[Windows Phone 7 Development and Hacking] ntonhd2:
************************************************************

update: Attached is ARM low level bootloader just built; this could be used to load LDR and then ntoskrnl.exe :D.

************************************************************

Please let me know your thoughts and please try to get this to run with debug if you can and pass results & thoughts back to me - Cheers. Hopefully it built ok. What do you think of using this method then? but with FULL & PROPER NTOSKRNL.EXE!

************************************************************

Hi Cotulla, thanks for your reply: appreciate it here.

[also much thanks for hspl, magldr, dft android, leo70ROM. :D.]

ok, sorry if this is a bit all over the place, i have cut and pasted my answers around to try clean it up but it is late and i think my brain is a bit dead sorry, but answers are here anyway :). hope makes sense. firstly please have a look at this video and let me know what you think :).

http://www.youtube.com/watch?v=RFNuY2OFRjU

that is ARM..... i am going through build environment and sourcecode now..... thoughts?

http://www.youtube.com/watch?v=n3v4YC9RT-g&feature=related

can learn a lot from wine. i agree with you on linux. same for virtualization, emulation, etc, like bochs qemu everything :). sandboxing and hypervisor unveils a LOT :D. another thing i wanted to ask you was what do you think of FPGA technology for reverse engineering unknown systems? for example, if i were to start almost any project, like say leo70DFTrelease, or NT on Xbox, or whatever, doesnt matter, i think it is worth spending the time or money (for private company to do it for you) and have an FPGA version of the target device being hacked (hd2 in leo70rom case) and then undo the software problems from a hardware logic perspective. just the way i have worked on things many times and it works for me anyway. but I digress.......... :). if i were to have done wp7hd2 (leo70rom) and magldr, then i would have had to have had (for me, not as good a dev as you) a FPGA based HD2 made up that ran in every way same but with which i could get right in there and do whatever i needed to do to see response& debug. let me know what you reckon... ok... digress now ;):

1)missing CL compiler for ARM with same set of features like CL for X86.

(CL version for ARM for WCE doesn't have all features supported and usually outdated)

what features specifically we need here?

what about tweaking this:

http://reactos.colinfinck.de/files/RosBE-Windows/RosBE-ARM-1.0.exe

2)this ARM compiler store exception info in other format (not SEH frames, but universal table for functions ".pdata")

http://www.reactos.org/wiki/PSEH

http://www.reactos.org/forum/viewtopic.php?f=9&t=5716

reading up on _IMAGE_CE_RUNTIME_FUNCTION_ENTRY. just going over stacks and frames and overall exception handling on ARM. are there any issues with reverse execute, virtual unwind? for this type of execution- how would you handle?

more to the point- how would you do this project :D;):) lol.

problems with prolog/epi? what about moving over x86 asm code? i am right now typing this to you whilst getting updated on specifics on registerslooking at emulators to see this in action. i am reading these here. let me know if on right path and please put up links to whatev will make this project concept a reality :). Cheers :).

see here

http://www.cl.cam.ac.uk/~mwd24/phd/swarm.html

http://gcc.gnu.org/onlinedocs/gcc/ARM-Options.html

http://www.codeproject.com/KB/threads/StackWalker.aspx?msg=2818356

can you recommend any compiler, emulator, os, setup, even equipment (JTAG etc etc) i should use, buy, try?

3)which files u exactly wanna build for ARM? is it "ntoskrnl.exe bootvid.dll hal.dll"?

depends on method: i agree (see below) that probably android or (htc-)linux is probably more likely to work but leo70_rom made me think maybe jump from (touch wp7) nk.exe? and are you saying use linux as in LinuxBios type setup?

would need emulated bios, pci bus fixed up (?), QSD timer HAL, ACPI (?), etc ,,, so probably would end up with the following:

a) BIOS (ce7 exe or linux ?): options here could be to make NT think it is running on PALcode, uEFI, or standard ACPI BIOS (your thoughts?). I think uEFI (tianocore/Intel) is best bet here perhaps. this would include MBR code (efi equiv or pal equiv depending) and any psuedo-real or "real" initialization i think.

b) mbr execution merged to and included in above, bootsect. in sim' 'firmware'.

c) $LDR$ @ OSLOADER.EXE (osloader.exe is non-x86 ntldr as im sure you know WITHOUT the code to run ntdetect.com and acts in PALcode architecture to pass on predefined data structues from firmware: tells NTOSKRNL.EXE where and what 2 execute).

d) HAL.DLL (timer, power/acpi, spinlocks, interrupts). another reason i leant towards WP7 as pre-NT launcher is because i assumed that something like BSP, OAL, etc, could be maybe used as base: if not for code, then logical base. what base(s) did you use to create WP7 if i may ask? ie: CE7? I have just installed Platform-Builder. but yeah, i here you regarding android/linux kernel example: ultimately are you saying better, easier, more logical, to go with android/linux you think Cotulla?

e) BOOTVID.DLL

f) KDCOM.DLL (if wp7 would make use of KITL?)

g) drivers as required including the following: ntbootdd.sys (?) might allow easier diversion from bios lack of INT13 and other support: remap to whatever can handle this properly. equivalents for ACPI.sys, filesystem drivers, other power, basics. how should i be looking at things from NT side of things, as in \ObjectTypes like \??, \Global?? etc .... and items like ROOT device in ARM (either CE or linux preloaded) context? any thoughts on how object manager would need to be brought up? for me, now, that is where it gets crucial and is core.

h)SMSS.EXE (NATIVE.EXE) but to begin with could just get drivers and all that working first and strap up into cmdcons (SPCMDCON.SYS). just blue-screen SMSS (windows setup) enough to prove kernel to run on ARM cpu. your thoughts?

i) SYSTEM reg key hive (setupreg.hiv etc?)

...

4)which final results u gotta got?

Tinykrnl type native CLI.

http://www.betaarchive.co.uk/imageupload/1193217573.or.99024.jpg

with USB keyboard support like htc-linux then go from there..... would love a prompt from which could just call any given call - be it CreateProcess or NtCreateProcess or ANYTHING: and it just does it (with debug/KITL) without question ;). but native NT command line is good for now. not going near win32.

5)why u need touch WP7? u can just look to example code in Android kernel and implement something. so replace PC standard timer realization inside HAL.dll with QSD8250 specific timer code. it's much better to start.

yeah....

I thought linux probably would end up being better: just liked symmetry of windowsCEx-strapping-windowsNTx: making a windowsCE-EFI/BIOS: but yeah, something like LinuxBios (android kernel etc) would be a lot easier in the end yeah? All this is overly simplified and very conceptual but there are basic answers. :). once a solid idea has been formed then this could actually be done i think. and before Microsoft ;). Do you believe Reactos-ARM-build environment could be used? Am i missing anything? 9 people team+myself (+any help you can offer) would make 10 (+1). I think this is a good idea to at least try and i believe with your assistance, guidance, well, it would get done and then complete the HD2 line up fully. :D. In conclusion, right now, I need ARM emulator software, platform builder, and fully working Compact Edition 7 on HD2 to get some more thoughts and try few things out in platform builder debug then can get final decision, design, plan and start to get everything working. Even though will probably go with Linux/Android obviously as above, I still need 2see init on CE7 on HD2 and be able 2use this along with whatever else we can! have a look at all above links... thanks.

Cotulla, thanks again 4reply>please PM me@have something but not posting..... await your PM.

what about this ( http://research.microsoft.com/en-us/projects/singularity/ ) could be of use to NT port with respect to CLR ? haha, or just outright hd2 port Microsoft RDK OS ' singularity ' ? ;):p:).

************************************************************

update: Attached is ARM low level bootloader just built; this could be used to load LDR and then ntoskrnl.exe :D.

************************************************************

Please let me know your thoughts and please try to get this to run with debug if you can and pass results & thoughts back to me - Cheers. Hopefully it built ok. What do you think of using this method then? but with FULL & PROPER NTOSKRNL.EXE!

************************************************************