in the Videos folder on the phone.

In the My Docs folder, you will see Zune, then content. i think it was 0400 that holds videos. either way, look through the the folders for a 0k file (the txt file, as it will NOT have the real name that was on pc. Mine was called dd.z )

Once you find the file, copy the file you want to that location, delete your text file and rename the file to match what it was called (dd.z or whatever you find).

Plug phone in, and now you should have the xap in the folder you dumped it into.
[Windows Phone 7 Development and Hacking] ajhvdb:
got it, thx.

BTW: what the hell were they thinking saving it this difficultly..
[Windows Phone 7 Development and Hacking] ceesheim:
just to bug us I think :D
[Windows Phone 7 Development and Hacking] indiekiduk:
Tried to use ID_CAP_LOADUNSIGNEDNATIVEDLL in a modified XAP today but unfortunately the Application Deployment tool says "Error - Access is denied" once this capability is added. Going to keep trying other ways because I think even the LPC chamber would be a big advantage over the 3rd party area.
[Windows Phone 7 Development and Hacking] n0psl3d:
3rd party application runs in the LPC chamber as well, so I don't think you will get any more elevated privs, just the ability to load unsigned code. Need to break into the standard rights, elevated or TCB (ideally) for a higher level access to the OS (these permissions are not controlled by capabilities and are fixed in the ROM image)...
[Windows Phone 7 Development and Hacking] indiekiduk:
Sorry that was a mistake, I think that ID_CAP_LOADUNSIGNEDNATIVEDLL would get me at least the Standard Rights Chamber. Otherwise there would be no point in that cabability since the default behaviour allows loading unsigned native dlls into LPC.
[Windows Phone 7 Development and Hacking] n0psl3d:
Perhaps, the code is in lvmod.dll function LVModProvisionSecurityForApplication which I think is when the chamber gets created.. I haven't fully finished reversing it out.. Would be cool to confirm this. It makes calls to LVModGetDeveloperUnlockState which checks a registry key. No write access to this key but its there...

It specifically mentions loads into chambers process space here as well:

<Macro Id="CAPMACRO_ID_CAP_LOADUNSIGNEDNATIVEDLL" Value="S-1-5-112-0-0X71-0X49445F4341505F4C4F4144554E5349474E45444E4154495645444C4C" />

<Account Id="S-1-5-112-0-0X71-0X49445F4341505F4C4F4144554E5349474E45444E4154495645444C4C" Description="Autogenerated group for capability ID_CAP_LOADUNSIGNEDNATIV EDLL" FriendlyName="ID_CAP_LOADUNSIGNEDNATIVEDLL:Capability to load unsigned native dll into chamber's process space" Type="Group">

<MemberOfGroup GroupAccountId="S-1-5-112-0-0X71" />

</Account>

However, thats part of this group:

<Macro Id="PRIVATE_CAPABILITIES_GROUP_NAME" Description="Private capabilities group" Value="S-1-5-112-0-0X71" />

Which is interesting, worth looking into..

EDIT: Hmm cool, might be possible to get standard rights indeed. ID_CAP_TESTPRIVATE1 and ID_CAP_TESTPRIVATE2 give the same access denied message also.
[Windows Phone 7 Development and Hacking] indiekiduk:
It might also be done when the xap is installed. I'd like to know what is checking the capabilities when the xap is installed and returning the access denied message.

There must be a way round this...otherwise partners wouldn't be able to test their native apps. Or maybe we need to look more closely at how Samsung's NetProfile app is signed and see if we can somehow get the phone to trust our own cert.

Btw there are no certs in the windows embedded compact 7 SDK.
[Windows Phone 7 Development and Hacking] ajhvdb:
Maybe a bit offtopic but may I ask; when do you think the XAP is certified/signed.

We can download all XAP files without a problem, so my guess is Zune downloads the xap and installs it with the correct rights from the xaml..
[Windows Phone 7 Development and Hacking] indiekiduk:
The XAP isn't signed but the DLLs inside it are. Open them in a text editor and scroll to the bottom.
[Windows Phone 7 Development and Hacking] indiekiduk:
It just occured to me that ID_CAP_LOADUNSIGNEDNATIVEDLL is probably the wrong one to use. It probably is for the app and not for native COM dlls used by the app so is designed for when the runtime = "Native". What we want to try is the managed cap: ID_CAP_LOADUNSIGNEDMANAGEDDLL.
[Windows Phone 7 Development and Hacking] ajhvdb:
Yes, I should be more specific :)

What do you think, is the procedure to get them signed?
[Windows Phone 7 Development and Hacking] n0psl3d:
Yes, right.. I think what happens is when a XAP is installed that function is called to provision the security (create the chamber/users/add to groups etc..). The security is basically inherited from the LPC chamber permissions and a new user (SID) is created for the application and its sandbox. Therefore each application kinda has its own chamber and permission sets.

Without proper OS debugging its hard to look into this properly.. Ill see if I can track down the access denied message.

I haven't looked at the databases yet, but users and permissions etc are stored in \Windows\Security\accountdb.vol and \Windows\Security\policydb.vol. What I am working from is I think the security policy when the ROM is flashed.. so its a little unclear how this affects apps installed after that. You can see each app provisioned in the ROM getting its own chamber:

<Account Id="S-1-5-112-0-0X10-0X0000000A" Description="Autogenerated chamber for oobe.exe" FriendlyName="oobe.exe" Type="User">

<Account Id="S-1-5-112-0-0X10-0X0000000B" Description="Autogenerated chamber for Device Feedback CPL" FriendlyName="Device Feedback CPL" Type="User">

<Account Id="S-1-5-112-0-0X10-0X0000000D" Description="Autogenerated chamber for Settings3.exe Chamber" FriendlyName="Settings3.exe Chamber" Type="User">

Is the Samsung netprofile app not just like the HTC COMDLL's? They are signed with the LPC chamber certificate, however, there are HTC device drivers in the ROM which the COMDLL's just uses to do its low level stuff. There's nothing to stop you doing that. I can call functions in coredll, DeviceIoControl's etc.. from native code.. There's nothing stopping you doing that unless the policy blacklists it..

I assume Samsung/HTC etc test their apps on proper development phones where they can flash their own development ROMs with less security.
[Windows Phone 7 Development and Hacking] indiekiduk:
I want to build a wifi scanner so am trying to use WlanOpenHandle in the native wifi api from inside my native COM dll but receive the error ERROR_ACCESS_DENIED "The caller does not have sufficient permissions." I could also use DeviceIOCtls to UIO1, the NDISUIO usermode driver however CreateFile to that also returns access denied. So I made the assumption that these things aren't possible in the LPC. What DeviceIOCtls did you get to work?

The Samsung DLLs are signed with "Microsoft Phone Applications for LPC" actually yeh, so now I'm a bit confused. Are normal apps from the marketplace that don't do any p/invoke signed?

I've looked around the ROM at the wlan security policies but its not obvious what chamber is required since this one makes it look like no special permissions are required:

<Rule Description="Everyone can enable or disable background scans" ResourceIri="$(GLOBAL_RESOURCES)/WLAN_SECURABLE_OBJECT/$(WLAN_SECURE_BC_SCAN_ENABLED)" SpeakerAccountId="$(SYSTEM_USER_NAME)" PriorityCategoryId="PRIORITY_HIGH">

<Authorize>

<Match AccountId="$(EVERYONE_GROUP_NAME)" AuthorizationIds="ALL_ACCESS">

</Match>

</Authorize>

</Rule>

This snippet from the policy xml file in NetWlanCore would make you think that you should be able to do at least something with the wifi, but if the WlanOpenHandle returns access denied I don't see how anything is possible.
[Windows Phone 7 Development and Hacking] JoeTheFro:
For those with HTC phones, if you use the method for getting files out of the system, under the windows dir, there are a couple files of interest..

HTCFileUtility ( maybe a group of wrapper functions to get to undoc api for filesystem access )

htcfsfilter ( think this is the filesystem filter driver )

HTCRegUtility ( same as file, but api wrapper for registry functions )

and lastly a plain ol

HTCUtility

not sure if anyone found those, but for you guys working backwards on stuff, there is a start..
[Windows Phone 7 Development and Hacking] WithinRafael:
indie, I haven't tried communicating via DeviceIoControl but the carrier applications work so I'm guessing there may just be a bug in your application.

You're just requesting GENERIC_READ | GENERIC_WRITE access right?
[Windows Phone 7 Development and Hacking] indiekiduk:
Well in one case I'm trying to get the list of adaptors so using CreateFile with NDS0: and only GENERIC_READ.

What carrier application have you seen use DeviceIoControl so I can take a look?
[Windows Phone 7 Development and Hacking] Heathcliff74:
After a lot of attempts I got the HTC Hub installed on my Samsung Omnia 7. Except it doesn't work!

I used the package, created by JoeTheFro.

I tried to use the Tom XAP installer, but it would just give me a generic error.

Then I tried to use the Windows Phone Application Deploymet tool. That gave me this error:

Installation of the application failed. XAP package signature is not valid or the WP manifest file is invalid. Re-sign with valid signature and fix the manifest file.

So I searched and finally tried to follow these step to sign the xap-file. I created and used this batch-file:

@Echo When asked for a password enter: pw
del /s TestCodeSigningCA.cer
del /s TestCodeSigningCA.pfx
del /s TestCodeSigningCA.pvk
del /s TestRootCA.cer
del /s TestRootCA.pvk
"C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\makecert.exe" -n "CN=Test Root Certificate Authority" -r -a sha1 -sr LocalMachine -sky signature -sv TestRootCA.pvk TestRootCA.cer
"C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\makecert.exe" -sv TestCodeSigningCA.pvk -iv TestRootCA.pvk -n "CN=Test Code Signing CA" -ic TestRootCA.cer TestCodeSigningCA.cer
"C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\pvk2pfx.exe" -pvk TestCodeSigningCA.pvk -spc TestCodeSigningCA.cer -pfx TestCodeSigningCA.pfx -po pw
"C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\signtool.exe" sign /v /f TestCodeSigningCA.pfx /p pw HTCHub.xap
@pause

After I tried to deploy again I got this error:

Installation of the application failed. Run time error has occured. Fix the Capabilities in WMAppManifest.xml file.

I thought I was one step further. I tried removing all capabilities from the WMAppManifest.xml, repack, resign and deploy. No luck. Then I tried adding all capabilities I knew to the WMAppManifest.xml, repack, resign and deploy. Still no luck. Later I realized that by signing the package this way I problably got one step back and the deployment would fail in an earlier stage. Probably no privileges at all, because of invalid certificate.

So I searched a bit further to get the cause of the first deployment error. I started to realize that the WMAppPRHeader.xml contains all DRM info for a package. And that is probably the "WP manifest file" that was referred to in the error message. So I removed that file from the package. And then I was able to deploy the package to my phone. I could add the tile to my home-screen! JoeTheFro, was that WMAppPRHeader.xml file originally on your device, or was it created by a packager?

Unfortunately I cannot start the hub :( Probably two reasons:

- DRM file was removed. If there are checks on it in the software, they fail.

- In HTC.Shell.Registry.dll there is a function called HTCRegistry.IsHTCDevice(). This calls a native function which should return 0xb9d548dc, or else it fails.

The reason the HTC shell assembly does not function on other devices may not be the dependency on hardware drivers, but just this check in a device-property. That raises this question: Is it possible to patch the native dll and still have the assembly get the higher privileges its got now? (Probably not) I will try that later.

Ciao!
[Windows Phone 7 Development and Hacking] n0psl3d:
To be honest, I only tried the HTC driver flashlight code (FLA:) with CreateFile/DeviceIoControl from my COM dll, that worked fine. That was the simplest code to recreate, I just wanted to test it worked. I expect the filesystem, registry and key capture to work directly as well because that's how HTC do it from their COM DLLs. I just put those COM dlls in my code then used them as the API instead of DeviceIoControl calls and that worked.

Every application you download from the marketplace is signed regardless if it uses Interopservices or not.. It needs to be before it will run on the phone.

<Macro Id="WLAN_SECURE_BC_SCAN_ENABLED" Description="WLAN securable object" Value="3" />

<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/RESOURCES/GLOBAL/WLAN_SECURABLE_OBJECT/3" SpeakerAccountId="S-1-5-112-0-0-1" Description="Standard users can enable or disable background scans">

<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="SCHEDULE_GENERIC_ACCESS, SCHEDULE_CREATE_PERSISTENT, SCHEDULE_ALL_ACCESS, MESSAGE_SEND, MESSAGE_RECEIVE, PROCESS_QUERY_INFORMATION, PROCESS_DUP_HANDLE, GENERIC_READ, GENERIC_WRITE, GENERIC_EXECUTE, GENERIC_ALL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE, STANDARD_RIGHTS_REQUIRED, SPECIFIC_RIGHTS_ALL, ALL_ACCESS" />

</Authorize>

</Rule>

I think you need standard rights minimum to do any Wifi stuff.. The sandbox is weird though, if you find a carrier app that uses DeviceIoControl instead you might be able to bypass this :-)
[Windows Phone 7 Development and Hacking] indiekiduk:
Yes, it's quite easy to patch a function to change the = to a !=. Alternatively you could decompile HTC.Shell.Registry.dl with Reflector and build it yourself with a different implementation of the function. How easy this is depends on the complexity of that library, Reflector isn't perfect!