[Q] Mod Windows RT to enable Remote Desktop

[TFGBD]

I just came across this program called "RDP Wrapper Library"
http://stascorp.com/load/1-1-0-63
It patches the RDP API in ram so the system files aren't modified at all. In this sense it is similar to commercial solutions like Thinstuff XP/VS. It seems to be based on the ProductPolicy method that was mentioned earlier in this thread. It's also open source so maybe it can be compiled for ARM and run on jailbroken devices!

 

[x86corez]

I just came across this program called "RDP Wrapper Library"

It's also open source so maybe it can be compiled for ARM and run on jailbroken devices!

First of all, it's just not enough to port RDP Wrapper to ARM platform. As you can see in the source code, for Win 8 (as for Win RT) it's required to add internal function signature, which will be then intercepted.

I never had any dealings with ARM-based PE binaries, but I think it's very interesting. I will research it.

By the way, I'm the creator of RDP Wrapper Library project

 

[x86corez]

Here is offsets for termsrv.dll [ARMv7, 6.2.9200.16384] from first post:

termsrv.dll+5F934 ; long __cdecl SLGetWindowsInformationDWORDWrapper(unsigned short const *, unsigned long *)
termsrv.dll+61D64 ; public: static long __cdecl CSLQuery::Initialize(void)

termsrv.dll+733FC ; private: static int CSLQuery::bFUSEnabled
termsrv.dll+73400 ; private: static long CSLQuery::lMaxUserSessions
termsrv.dll+73404 ; private: static int CSLQuery::bAppServerAllowed
termsrv.dll+73408 ; private: static int CSLQuery::bInitialized
termsrv.dll+7340C ; private: static int CSLQuery::bMultimonAllowed
termsrv.dll+73410 ; private: static int CSLQuery::bServerSku
termsrv.dll+73414 ; private: static unsigned long CSLQuery::ulMaxDebugSessions
termsrv.dll+73418 ; private: static int CSLQuery::bRemoteConnAllowed

Function SLGetWindowsInformationDWORDWrapper can be hooked for rewriting policy values in realtime.
Function CSLQuery::Initialize also can be hooked to write policy values directly into memory.

And the values offsets, here is default for RDP server:

// Fast User Switching is enabled
*bFUSEnabled = 1;
// Unlimit user sessions
*lMaxUserSessions = 0;
// Allow application server
*bAppServerAllowed = 1;
// Initialize function is succeeded
*bInitialized = 1
// Multi monitor is allowed
*bMultimonAllowed = 1;
// Windows has Server edition (needs for RDP and other functions)
*bServerSku = 1;
// Unlimit debug sessions (I really don't know what is this)
*ulMaxDebugSessions = 0;
// Allow remote connections (to enable RDP listener session)
*bRemoteConnAllowed = 1;

But I don't know how to compile RDP Wrapper for ARM platform.

By the way, can anybody share termsrv.dll version 6.3.9600.16384 and 6.3.9600.17095 from RT 8.1 ?

 

[x86corez]

I'm glad to present new release of the RDP Wrapper Library which now supports Windows 8.1 Basic!

Also I've added some comments about porting it to ARM platform in the C++ source code. Maybe someone will accept challenge...

 

[x86corez]

I tried to enable one of the Remote Desktop vars last night, allowRemoteConnections I think it was called, but I didn't get anything from it.

I can guess, it's because TermService is not started and disabled by default on Windows RT (as on the Basic/Core edition).

Try to execute:

sc config TermService start= auto
sc start TermService
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Of course, you will need to change policy values before executing these commands.

 

[TFGBD]

First of all, it's just not enough to port RDP Wrapper to ARM platform. As you can see in the source code, for Win 8 (as for Win RT) it's required to add internal function signature, which will be then intercepted.

I never had any dealings with ARM-based PE binaries, but I think it's very interesting. I will research it.

By the way, I'm the creator of RDP Wrapper Library project

Sorry, I hadn't actually looked at the source code when I made the post. I just wanted to make people aware it existed. It was a real pain even finding the thing.

I'm glad you found the post here and may actually look into getting it working.

Oh, and thanks for the RDP Wrapper Library. It's a great program!

 

[kranjan]

I can guess, it's because TermService is not started and disabled by default on Windows RT (as on the Basic/Core edition).

Try to execute:

sc config TermService start= auto
sc start TermService
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Of course, you will need to change policy values before executing these commands.

Thanks for the post, I am end user trying to get this to work. I executed the command above successfully, but I don't know how to change policy values. Is this done through regedit or some other application? Sorry for the amateurish question, but I think it would be really cool to get this to work on my Surface2

 

[x86corez]

Thanks for the post, I am end user trying to get this to work. I executed the command above successfully, but I don't know how to change policy values. Is this done through regedit or some other application? Sorry for the amateurish question, but I think it would be really cool to get this to work on my Surface2

Hello!

I'm very glad to talk with an owner of a Windows RT device
About changing policy values, see this post:
http://forums.mydigitallife.info/threads/39411

I don't know will Product Policy Editor run on RT or not, so I think we can do this way:
1. Export this registry value to the .reg file
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
Value Name: ProductPolicy
2. I'll try to edit this value with PPE
3. Then I'll send you modified value in a new .reg file
4. You'll need to reboot your device in Setup Mode (not to be confused with Safe Mode), start Command prompt (cmd.exe) and import that .reg file
5. Then after reboot try to use RDP

And also, if you have Windows RT 8.1, please share termsrv.dll file from system32 directory.

Thanks for your response!

 

[x86corez]

It seems like everybody forgot about this thread...
But I'm not.

I've commited some experimental patch codes for these builds:
6.2.9200.16384 (Windows RT)
6.3.9600.16384 (Windows RT 8.1)
6.3.9600.17095 (Windows RT 8.1 with KB2959626)

You can view it here:
https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-arm-kb.ini

However RDP Wrapper C++ version still needs to be updated to support and to be compiled on ARMv7 architecture. Hope somebody will help with that.

I think, the most complex thing is to implement function hooking.

 

[ms_dont_forget_rt]

It seems like everybody forgot about this thread...
But I'm not.

I've commited some experimental patch codes for these builds:
6.2.9200.16384 (Windows RT)
6.3.9600.16384 (Windows RT 8.1)
6.3.9600.17095 (Windows RT 8.1 with KB2959626)

You can view it here:
...

However RDP Wrapper C++ version still needs to be updated to support and to be compiled on ARMv7 architecture. Hope somebody will help with that.

I think, the most complex thing is to implement function hooking.

Great!
I can compile your code with VS2013.
termservice seems not have port 3389 port open.
Some advice?

 

[TristanLeBoss]

Great!
I can compile your code with VS2013.
termservice seems not have port 3389 port open.
Some advice?

Probably blocked by Windows Firewall. To enable the Windows Firewall configuration tool: http://www.surfacetablethelp.com/2012/11/firewall-setup-on-windows-rt.html (look in the comments)