[PROJECT] HaRET on WP7

Search This thread

Robbie P

Senior Member
Feb 8, 2011
5,116
4,017
London
Thanks Martin7Pro for all the work you have done here, it is really appreciated. The best of luck for your future, may the road rise up to meet you.
If anyone needs a hd2 wp7 tester, i am a PM/post away.
My offer still stands.
My hd2 is my only phone, although my other half has a htc Mozart lying around doing nothing, sure she won't mind me fiddling with it if necessary too;)
I have lollipop 5.1 running on my 4-year old phone from all-f2fs on sdcard:)thanks to the Devs here on XDA.
I am a bit averse to the culture of obsolescence, as you might have guessed.:D
 
  • Like
Reactions: poyensa

Martin7Pro

Senior Member
Oct 23, 2011
385
363
htc7pro.howto.cz
I'm sorry, gentlemen. I'm still very busy. I submitted my codes pdaimatejam in the past. If I find the time to gather all my old WP7 source code, I save it to a public store. Licence problem may be because W.i.n.c.o and Ultrashot parts are used in them. My HTC 7 Pro was destroyed by constant attempts at improvement. I went back to the Nokia 9300 last year because all newer smartphones are useless to me. After Nokia hardware broke, I tried also Android and BlackBerry, but not touch or gestures convinced me. I probably will stick with HTC Touch Pro 2 or large screen Android with blue tooth keyboard. I do not understand why the mobile manufacturers are making fools of people, when 20-year-old Nokia 9210/9500/9300 had excellent and quick control, battery life of a week of daily use, and it was a truly usable tool.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 80
    Hi
    * Please help keeping the noise level low: Don't ask for ETA (stuff will be anounced), use Thanks buttons to say thx, etc.
    * This will work on "fully unlocked" WP7 devices only and is not limited to specific phones

    thx, dcordes

    HaRET (Handhelds Reverse Engineering Tool) has been used on smartphones and PDAs with previous WinCE (Windows Mobile) versions to

    * boot the Linux kernel (=> use Linux based OS like Android)
    * obtain information about hardware and software (=> reverse engineering) in order to accordingly modify the Linux kernel (drivers).

    Famous HTC devices that are capable of running HaRET are the QSD8250 based HTC HD2 and a wide range of MSM7xxA based phones like the diamond, raphael and touch pro 2.

    WP7 is and will be shipped on many devices with quality hardware. In order to be able to run Linux on these, a novel aim is to investigate the use of HaRET on WP7 based devices. WP7 is known to posess several mechanisms to prevent this.

    A discussion about the problem has beend started on the official HaRET development mailing list by Jaxbot:
    http://lists.linuxtogo.org/pipermail/haret-devel/2012-January/000150.html
    You need to send a subscription mail in order to write to the list. The original creators of HaRET as well as many good developers with low level skills (from XDA: Cotulla, NetRipper, cr2) are subscribed to it but maybe not many of them have access to a WP7 device.

    HaRET source code repository with history:
    http://git.linuxtogo.org/?p=groups/haret/haret.git

    Documentation of the HaRET project (publicly accessible wiki):
    http://htc-linux.org/wiki/index.php?title=HaRET
    See http://htc-linux.org/wiki/index.php?title=HaRET/Documentation#Development for how to compile.

    We should discuss the technical possibilites and challenges (if any :cool:) about this project in this thread.

    Update: Lots of insight has been gained. Since progress is rapid, uptades are not listed here yet. Please read the full thread for now.
    8
    Delay

    Sorry for delay. I have got unused phone from last HaRET using, then I made:

    1. Full internal memory cleaning.
    2. SD card changing to 32GB class 10 (I can recommend it for everybody). One screw was lying on the table after the repair and I do not know where it belongs :).
    3. Data restoring (big thanks to Ultrashot).
    4. Actualisations (unfortunately, Microsoft is lying again, the phone with 8860+8862 updates under LockScreen very quickly discharged too, all livetiles closing helps only). I hope we will have WM6, Ubuntu or RT on our WP7 devices in near future. My very old S80 devices knew how much more and lasted a week on a single charge.
    5. Finishing WP7 native FTP Client library, you are welcome for testing.

    Next weak I have very much work in a occupation, but I hope I will send to Jessenic much HaRET updates next weakend.
    8
    VS

    Now I have got HaRET incremental version working under Visual Studio 2008. It is compiled by cygwin/make, deployed to device and started under debugger, all from VS IDE. All output (Warning, Information, Error) is redirected to VS Output window. For example now (instead MessageBox):
    ...
    KMD1: 0xD9456944 $device\KMD1 Drivers\BuiltIn\KMDriver $bus\KMD1
    ListRunningDrivers(KMD1:) returns HANDLE 0xD9456944
    Load module: toolhelp.dll
    WP7RunInKernelMode(kmodedll.dll, KGetProcInfo, 0x39F248, 1, 0x39F274, 576, 0x39F180, 198)
    DeviceIoControl returns 1
    Error: 'Haret is not running in 'system' mode. Major functionality will not be present.'
    Load module: WindowTreeUpdater.dll
    ...
    WP7VirtualAlloc, WP7VirtualFree, WP7VirtualCopy is used instead VirtualAlloc, VirtualFree, VirtualCopy. But, by error message, I mean a big part of cpu.cpp module must be tranfered to kmode_dll.cpp.

    PHP:
    // Get Program Status Register value
    static inline uint32 cpuGetPSR(void) {
        uint32 val;
        asm volatile("mrs %0, cpsr" : "=r" (val));
        return val;
    }
    
    unsigned long KcpuGetPSR(unsigned char * InStructurePointer,
    		unsigned long InStructureLength, unsigned char * OutStructurePointer,
    		unsigned long OutStructureLength) {
    
    	TRACE_SAVE(L"KcpuGetPSR(0x%X, %d, 0x%X, %d)\n", InStructurePointer,
    			InStructureLength, OutStructurePointer, OutStructureLength);
    
    	if (OutStructurePointer && sizeof(uint32) == OutStructureLength) 
    	{
    		uint32 * pRes = (uint32 *) OutStructurePointer;
    
    		*pRes = cpuGetPSR();
    
    		TRACE_SAVE(L"cpuGetPSR() returns 0x%X\n", *pRes);
    
    		return ERROR_SUCCESS;
    	}
    	return ERROR_INVALID_PARAMETER;
    }

    After it:
    ...
    KMD1: 0xD9456944 $device\KMD1 Drivers\BuiltIn\KMDriver $bus\KMD1
    ListRunningDrivers(KMD1:) returns HANDLE 0xD9456944
    Load module: toolhelp.dll
    WP7RunInKernelMode(kmodedll.dll, KGetProcInfo, 0x21EF248, 1, 0x21EF274, 576, 0x21EF180, 198)
    DeviceIoControl returns 1
    WP7RunInKernelMode(kmodedll.dll, KcpuGetPSR, 0x21EF378, 1, 0x21EF374, 4, 0x21EF2AC, 198)
    DeviceIoControl returns 1
    Load module: WindowTreeUpdater.dll
    ...


    KGetProcInfo(0x21F1CE4, 1, 0x21F1F00, 576)
    pinfo filled, GetProcInfo returns ERROR_SUCCESS
    wVersion = 1
    szProcessCore = Snapdragon
    wCoreRevision = 0
    szProcessorName = QSD8250
    wProcessorRevision = 0
    szCatalogNumber =
    szVendor = QUALCOMM
    dwInstructionSet = 0
    dwClockSpeed = 998
    KcpuGetPSR(0x21F5CE4, 1, 0x21F5F00, 4)
    cpuGetPSR() returns 0x2000011F

    KMD_Open
    KMD_Open
    KMD_IoControl entry, dwCode=9
    KMD_IoControl WP7_DLL_CALL, dwCode=9
    Function kmodedll.dll::KGetProcInfo returns 0
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=6
    KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6
    Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns D97A0000
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=8
    KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8
    Function VirtualCopy(0xD97A0000,0xAC0000,65536,0x604) returns 1
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=6
    KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6
    Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns D9EE0000
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=8
    KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8
    Function VirtualCopy(0xD9EE0000,0xA90000,65536,0x604) returns 1
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=6
    KMD_IoControl IOCTL_WP7_ALLOC_ADDRESS, dwCode=6
    Function VirtualAllocEx(0x42,0x0,65536,0x2000,0x1) returns DA020000
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=8
    KMD_IoControl IOCTL_WP7_COPY_ADDRESS, dwCode=8
    Function VirtualCopy(0xDA020000,0xA91000,65536,0x604) returns 1
    KMD_IoControl returned 1
    KMD_IoControl entry, dwCode=9
    KMD_IoControl WP7_DLL_CALL, dwCode=9
    Function kmodedll.dll::KcpuGetPSR returns 0
    KMD_IoControl returned 1


    Function kmodedll.dll::KFunctionName returns 0 means SUCCESS (nonzero is Error code),
    in other attempts nonzero means OK (zero is FALSE or 0 bytes).

    Console works for me now:
    NLEDSET 0 1 // Start vibration
    NLEDSET 0 0 // Stop vibration
    But very much directives must be reimplemented to driver calling still.


    Better way, then functions redefining by one, will DEF_GETCPR and DEF_SETCPR macros adjustment to kernel driver using.

    I tried to port PocketPutty for WM to communicate on WP7 device. But, Putty.exe not goes to WinMain function. Do you know anybody, why entrypoint may not be called? It is probably by missing linked dll or function in WP7.

    I tried also to connect from Silverlight Telnet client to second device with HaRET and WiFi internet tethering running. But, message is "he remote host is actively refusing a connection" on related IP (192.168.33.1) and all ports (not only 9999). Do you know anybody, if Telnet is theoretically available by WiFi tethered connection?
    8
    Thread Cleaned

    Please only post if you have something to contribute. Also please avoid posting thank you we have a "thanks" button for that.

    Stop with the ETA posts, it just annoys the good developers. Just be grateful for the work they do!​
    8
    does this work with devices unlocked with wp7 root tools??if yes, i will be always ready to test it on my omnia w..

    Prahlad

    Yes, I have got HaRET last version running in the Kernel mode with full hardware and physical memory access too. Any unlock needed. But, my HTC7Pro needed hard reset after this version using to unbrick, then I mean it is too danger when you like your phone. Only one function was succesfully tested before HR - Vibration On/Off low-level switching. I have idea to make HaRET safe equivalent, but the way needs to finish my other related projects and I am too busy now. No C++ coder here wants my unfinished codes? Especially shell/batch interpreter with registry export/import/backup and new directives simply adding (may be used for own macro language definition too), pipes for easy interprocess comunication (unmanged/managed too), native WP7 installer with plugins system and low-level system scheduler projects are near of finishing. Any C++ student with free time can finish it all relatively quickly.