yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] WithinRafael:
It may be worth mentioning that the SHA-1 (or 256, I have to check my notes) hash of the policy XML files that it shoves into the registry -- is truncated. I'm not a crypto. expert, but I'm pretty sure that increases the chances of collision (if it's being read out/used).

Just a random factoid.
[Windows Phone 7 Development and Hacking] JoeTheFro:
Interesting....

take a look at this, maybe it may help shed some light

http://www.jac-it.com/xda/HTCHub_License.xml
[Windows Phone 7 Development and Hacking] WithinRafael:
Base64 decodes into PlayReady-related certificate blobs. Hm.

http://msdn.microsoft.com/en-us/library/dd743095(VS.85).aspx
[Windows Phone 7 Development and Hacking] Heathcliff74:
PlayReady is just another name for DRM used on Windows Phone devices. The WMAppPRHeader.xml file is the PlayReady header, which contains DRM info for XAP packages.
[Windows Phone 7 Development and Hacking] n0psl3d:
Hey, ok well I don't think you could just add to the registry. I don't think it builds the registry like that either (more like builds the policydb.vol)? I think the load verifier checks against \Windows\Security\policydb.vol database. You would probably need to add an entry in that. Here's the rules from the policy xml file which specifies the CA certs it needs to be signed with for the chambers:

<Rule PriorityCategoryId="PRIORITY_STANDARD" ResourceIri="/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/1C8229F5C8D6E256BDCB427CC5521EC2F8FF011A" SpeakerAccountId ="S-1-5-112-0-0-1" Description="Microsoft Mobile Device Unprivileged PCA(Cert #127) is honored by Standard Right Identity Group">
<Match AccountId="S-1-5-112-0-0X22" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>

<Rule PriorityCategoryId="PRIORITY_STANDARD" ResourceIri="/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/CED778D7BB4CB41D26C40328CC9C0397926B4EEA" SpeakerAccountId ="S-1-5-112-0-0-1" Description="Microsoft Mobile Device Privileged PCA(Cert #126) is honored by Elevated Right Identity Group">
<Authorize>
Match AccountId="S-1-5-112-0-0X13" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

<Rule PriorityCategoryId="PRIORITY_STANDARD" ResourceIri="/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/88BCAEC267EF8B366C6E6215AC4028E7A1BE2DEB" SpeakerAccountId ="S-1-5-112-0-0-1" Description="Microsoft Mobile Device TCB PCA is only honored by WLIDSVC_STANDARD_SELF_ISOLATED">
<Authorize>
<Match AccountId="S-1-5-112-0-0X21-0X00000001" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

<Rule PriorityCategoryId="PRIORITY_STANDARD" ResourceIri="/LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/069DBCCA9590D1B5ED7C73DE65795348E58D4AE3" SpeakerAccountId ="S-1-5-112-0-0-1" Description="VeriSign Mobile Root Authority for Microsoft is honored by LPC Identity Group">
<Authorize>
<Match AccountId="S-1-5-112-0-0X81" AuthorizationIds="LV_ACCESS_EXECUTE" />
</Authorize>
</Rule>

As you can see Marketplace code is signed using the VeriSign LPC cert.

Even with Elevated rights (HTC AppDrivers) there are still a lot of registry keys we require TCB for write access to (e.g HKLM/COMM/SECURITY/LVMOD/*).
[Windows Phone 7 Development and Hacking] Heathcliff74:
I want to have better filesystem/registry access on my Samsung. I was hoping to find managed assemblies that would access the samsung drivers the same way it is working on HTC devices. I couldn't get any files from my phone or from the rom image I got. So I wanted to see if I could get my hands on samsung assemblies in another way.

I wanted to capture the network traffic of my phone. First I tried to install "Connectify" on my computer and use it as a Virtual WiFi host. I set up my phone to log on to that access point, disabled my cellular data connection and all traffic was routed through my computer. Unfortunately I couldn't get wireshark to capture any data. Wierd, because I got some docs stating that it should work.

Another attempt. I installed "Cain" for ARP Cache Poisoning. I routed the data from my phone through my computer. This doesn't work very well. Simple browsing works, but the marketplace gives me all kinds of errors (as soon as I quit Cain everything is back to normal). While browsing the marketplace I could however see some Atom Xml with download URLs. Tried to capture that and download the XAP's to my computer. That worked! The XAP's are not installable, because the DRM is added by the marketplace in real time, based on the LiveID cookie. So the XAP's I got do not have valid PlayReady DRM in the WMAppPRHeader.xml files. But that is not the point.

This way I got the url's of all the Samsung Xap's in the marketplace and I downloaded and extracted all of them. Sadly I have to conclude that the native access from the NetworkProfile app was the most extensive one of them all. :mad:

So I still have no real browsing capabilities and no access to the filesystem.

Edit: This doesn't mean the Samsung drivers don't have these capabilities, because in all packages only those native functions were left there, that were actually used. So there's big chance, there is more in the drivers than what I've seen so far. I just have no clue about how to access that.
[Windows Phone 7 Development and Hacking] indiekiduk:
The other guy that got the network profile xap for us did it simply with a wifi packet sniffer. If you could take the drm xml file out and someone remove the authenticode signature then you could probably run the xaps. I noticed a xap appeared on usenet without the signature which is why I asked earlier on if some xaps on the marketplace are not signed but they all are of course.

Has anyone managed to extract the driver dlls from a HTC HD7 ROM I'd like to take a look at whats available...
[Windows Phone 7 Development and Hacking] n0psl3d:
Yeah, im having a problem with rebuilding the modules though. Right now the disassembly is pretty broken. Recmod needs to be updated to handle the RELOC section of the PE I think and perhaps more stuff.

Use http://xdaforums.com/showthread.php?p=2028331#post2028331 to extract the module from the ROM.

Source code for recmod is here http://code.google.com/p/aeroboot/source/browse/trunk/wm/rom-kitchen/imgfs_tools_src/recmod/
[Windows Phone 7 Development and Hacking] indiekiduk:
Do you think we could add a new TCB entry for our own cert to the policy xml file in a custom ROM? I'm not exactly sure how the security polices are created on the phone when the rom is flashed...didn't some of the old WM6 ROMs include the privileged SDK cert CA? I suppose it could have just been a CAB installed as part of the first run customisations.

It might be the case that if an app dll is signed then it checks for the drm blob in which case the idea above won't work. So would need to go the harder route of patching out checks.
[Windows Phone 7 Development and Hacking] n0psl3d:
I think what happens is that you write a XML security policy for the module, then it gets pulled into the PolicyCommit.xml and written to the policydb.vol when the ROM is built. After that I think the changes are made to the policydb.vol/accountsdb.vol when new apps are provisioned.

If we can custom ROM flash then you could either just patch out the checks or inject a TCB certificate into wherever its needed. Problem is, production SPLs are security locked.. I think it would require that to be hacked first.
[Windows Phone 7 Development and Hacking] ceesheim:
could you gif us a download link to that Samsung rom image ?
[Windows Phone 7 Development and Hacking] Heathcliff74:
http://www.samfirmware.com/WEBPROTECT-i8700.htm

You have to register first, but its free.

The rom is in nb0 format. I don't know how to extract it. Tried different tools (see earlier posts). No luck.
[Windows Phone 7 Development and Hacking] WithinRafael:
So, it looks like direct-driver (DeviceIoControl) access is also restricted via policy (all non-privileged calls seem to return ERROR_INVALID_PARAMETER). I'm guessing we can piggy back off the carrier COM libraries because they're signed properly ... but we're at the mercy of the library's functionality, which sucks. :(

I'm going re-verify my control codes and whatnot, just in case I missed something.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Nice to see you're working on that. I concluded earlier that there was no need for code-signing.

This is what I did. I made a test-project to test writing to the registry using a Samsung dll. Then I checked for strongname-signing in the .NET assemblies. There was no signature, so nothing to remove. Then I used LordPE (make sure option "section table: autofix sizeofimage" is turned off) to open the directory-table of the dll's (both native and managed). Reset the offset and size of the "security" directory to 0, save the directory-table. Recalculate checksum and save the dll. Repack the XAP and deploy.

Writing to the registry was still working! Maybe the HTC driver is checking the signature, but I doubt that.

Could it be that you miss some initialization code?

In the mean time I'm still working on the API of the Samsung drivers, but I not really making a lot of progress. I still don't have proper filesystem access on my Samsung Omnia 7. I want to know if the Samsung drivers provide more access, than what I've seen in the managed Samsung dll's so far. In order to do that I need to analyze the driver. But I don't know which files I should analyze and how to get those files on my PC.

My plan was to get the drivers from a rom-image I downloaded. I saw the rom-image I downloaded was a beta version (pre build 7000). The download contained a .nb0 file which is about the same as an extracted os.nb from an HTC image. I looked at the filestructure and I'm pretty sure the IMGFS is at 01b23000-0cbda067. I dumped that, but xidump was not able to dump the contents. Error: invalid block signature.

I already did some research on ARM assembly, parameter passing, usage of IDA pro with these binaries and calling CreateFile and DeviceIoControl. But I still need a dump of the actual driver to be able to see which IoControlCodes I can use and what parameter-structures I should use. I have to do some detailed reverse-engineering, because I have no example of the calling code and if I use the wrong codes or parameters I could screw up my device.

Next thing I will try is to get xidump working on my IMGFS dump. Maybe I can ask some assistance of Da-G.
[Windows Phone 7 Development and Hacking] l3v5y:
I believe there is some code signing checking going on, the HTC libraries only work on HTC devices, with HTC certificates installed. It might be that the code signing is lowering the required permissions of the XAP, making things that wouldn't normally be possible work.

For getting files of the device, I'd recommend using this, which seems to work for me, and is a lot simpler than dumping a ROM!
[Windows Phone 7 Development and Hacking] kuerbis2:
Interested in getting the htc hub application without authenticode certificates embedded in the dlls? This would help to find out if it actually is correct to assume that code signing is the missing link.

(BTW: Don't think so. I've reused the Samsung DLLs with unsigned code therefore should make any difference if the code is signed or not).

The codes from HTC and LG do check if they run on the expected hardware. LGs augmented reality app does check for extended camera properties (should be present on any device) and in addition it has an internal table of allowed handsets and operators. Samsungs code does the check based on Samsung-only registry entries and last but not least HTC does also check for specific registry settings.

I have deployed the htc hub to my samsung omnia 7 and the hub detected that it was not running on a htc device. That was reason enough to look at the code ;)

regards,

-tobias
[Windows Phone 7 Development and Hacking] n0psl3d:
The HTC apps only work on HTC devices because they are essentially just wrappers for the HTC drivers already installed in the ROM (IMGFS\OEM\HTC_AppDrivers). Our apps are just running in the LPC chamber the drivers are running in the elevated chamber (i.e. signed with a higher priv cert) and there is no security policy preventing access the the IOCTLs exposed (or rather there might be one that permits it).. that's why we can only use the functionality of these drivers and not others.

The check in the HTC xap's is irrelevant really due to the lack of driver support in the other devices.
[Windows Phone 7 Development and Hacking] obelix:
I've seen some examples like of the WebServer that lets files be downloaded including .EXEs from \windows. We can also execute apps located in\windows. Has anyone found a directory that can support write access through native APIs that would allow an EXE to be uploaded to and executed from that directory?
[Windows Phone 7 Development and Hacking] l3v5y:
Didn't realise that... Is there anything to stop us just copying the HTC dlls into an XAP and having the deployed with the XAP?
[Windows Phone 7 Development and Hacking] l3v5y:
Using the Microsoft.SmartDevice.Connectivity stuff (what's used by the XAP deployer) it should be possible, though whenever I've tried, I get "Access Denied" or similar. I'm working on that though...
[Windows Phone 7 Development and Hacking] n0psl3d:
I doubt that would be possible, although admittedly not tried it... Might be worth a try actually... (The registry one is the most likely because that just seems to be using the normal win32 reg api calls internally). You would somehow have to get drivers installed properly and hosted in the correct service process.

From what I can see, the only way by design you can get the functionality is to use the OEM drivers provided in your ROM and their exposed API or (much harder) find a bug to get your application installed in a higher priv chamber, then make use of the win32 api at that level.
[Windows Phone 7 Development and Hacking] obelix:
Can someone post FileSystem.dll from jmorrill's filesystem sample? I dont have vs2008/c++ installed.
[Windows Phone 7 Development and Hacking] eme915:
Whether can use FSDMGR.DLL realization?
[Windows Phone 7 Development and Hacking] indiekiduk:
Even if you could add the registry keys to install your own driver you would still need to sign the dll which is just the same problem as the one we are facing for trying to do what we want in a COM dll.
[Windows Phone 7 Development and Hacking] n0psl3d:
He was aiming at just re-adding the already presigned HTC driver dlls (not the LPC signed com dlls) so you wouldn't need to sign them yourself. Its very unlikely to work unless the loader somehow detects its a driver signed with a higher cert and installs it properly to the userland driver service process and creates a higher priv chamber for it.. :]

Regardless.. I have a feeling you need to go through the ULDR to deploy to a chamber higher than LPC. I guess that's what the OS updates in Jan will be pushed out using + any OEM fixes.
[Windows Phone 7 Development and Hacking] WithinRafael:
The reg. one also communicates with the driver via DeviceIoControl.

BTW, everyone can laugh at me now. The reason my DeviceIoControl calls were failing were because... of exactly what it said. ERROR_INVALID_PARAMETER. I was trying to communicate with the HTC driver on my Samsung phone. :D :rolleyes:
[Windows Phone 7 Development and Hacking] n0psl3d:
Indeed, so if you somehow manage to get that driver installed. Internally in the driver it makes WINAPI calls.. doesn't do anything hardware specific.. so potentially would work on another manufacturer if you could install the driver properly (the big challenge).
[Windows Phone 7 Development and Hacking] WithinRafael:
Ah gotcha! (p.s. do we not have an IRC channel?)
[Windows Phone 7 Development and Hacking] WithinRafael:
Okay, so. I was indeed calling DeviceIoControl incorrectly... the user-mode driver -- at least, on Samsung -- implements all the various functions via one control code. Rather than implement a custom control code per function, like any normal human being would do, they use one + some homegrown "selector".

I'm still RE'ing that bit, so I can update my COM library. What a !@#$ing mess. :mad:
[Windows Phone 7 Development and Hacking] indiekiduk:
Let us know if it takes the name of the WinAPI function as part of the struct passed in as lpInBuffer. If so the thing is wide open.
[Windows Phone 7 Development and Hacking] WithinRafael:
Nope, sadly. It uses "method codes", numbers assigned to a baked in list of functions. Samsung and HTC seems to have identical codes, which isn't surprising. I don't think carriers wrote a single line of code -- all comes from MSIT in the end, right? :P (Although, that doesn't explain why it's so horrible...)
[Windows Phone 7 Development and Hacking] indiekiduk:
What is the driver name of each? You know like "UIO1:"
[Windows Phone 7 Development and Hacking] n0psl3d:
HTC ones are:

\\HTF0: file system
\\HTR0: registry
FLA1: flashlight

Not looked at Samsung ones.
[Windows Phone 7 Development and Hacking] indiekiduk:
Any chance you could explain exactly what you mean by this in detail? i.e. are you suggesting that the COM dlls may work on either platform by simply hex editing the name of the driver?
[Windows Phone 7 Development and Hacking] indiekiduk:
From COMRilClient.dll in Samsung's netprofile app looks like SRP1: is the driver name which is used for RIL access (e.g. getIMEI), registry access (e.g. RegGetString) and (e.g. ReadTextFile).

To me things look different on HTC and Samsung...

Btw I found another HTC driver called HTU0: which is used in GetInfoComDll_convertor.dll for the GetDeviceInfo. Oh and RMD0: which looks for cellular related queries.

Would be good to konw the corresponding dll names for all these drivers so we can pull them out of the ROM and take a closer look.
[Windows Phone 7 Development and Hacking] indiekiduk:
This is all of the HTC App Drivers:

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCRegUtility]
"Dll"="HTCRegUtility.dll"
"Prefix"="HTR"
"Flags"=dword:10
"Order"=dword:64
"Index"=dword:0
"IClass"="{4619249B-6362-4520-B700-984C8E7BC7A4}"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCFileUtility]
"Dll"="HTCFileUtility.dll"
"Prefix"="HTF"
"Flags"=dword:0
"Order"=dword:64
"Index"=dword:0
"IClass"="{4619249B-6362-4520-B700-984C8E7BC7A4}"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCBgService]
"Dll"="HTCBgService.dll"
"Prefix"="HTB"
"Flags"=dword:10
"Order"=dword:96
"Index"=dword:0
"IClass"=multi_sz:"{0007AE3D-413C-4e7e-8786-E2A696E73A6E}",
"{4619249B-6362-4520-B700-984C8E7BC7A4}"
"AccountSid"="SID_UDEVICE_TCB"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCYouTubeUtility]
"Dll"="HTCYouTubeUtility.dll"
"Prefix"="HTY"
"Flags"=dword:10
"Order"=dword:96
"Index"=dword:0
"IClass"="{4619249B-6362-4520-B700-984C8E7BC7A4}"
"AccountSid"="SID_UDEVICE_TCB"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCProvisionDrv]
"Dll"="HTCProvisionDrv.dll"
"Prefix"="HPO"
"Flags"=dword:10
"Order"=dword:100
"Index"=dword:0
"IClass"="{4619249B-6362-4520-B700-984C8E7BC7A4}"
"AccountSid"="SID_UDEVICE_TCB"
[HKEY_LOCAL_MACHINE\Services\HTCVersionUtility]
"Dll"="HTCVersionUtility.dll"
"Prefix"="HTV"
"Order"=dword:150
"Index"=dword:0
"IClass"="{4619249B-6362-4520-B700-984C8E7BC7A4}"
"AccountSid"="SID_UDEVICE_TCB"
[Windows Phone 7 Development and Hacking] indiekiduk:
I saw this path rule in the security policy:

<Rule Description="By default, all ROM EXEs can be loaded into Standard Rights Chambers and less privileged ones"
ResourceIri="policy:/LOADERVERIFIER/GLOBAL/AUTHORIZATION/PE_AUTHZ/NONE/NONE/PRIMARY/WINDOWS/(*)"

And it made me think that perhaps exes in the Windows folder run with standard rights by default. Then I got the idea to use the HTC File Access driver's CopyFile method to copy my own exe from the app folder to the win folder:

HTCFileAccess h = new HTCFileAccess("HTCHub");
h.Init();
uint x = 0;
string szProductID = "511df06f-443f-40c3-99b6-cebc8deba78e";
string strPath = @"\Applications\Install\" + szProductID + @"\Install\malc.exe";
string strPath2 = @"\Windows\malc.exe";

uint res = h.CopyFile(strPath2, strPath, 1);
uint res2 = h.IsFileExist(strPath2, out x);

This works.

The next thing I'm going to do is run my exe from a COM dll using CreateProcess and see if I can get it to execute and return a result. Then I'm gonna try something only standard rights can do and see if its possible. The aim is to return strings from the exe's standard output to the COM dll, and subsequently back to the silverlight app...
[Windows Phone 7 Development and Hacking] WithinRafael:
Just wanted to chime in and post an update. I was able to call GetIMEI successfully, I've gotten the structure figured out. I'll try to update the structure in the previous post tomorrow evening.

Funny thing is, the driver appears to be bugged. GetIMEI only returns the first 10 digits... :confused: Whoever coded this abomination needs their fingers broken.
[Windows Phone 7 Development and Hacking] n0psl3d:
There are functions in coredll.dll we can call which likely can be used to determine the permissions of our applications and change the thread token. Like normal Windows, ACL's seem to be enforced using tokens (access tokens). On windows in the past it was possible to escalate privileges by hijacking other threads / process tokens (token stealing). CeImpersonateCurrentProcess / CeImpersonateToken / CeDuplicateToken / CeGetProcessAccount are definitely worth looking into.
[Windows Phone 7 Development and Hacking] WithinRafael:
Okay. I started putting together that cross-platform library I promised. It'll be licensed LGPL for maximum flexibility (pay and free developers). Basically, the idea is you bundle ZPM.dll (COM) and ZPM.Managed.dll (C# wrapper). Then calling functions like GetIMEI() will simply *work* magically.

The COM library will take care of the bridging to your specific device/carrier driver. (Although, this logic is not in place yet.)

Keep an eye on https://launchpad.net/zpm for the initial checkin. Right now, I'm checking code into the Samsung branch. You can see a snapshot of the Samsung branch via http://bazaar.launchpad.net/~zpm-coredevs/zpm/samsung/files

EDIT: Checked in.
[Windows Phone 7 Development and Hacking] (nico):
Nice.

What do you plan adding into this lib?

Do you think you will add filesystem access, registry, etc... too? (especially write capability)
[XPERIA X10 Q&A, Help & Troubleshooting] cylent:
hello all.

I am posting this in hopes of getting a favorable response from all the good folks that use the x10(i).

i am seriously considering getting an x10i (either for myself or the wife) however i wanted to open a discussion on some things...

in the past i bought an x10i (about 4 or so months ago - maybe longer) and i didnt like it so much not because of the hardware but because android 1.6 was sooo awful -- slow, sluggish and damn problematic. well now we have 2.2 on other devices and the x10 has 2.1 which is great.

I currently own a galaxy s and i love it for the most part. it lacks some hardware features like a camera flash, real notification led and its just Samsung. not the best when it comes to these things.

se on the other hand has real great potential and makes great looking phones although sometimes careless.

i see the x10 as having the things the galaxy s lacks but main the inability to still have 2.2 or even 2.3 which the galaxy may get first.

other things like the type of processor... i havent got a x10 in my hand to compare to the galaxy but is the arm processor on the galaxy faster than the qualcomm on the x10?

any feedback / advise is greatly appreciated.

oh and before i forget. the x10 is really the only option IF the purchase decision is made. the x10 i can get for $500 ... cant afford another galaxy s for $700. so its either x10 or nothing.
[XPERIA X10 Q&A, Help & Troubleshooting] OmegaRED^:
No.. no and no again.

The x10 has many bugs and faults.

The most common problem is hearing other ppl speak in a phone call.