[XAP][SOURCE] Native Toast Notification Launcher

[cpuguy]

This is a very simple application that enables you to specify any kind of Uri to launch. This is done through creating a Toast notification that, when clicked on, will execute the specified Uri. This uses a native method outside of the regular SDK; the standard methods available in the SDK that you'd normally use to create a Toast notification are restrictive in what kind of Uri you can specify. By using the native method not part of the SDK, these limitations can be by-passed.

I've attached both the XAP and the source code. The source project contains three projects:

1. CShellChromeAPI: The C++/CLI project which calls the native un-documented method
2. NativeToastLauncher: The .NET wrapper which simplifies the interaction with the C++/CLI project
3. NativeToastLauncherApp: The test application used to quickly launch any Uri

You'll notice I've hard-coded a default Uri when you launch the application: this will open the Windows Phone 8 "About" page.

To run this, you'll need to side load the XAP which requires a dev unlocked device...

 

[djtonka]

Can I use any system GUID to launch?

 

[cpuguy]

Can I use any sytem GUID to launch?

Any registered app GUID yes. You'd do app://GUID/_default (or replace the _default with the particular task to run - in most cases, that's _default).

 

[snickler]

@cpuguy this is awesome, thanks!

 

[compu829]

If you guys are looking for GUIDS and default tasks, they are all in the app's WMAppMAnifest.xml. the "ProductID" is the GUID and the "DefaultTask Name" property contains the name of the default task.

 

[aclegg2011]

Hopefully we can use this to find a program to exploit.

Sent from my Nokia 521 using XDA Windows Phone 7 App

 

[iPwnza]

Does anyone happen to have a list of the ID's for the system and settings apps? Obviously, I can't go into the code and get these without messing with the file system. If no one has them, then I can just trial/error until I get some...

 

[compu829]

If you download the registry hives located at http://forum.xda-developers.com/showthread.php?t=2393883 , you can load the Software hvie and search for "app://" That will give you a few system files you can launch.

EDIT:

I posted a zip file of the default ones in a new thread.

IF anyone has tethering blocked, see if you can get it to work by launching this URI app://5B04B775-356B-4AA0-AAF8-6491FFEA5629/Default

 

[aclegg2011]

If you download the registry hives located at http://forum.xda-developers.com/showthread.php?t=2393883 , you can load the Software hvie and search for "app://" THat will give you a few system files you can launch.

Im only seeing the app:// function used on the system settings options after going through the regsistries so far.

 

[compu829]

Im only seeing the app:// function used on the system settings options after going through the regsistries so far.

that's what I saw too. I am having way more luck finding cool stuff in the extracted ffu. Take a look at the zip file in the new thread I started.

 

[aclegg2011]

that's what I saw too. I am having way more luck finding cool stuff in the extracted ffu. Take a look at the zip file in the new thread I started.

yea, I saw the new thread. Hopefully somebody can find a exploit in all that. It executes some cool files. Too bad there wasn't a cmd.exe file on our phones that we can execute.

 

[compu829]

yea, I saw the new thread. Hopefully somebody can find a exploit in all that. It executes some cool files. Too bad there wasn't a cmd.exe file on our phones that we can execute.

actually..there is! but it's stuck in a WIM. It inflates it on an "as-needed" basis.

I am hoping that we can use the backgroundworker to run some stuff elevated

 

[ultrashot]

I am hoping that we can use the backgroundworker to run some stuff elevated

But they all are pretty much isolated. It is unlikely that you will be able to run anything elevated

 

[iPwnza]

yea, I saw the new thread. Hopefully somebody can find a exploit in all that. It executes some cool files. Too bad there wasn't a cmd.exe file on our phones that we can execute.

Not only is there a CMD.exe, but there are other interesting things like a BSOD screen, Control Panel, registry keys referencing desktop (A future exploit I might attempt), and even native EXEs (We knew about native EXEs since WPs release).

 

[-W_O_L_F-]

Why does this launcher not work with "normal" toasts: {YOUR-APP-GUID} and "/Page1.xaml"? Only with empty GUID and full path.

 

[GoodDayToDie]

Similarly, any chance this could be used to open arbitrary XAML pages, rather than just the ones defined in the app manifest? For example, something like what was posted in another thread (http://forum.xda-developers.com/showpost.php?p=45265419&postcount=56) using the following URI: app://5edbdbbc-2ab2-df11-8a2f-00237de2db9e/_default#/View/APNSettingPage.xaml to launch a hidden page in the Connection Setup app. I don't know if that's a weird behavior of CS or if its universally possible (and while it feels lazy to ask, I'm at work right now). There are a bunch of "hidden" pages in the ATIV S Diagnosis app, some of which would be very useful, but the navigation code for them is blocked or outright missing. If we could invoke those directly... There are probably a bunch of other such hidden gems in other OEM apps too.

 

[compu829]

Yes you can. The way I found the one in the HTC app was by loading the dlls in JetBrain's dotPeek. Then I looked for the xaml files. It is all a relative URI based on what dotPeek/the app "sees". The only thing the manifest states is where the default entry point is for the page. Basically I looked in the manifest file for how it calls the "default" page. and then replace it with the relative URI for the other page you want.

If you guys want, I can write up a simple tutorial. I just have an HTC 8x, so my hands are tied. If someone can figure out how to deflate an nbh file so I can browse it, that'd be fantastic! I found a "dead" 521 on eBay that I am thinking of picking up for research since there are way more tools for Nokia.

 

[cpuguy]

Yes you can. The way I found the one in the HTC app was by loading the dlls in JetBrain's dotPeek. Then I looked for the xaml files. It is all a relative URI based on what dotPeek/the app "sees". The only thing the manifest states is where the default entry point is for the page. Basically I looked in the manifest file for how it calls the "default" page. and then replace it with the relative URI for the other page you want.

If you guys want, I can write up a simple tutorial. I just have an HTC 8x, so my hands are tied. If someone can figure out how to deflate an nbh file so I can browse it, that'd be fantastic! I found a "dead" 521 on eBay that I am thinking of picking up for research since there are way more tools for Nokia.

That's correct. I have been navigating to various - normally unreachable - XAML pages in quite a few of the Nokia apps. I gave an example of that in a different thread:

app://[COLOR="Navy"][B]2377fe1b-c10f-47da-92f3-fc517345a3c0[/B][/COLOR]/[COLOR="Orange"][B]_default[/B][/COLOR]#/[COLOR="Green"][B]Launcher[/B][/COLOR];component/[COLOR="DarkRed"][B]MainPage.xaml[/B][/COLOR]

In this example, I launch the Nokia extras+info app (2377fe1b-c10f-47da-92f3-fc517345a3c0) with the default entry point (_default) which, as @compu829 stated, can found in the app's manifest. Following that, you can add "#/" (not sure if either the hash-tag or slash can be taken out or both are required to work but I know with both, it does work) to the URI to specify a particular XAML file you'd like to open. Following the "#/", you get to specify the assembly (i.e. the .DLL in the XAP file) in which the XAML file is located (Launcher). And finally, you add ";component/" followed by the full path to the XAML as defined in the embedded resource file (MainPage.xaml).

 

[cpuguy]

Why does this launcher not work with "normal" toasts: {YOUR-APP-GUID} and "/Page1.xaml"? Only with empty GUID and full path.

I presume your reference to the "empty GUID" is for the first parameter of my static Launcher.LaunchToast method? That first parameter is, as far as I can see, ignored for the actual toast launch. If I'd have the signature of the "Shell_PostMessageToast" method, I could perhaps understand what it does but, without it, I just knew it wanted a GUID (passed to it as a string) and that that GUID could be an empty one. I reversed engineered the signature from that native method (found in ShellChromeAPI.dll) by taking a look at another native assembly calling it. Naturally, this only tells shows me how that method is being called but doesn't return the name of the parameters. If I remember correctly, the assembly calling that method was passing its own application GUID... I could have done the same but, I didn't see what use it had so I decided to keep passing it an empty GUID.

The format of the toast is different most likely because that's the raw toast launching method. The other format you're used to is the more developer friendly one that's sanitized prior to launching it (so you can't launch another app directly).

 

[-W_O_L_F-]

Success!

@GoodDayToDie , this is exactly what I'm trying to do! And here is result: