Running Homebrew Native Executables - Status: DONE!!

Search This thread
By:
Advanced…
G

GoodDayToDie

Inactive Recognized Developer
Jan 20, 2011
6,066
2,933
Seattle
Creating a live tile should be totally possible; we already know the API for that. Doing it in a way that won't wreck the battery life will take careful work, but is surely possible.

What I'm excited about here is a persistent background service that isn't subject to the app model restrictions. This can be used for things like automatically muting the phone in meetings (with exact timing, not the loose timing that the current background APIs give). It can also be used for things like making openVPN (a current project of mine) work on stock ROMs, which would otherwise be very difficult (technically possible if I can get the driver to load on a stock ROM, but a mess of hacks even then).
 
L

luka69

Member
Jul 4, 2009
30
1
Heathcliff74 said:
Today I will change the topic title from "Status: Not possible >YET<" to "Status: Possible!".

On Custom ROMs with Full Unlock it was already possible to run homebrew executables. For stock ROMs with Interop Unlock there is WP7 Root Tools which allows Policy Unlock for Silverlight applications. But running homebrew executables like Opera Mini was still not possible.

But now I've found a way to unlock homebrew executables using policies and certificates. I need to do more research before I can implement this unlock in WP7 Root Tools, because the unlock currently still needs some manual actions. But I know it's possible now, because I have it working.

I will keep you updated on the progress for implementing this in WP7 Root Tools.

I have to thank Cotulla for helping me find a stupid mistake I made! His incredible knowledge helped me see why I thought it was not working yet :D

Ciao,
Heathcliff74
Click to expand...
Click to collapse

Hi, thanks for your wonderfull job!!
Have any news about it? I would like to use opera with my unlocked optimus7.
 
Heathcliff74

Heathcliff74

Inactive Recognized Developer
Dec 1, 2010
1,646
2,610
luka69 said:
Hi, thanks for your wonderfull job!!
Have any news about it? I would like to use opera with my unlocked optimus7.
Click to expand...
Click to collapse

There's no way to predict an ETA. Depends on how much time I can spend on it. Currently working on a managed abstraction layer for the policy engine, so I can integrate my new unlocks in WP7Root Tools. Making a little progress everyday. Just bear with me.

Ciao,
Heathcliff74
 
  • Like
Reactions: farafr, davide136 and pdaimatejam
snickler

snickler

Retired Forum Mod / Inactive Recognized Developer
Aug 17, 2010
1,320
1,133
Dub V
www.sinclairinat0r.com
Heathcliff74 said:
There's no way to predict an ETA. Depends on how much time I can spend on it. Currently working on a managed abstraction layer for the policy engine, so I can integrate my new unlocks in WP7Root Tools. Making a little progress everyday. Just bear with me.



Ciao,

Heathcliff74
Click to expand...
Click to collapse


thanks for taking the time to work on this =)

Sent from my SGH-i917 using XDA Windows Phone 7 App
 
N

Nixeus

Senior Member
Sep 14, 2007
1,724
43
If I understand, with this project, we could execute homebrew without using the Interop Hack, is'nt it ?
 
G

GoodDayToDie

Inactive Recognized Developer
Jan 20, 2011
6,066
2,933
Seattle
@Nixeus: Not really. This will require making changes to the OS configuration that can only be made with high privilege access. Aside from custom ROMs with full-unlock (which can already run homebrew EXEs), the only ways to get this access on the phone currently all require interop-unlock. For example, WP7 Root Tools requires ID_CAP_INTEROPSERVICES so your phoen must be interop-unlocked to install it.
 
N

Nixeus

Senior Member
Sep 14, 2007
1,724
43
I would like to re-create or port a little C/C++ application whick i have wrote for Wm6.5.

My Application used the RAS function in order to manage the DATA connection.

Can i do it ?
If yes, with com-interop ? or, is there today a easiest way ?

Is there a guide ?

Thanks a lot ,

Nixeus
 
U

ultrashot

Inactive Recognized Developer
May 26, 2009
1,478
2,046
St.Petersburg
Nixeus said:
I would like to re-create or port a little C/C++ application whick i have wrote for Wm6.5.

My Application used the RAS function in order to manage the DATA connection.

Can i do it ?
If yes, with com-interop ? or, is there today a easiest way ?

Is there a guide ?

Thanks a lot ,

Nixeus
Click to expand...
Click to collapse
The best (in general) way today is to write a silverlight app with native COM libraries inside. Follow this guide: http://xdaforums.com/showthread.php?t=1299134
 
  • Like
Reactions: vova1609
You must log in or register to reply here.

Similar threads

Heathcliff74
[GUIDE] INTEROP-UNLOCK - NEW unlocks for ALL SAMSUNG WP7 devices!!
Replies
2K
Views
686K
X
x.shayan.x
Cotulla
[DFT][Updated!#3] HSPL / RSPL for HTC WP7 First Generation
Replies
1K
Views
785K
spideyngo
spideyngo
Heathcliff74
[CAB] Official WP7 Updates List up to WP 7.8 + ALL LANGUAGES complete + OEM updates
Replies
2K
Views
1M
M
mike_san
W
WP7 Hacking for Beginners - Chevron, Theming, Ringtones, Registry, MMS/Data
Replies
194
Views
244K
F
frahman
Heathcliff74
  • Locked
[XAP] WP7 Root Tools 0.8 for MANGO
Replies
338
Views
265K
D
dazza9075

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 25
    Heathcliff74
    Heathcliff74
    Breakthrough!

    Today I will change the topic title from "Status: Not possible >YET<" to "Status: Possible!".

    On Custom ROMs with Full Unlock it was already possible to run homebrew executables. For stock ROMs with Interop Unlock there is WP7 Root Tools which allows Policy Unlock for Silverlight applications. But running homebrew executables like Opera Mini was still not possible.

    But now I've found a way to unlock homebrew executables using policies and certificates. I need to do more research before I can implement this unlock in WP7 Root Tools, because the unlock currently still needs some manual actions. But I know it's possible now, because I have it working.

    I will keep you updated on the progress for implementing this in WP7 Root Tools.

    I have to thank Cotulla for helping me find a stupid mistake I made! His incredible knowledge helped me see why I thought it was not working yet :D

    Ciao,
    Heathcliff74
    View
    10
    Heathcliff74
    Heathcliff74
    [2012/06/03] IMPORTANT UPDATE HERE

    Hi hackers,

    This is meant as a little update on one of the projects I've been working on. I'm kinda stuck now. I have a suspicion of what the problem is. I thought that maybe if I write a post about it, me or someone else will have an idea on how to get this working.

    The goal is to run native homebrew executables on WP7

    This has not been done yet. All apps are Silverlight apps that are compiled as DLL and run by Taskhost.exe with least privileges. All other executables are signed by Microsoft. Executables that are compiled as ARM executable cannot be started.

    The angle is to create a certificate that allows to sign a WP7 executable. Then add that to the appropriate certificate store. Create an executable. Sign it with the private key. Load it onto a WP7 device. Copy it to the Windows folder. Use an OEM driver to launch the executable.

    First I did research on the certificate stores. I can now with certainty state that there are 4 certificate stores:
    - CA
    - Root
    - My
    - Code Integrity

    After a lot of research I finally got complete read/write access to all of these stores. The Code Integrity store contains all the certificates that are used by the Loader Verifier to verify the executable that is being launched. When the device is launched for the first time, the certificates that are in \Windows\ciroots.p7b are installed to that certificate store. These certificates have these properties:

    Key Usage = 0x86 = Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing
    Entended Key Usage = Code Signing (1.3.6.1.5.5.7.3.3) + Unknown key usage (1.3.6.1.4.1.311.10.3.14)

    So I used OpenSSL to create such an certificate (with private key) for myself. And I installed the certificate in the Code Integrity store.

    I then used VS2008 to create a completely barebone executable (ARMv4 Console app with only Sleep(-1) in the Main). I signed it with SignTool from Microsoft.

    I loaded the executable to my device and I copied it to the \Windows folder (I think the policies restrict executing to only from that folder, but I'm not sure about that).

    I use the Samsung driver to launch the executable, because I need at least Standard Rights to launch an executable. The Samsung driver has Elevated Rights. My own app has only Least Privileges. Using the Samsung driver does not return any success or fail codes. But looking at the Running Processes list, I don't see my Test.exe running. It should be, because the main thread is put to sleep infinitely.

    So why is this not working?

    Well, I have a guess. I think it's the policies that bind the certificates in the Code Integrity store to the different accounts/chambers. In the \Windows folder there are a lot of policy xml-files. On fist boot, these are merged into PolicyCommit.xml and then compiled to policydb.vol. When the Loader Verifier (lvmod.dll) loads an executable, it queries the policies to determine access rights and chamber for that executable. The policies that matter in this context are defined in 8314B832-8D03-444f-9A2A-1EF6FADCC3B8.policy.xml. It's an xml-file that basically says this:

    Code: 
    Microsoft Mobile Device Privileged PCA       - ced778d7bb4cb41d26c40328cc9c0397926b4eea - not used in this context
Microsoft Mobile Device TCB PCA              - 88bcaec267ef8b366c6e6215ac4028e7a1be2deb - honored by System Identity Group
Microsoft Mobile Device Unprivileged PCA     - 1c8229f5c8d6e256bdcb427cc5521ec2f8ff011a - honored by Standard Right Identity Group
Microsoft Mobile Device VSD PCA              - 91b318116f8897d2860733fdf757b93345373574 - not used in this context
VeriSign Mobile Root Authority for Microsoft - 069dbcca9590d1b5ed7c73de65795348e58d4ae3 - honored by LPC Identity Group

    I should find a way to add a policy with my certificate in it. Any ideas? :eek:

    Ciao,
    Heathcliff74
    View
    6
    Cotulla
    Cotulla
    Great!

    I have to thank Cotulla for helping me find a stupid mistake I made! His incredible knowledge helped me see why I thought it was not working yet
    Click to expand...
    Click to collapse
    I won't tell to anyone :D
    View
    4
    fiinix
    fiinix
    **** so CLOSE!

    Successful copied "main.exe" and "ExeX.exe" to "\Windows", where i have the right to launch them remotely.

    Method:


    WP7Process p = device.LaunchEXE(@"main.exe", "");

    main.exe (no signing, ARMv7):
    System.UnauthorizedAccessException: Access is denied.


    WP7Process p = device.LaunchEXE(@"ExeX.exe", "");

    ExeX.exe (signed with CA/ROOT custom, ARMv4):
    System.Runtime.InteropServices.COMException (0x800704EC): This program is blocked by group policy. For more information, contact your system administrator.

    There IS different things going on! Something is missing, but what :p

    edit:

    Signed main.exe with custom XDA ROOT certificate (ARMv7):
    signtool.exe sign /sha1 "[CertChomp]" "main.exe"
    > Now main.exe also gets "This program is blocked by group policy. For more information, contact your system administrator."
    Ill see if i can add it to startup list , if it boot from there.

    edit 2:
    Nope gonna hijack "fieldtestapp.exe" with my app because policy says:

    Risky-mode.Activate();

    Backup(fieldtestapp.exe, backupPath);
    Copy(main.exe, > fieldtestapp.exe);


    "LOADERVERIFIER_ROUTE_BY_NAME"
    "LOADERVERIFIER_EXE_AUTHZ_INROM_ROOT"

    <Rule Description="Route fieldtestapp.exe" ResourceIri="$(LOADERVERIFIER_ROUTE_BY_NAME)/PRIMARY/WINDOWS/FIELDTESTAPP.EXE" SpeakerAccountId="$(SYSTEM_USER_NAME)" PriorityCategoryId="PRIORITY_LOW">
    <Authorize>
    <Match AccountId="$(FIELDTESTAPP_EXE_SID)" AuthorizationIds="LV_ACCESS_EXECUTE" />
    </Authorize>
    </Rule>

    <Rule Description="Authorize fieldtestapp.exe be loadable to $(FIELDTESTAPP_EXE_SID) and chambers" ResourceIri="$(LOADERVERIFIER_EXE_AUTHZ_INROM_ROOT)/WINDOWS/FIELDTESTAPP.EXE" SpeakerAccountId="$(SYSTEM_USER_NAME)" PriorityCategoryId="PRIORITY_STANDARD">
    <Authorize>
    <Match AccountId="$(FIELDTESTAPP_EXE_SID)" AuthorizationIds="LV_ACCESS_EXECUTE,LV_ACCESS_LOAD" />
    </Authorize>
    </Rule>


    edit 3:
    Seems like "fieldtestapp.exe" is ROM locked. Need to try out some other targets.

    edit 4:
    Target acquired "ProximitySensorDisable.exe" > "ProximitySensorDisableBackup.exe"
    Successful copy == no ROM lock.

    edit 5:
    There exists two types of talking to the LoadVerifier (the: This program is blocked by group policy.):

    Direct exe name OR special certificate
    How we do:
    > Direct exe (hijack exe)

    How we cant do (SHA1) (Nope, ain't gonna happen):
    > We certainly dont have Microsofts certificate so this way is a nodo, haha lol, no do way.

    (1: direct exe name) /LOADERVERIFIER/GLOBAL/AUTHORIZATION/PE_AUTHZ/NONE/NONE/PRIMARY/WINDOWS/CFGHOST.EXE
    (2: static/pre certificates) /LOADERVERIFIER/GLOBAL/CERTIFICATES/HASH/SHA1/91B318116F8897D2860733FDF757B93345373574

    edit 6:
    Yep, loads of edits, just for you.

    Allowed exe's to run (sorted a-z) (direct exe) (pre cert removed):
    Code: 
    ACCESSIBILITYCPL.EXE
ACCOUNTSMANAGER.EXE
ALARMS.EXE
APPCHECKERSHIM.EXE
APPPREINSTALLER.EXE
AUTODATACONFIG.EXE
AUTOSIM.EXE
AUTOTIMEUPDATE.EXE
BRIGHTNESSCPL.EXE
BTUXCPL.EXE
CALENDARAPP.EXE
CALLSETTINGSHOST.EXE
CALNOT.EXE
CALUPD.EXE
CAM_FW_UPDATE_UI.EXE
CELLUXCPL.EXE
CERTINSTALLER.EXE
CFGHOST.EXE
CFLAUNCHER.EXE
CHDIALERHOST.EXE
CIPHASE2.EXE
CLIENTSHUTDOWN3.EXE
CLOCKNOT.EXE
CMACCEPT3.EXE
COLDINIT.EXE
COMMSVC.EXE
COMPOSITOR.EXE
CONFIGDM.EXE
CONFIGXML.EXE
CONMANCLIENT3.EXE
CONTACTS.EXE
CPROG.EXE
DATETIMECPL.EXE
DCVSSWITCH.EXE
DEPOTCOPY.EXE
DEVICEFEEDBACKCPL.EXE
DEVICEREG.EXE
DIAGPORTCHANGETEST.EXE
DLLHOST.EXE
DMSCHEDULERCALLBACK.EXE
DMSRV.EXE
DMSTOOLS.EXE
DUACLIENT.EXE
DW.EXE
EDM3.EXE
EMAIL.EXE
EMAILSETUP.EXE
ENDPOINT.EXE
FCROUTERCMDTEST.EXE
FIELDTESTAPP.EXE
FLIGHTMODE.EXE
GAMESUX.EXE
IEXPLORE.EXE
INITIATEDMSESSION.EXE
INVALIDLICENSEUXLAUNCHER.EXE
KEYBOARDCPL.EXE
LASSCREDENTIALEXPIRATIONCHECK.EXE
LASSRESTARTER.EXE
LIVETOKEN.EXE
LOCKCPL.EXE
LOOPBACKTEST.EXE
MEDIAGROVEL.EXE
MEUX.EXE
MITSMAN.EXE
MMSPRPROXY.EXE
MMSTRANSHOST.EXE
MULTIMEDIALAUNCHER.EXE
MYPHONECPL.EXE
MYPHONETASKSRUNTIME.EXE
NATIVEINSTALLERHOST.EXE
OFFICEURL.EXE
OMADMCLIENT.EXE
OMADMPRC.EXE
OMHUB.EXE
ONBOOTSQM.EXE
ONENOTEMOBILE.EXE
OOBE.EXE
PACMANINSTALLER.EXE
PHOTOENT.EXE
PHOTOENTCAPTURE.EXE
PHOTOUPLOADER.EXE
PPT.EXE
PWORD.EXE
PWRLOGCTRL.EXE
PXL.EXE
RAPICONFIG.EXE
REGIONCPL.EXE
RMACTIVATE.EXE
SAPISVR.EXE
SECSIMTKIT.EXE
SERVICESD.EXE
SERVICESSTART.EXE
SETTELEPORTMODE.EXE
SETTINGS3.EXE
SHORTMSG.EXE
SICLNT.EXE
SIGNALEVENT.EXE
SIREPSERVERAPPDEV.EXE
SMSETTINGS.EXE
SMSTRANSPORT.EXE
SOUNDCPL.EXE
SPEECHCPL.EXE
SPMC.EXE
SQMEVENT.EXE
SSUPDATE.EXE
TASKHOST.EXE
TELSHELL.EXE
TESTSHOW.EXE
THEMECPL.EXE
TOGGLEBROWSERHIBERNATION.EXE
TOGGLEDOG.EXE
UDEVICE.EXE
UIF.EXE
UNIFIEDPAIR.EXE
USBMGR.EXE
WEBSEARCH.EXE
WIFIUXSPLASH.EXE
WLANEXT.EXE
WLIDSETUP.EXE
WWANDATAMGR.EXE
XDRMREMOTESERV.EXE
ZIPVIEW.EXE
ZMFTASKLAUNCH.EXE

    How code (yes i know its super un-optimized, fast put together):
    Code: 
    var doc = XDocument.Load(File.OpenRead("SamsungOmnia7_BasePolicy_webserver.xml"));
var ea = doc.Elements().ToArray()[0].Elements()
    .Where(x => x.Name.LocalName == "Rule")
    .Where(x => x.Attributes("ResourceIri").Count() > 0)
    .Where(x =>
    {
        var r = x.Attribute("ResourceIri").Value;
        return r.Contains("LOADERVERIFIER") && r.ToLower().Contains(".exe") && !r.Contains("CERTIFICATES");
    })
    .Select(x =>
    {
        var v = x.Attribute("ResourceIri").Value;

        var l = v.LastIndexOf('/');

        return v.Substring(l + 1);
    })
    .Distinct()
    .OrderBy(x => x)
    .ToArray();

    edit 7:
    yeah, lol i say too.
    Unprotected exe (FCRouterCmdTest.exe)
    > c:\Project Work\SGH-i707(Cetus)\FCRouterCmdTest\Windows Mobile 6 Professional SDK (ARMV4I)\Release\FCRouterCmdTest.pdb
    mfw samsung use "Windows Mobile 6 Professional SDK (ARMV4I)"
    View
    3
    Heathcliff74
    Heathcliff74
    FINALLY!!

    STATUS: DONE! :D

    www.wp7roottools.com

    Ciao,
    Heathcliff74
    View

New posts