FORUMS

[xda-devs] WP Telnet Daemon & App Repurposing Utility

18 posts
Thanks Meter: 42
 
By FurballTheGreat, Junior Member on 21st December 2014, 06:49 PM
Post Reply Email Thread
Disclaimer
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

This may damage your phone use at your own risk!

Introduction
The WP Telnet Daemon is a light weight server written in C++ as a static library using the native Win32 API on Windows Phone. It allows a telnet client such as PUTTY to connect from a machine on the same LAN.
Click image for larger version

Name:	telnet-help.png
Views:	2256
Size:	38.2 KB
ID:	3075435 Click image for larger version

Name:	telnet-reghelp.png
Views:	2072
Size:	41.2 KB
ID:	3075436
It provides a shell similar to the dos prompt with basic commands such as CD, DIR, MKDIR, RMDIR, PS, KILL, MOVE, COPY and ATTRIB. A registry editor is provided which can be loaded by using the REG command. Finally a selection of other commands which have been created to test various APIs are also present for example NETSTAT.

Currently the daemon is packaged as a Silverlight application with two modes of operation:-
  1. Standalone - An executable called wptd.exe which is launched calling CreateProcess and runs in the background.
  2. In Process – The library is called directly by the Silverlight application inside a thread. The primary difference is this mode runs inside the Silverlight process.
The telnet daemon runs with the rights of the container in which it is launched therefore if the manager app is side loaded using developer unlock rights it will operate within the limits of the chamber.

The second part of this release combines WPTelnetD with the SD Card tricks that have been revealed over the past months. Using the App Repurposing Tool the daemon can be run with the rights of the target app.

WP Telnet Daemon command prompt
The command prompt is mostly similar to that offered by cmd.exe on desktop windows. The primary difference is that the WPTelnetD prompt has commands which are of use or interest when exploring a Windows Phone device.

The command which offers the most interesting possibilities right now is "reg" the registry editor. When WPTelnetD is launched from a container such as PFD a large number of registry keys are writeable. Just try typing the following from the PFD chamber .
Code:
reg writeable
The list command can be used to inspect current values as follows:-
Code:
D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>reg list hklm\software\microsoft\mtp
Subkeys
  DeviceServices
  ObjectFormats
  ObjectProperties

Values
  DataStore string 'c:\'
  MTPDPCLSID string '{4cd7b058-ee73-4885-af9f-d8adc79b80f5}'
  MtpIntermediateBufferSize dword 00046000
  MTPSDName string 'SD card'
  MTPStorageName string 'Phone'
  UsbBuffers dword 00000003
  UsbBufferSize dword 00010000
  UsbEventBuffers dword 00000040
  UsbEventBufferSize dword 00000040
  OEMICON string 'C:\Windows\System32\DevIcon_Black.ico'
  OEMAVATAR string 'C:\Windows\System32\OEMAvatar_Black.cab'
D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>
To search for a key, value name or value containing a string use the find command:-
Code:
D:\WPSystem\Apps\{E69A2877-59B8-43ED-898D-554FBC4B8B2B}\Install>reg
Registry Editor - Type HELP for assistance.
HKLM\>find Autobrightness
Searching...
Match: SOFTWARE\Microsoft
Match: SOFTWARE\Microsoft\MCSF\Settings
  SourcePath string 'HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\OEM\Brightness\HideAutoBrightness'
Match: SOFTWARE\Microsoft\MCSF\Settings\Microsoft/DisplaySettings/HideAutoBrightness
  HideAutoBrightness dword 00000001
Match: SOFTWARE\Microsoft\Shell\OEM\Brightness
Match: SOFTWARE\OEM
  UserSettingAutoBrightnessScaler dword 00000064
  UserSettingAutoBrightnessScalerMax dword 000000c8
  UserSettingAutoBrightnessScalerMin dword 0000001e
Match: SOFTWARE\OEM\Nokia\Display\ColorAndLight
Done
HKLM\>
Example Tweaks
These tweaks must be run from a chamber with ID_CAP_DEVICECONFIG. Preview for developers (PFD) is one such chamber.

Set the MTP datastore to display a lot more folders over USB
Code:
reg set "hklm\SOFTWARE\Microsoft\MTP\DataStore" string "c:\"
Set the OEM identifier used by the store
Code:
reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "NOKIA"
reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "HTC"
reg set "HKLM\system\Platform\DeviceTargetingInfo\PhoneManufacturer" string "SAMSUNG"
WP Telnet Daemon Manager App
Standalone Mode
This mode of operation calls CreateProcess to launch wptd.exe as a child process. This mode was the original one to be implemented. As daemon runs as a separate process it is not killed cleanly when the manager app exits.

The daemon will launch on port 27249 when the launch button is tapped. Once CreateProcess returns SUCCESS this will be indicated in blue text at the bottom of the screen. This is illustrated in the image below.
Click image for larger version

Name:	standalone.png
Views:	1984
Size:	89.1 KB
ID:	3075438

In Process Mode
This mode of operation hosts the telnet daemon within the Silverlight process of the manager app.

It was added due to some problems creating child processes in certain instances. However it has the advantage that the standard WP application life cycle rules are followed (e.g. it will exit when the host application exits).

The daemon will by default listen on port 23422 when the launch button is tapped. Once listening some blue text will appear indicating as such and as soon as a client connects the status will change again. This is illustrated in the image below.
Click image for larger version

Name:	inprocess.png
Views:	1706
Size:	86.5 KB
ID:	3075437

Using PUTTY to connect
Connecting to the instance of WPTelnetD launched on your phone it is recommended that one uses PUTTY. Setting up the connection is simple but it is very important that you heed the following instructions:-
  1. The connection type must be set to raw failing to set this will cause PUTTY to send control codes which are not understood by the telnet daemon.
  2. The host name must be the IP address that the phone currently has on the LAN. This address can be seen on the standalone page of the manager app.
  3. The port must be set to the port that the telnet daemon instance is listening on by default this is 27249 for standalone mode and 23422 when using in process mode.
Saving the connection into PUTTY's list of saved connections is recommended to prevent having to set these settings each time one connects.

Repurposing Existing Silverlight-based Apps (SD-Card only)
As reported previously there is a quirk in the handling of apps installed on the SD card of Windows Phone 8/8.1 devices. This allows their contents to be replaced therefore allowing the capabilities of that app to be leveraged by the replacement.

First side load the “Windows Phone Application Deployment (8.1)” or equivalent tool. It must be installed into the phones memory and not the SD Card or you will experience errors. The package you must install is:-
  • HostApp_1.0.0.X_ARM_Debug.appx – This package contains the App Repurposing Tool and the WP Telnet Daemon manager app in a single package. Therefore it is not necessary to deploy WPTelnetD.xap for the tool to function correctly.
Once the tool is deployed you may then install any of the following applications from the store onto the SD Card of the phone. It is critical that the target app is stored on the SD Card and not the phone:-
  1. Preview for Developers
  2. HTC CSDDiag
  3. Extras+Info
  4. Glance
Now launch the App Repurpose Utility on the phone and follow the instructions as illustrated in the image below. Note that the first time this utility is run you must choose the WPSystem folder on the SD Card, on subsequent uses the app will remember the location so you will not be prompted again.
Click image for larger version

Name:	sequence.jpg
Views:	2014
Size:	190.1 KB
ID:	3075439
Assuming the process has completed without errors you may now launch the target the application that has been replaced from its normal location. Note that the title on the menu item may change to the install path of the app and the icon WILL change.


Downloads & Source
WPTelnetD Manager binary package
The telnet daemon XAP package can be downloaded from the address below. This is primarily for those who wish to side load or lack the SD Card required to use the App Repurposing Tool.
https://github.com/FurballTheGreat/W.../WPTelnetD.xap

App Repurposing Tool binary package
This tool can be downloaded from the address below. An SD Card is necessary for this app to function usefully.
https://github.com/FurballTheGreat/W...ARM_Debug.appx

Source
A zip of the full source code can be downloaded from the following address:-
https://github.com/FurballTheGreat/W...rchive/1.3.zip

Finally the source can also be retrieved using git & subversion by following the instructions on the projects git home page:-
https://github.com/FurballTheGreat/WPTelnetD
The Following 23 Users Say Thank You to FurballTheGreat For This Useful Post: [ View ] Gift FurballTheGreat Ad-Free
21st December 2014, 06:51 PM |#2  
ceesheim's Avatar
Retired Forum Moderator
Flag No Android Fanboys Please !!!
Thanks Meter: 2,293
 
Donate to Me
More
Thanks for releasing it , works super.

[/PS: For the ones who don't read, its a regeditor ( and yes not only that )
The Following 3 Users Say Thank You to ceesheim For This Useful Post: [ View ] Gift ceesheim Ad-Free
21st December 2014, 07:00 PM |#3  
snickler's Avatar
Retired Forum Moderator / Inactive Recognized Developer
Flag Dub V
Thanks Meter: 1,191
 
Donate to Me
More
Thanks, oh great Furball
The Following 3 Users Say Thank You to snickler For This Useful Post: [ View ] Gift snickler Ad-Free
21st December 2014, 07:04 PM |#4  
Senior Member
Thanks Meter: 304
 
More
Thanks for the excellent release!
The Following 2 Users Say Thank You to compu829 For This Useful Post: [ View ] Gift compu829 Ad-Free
21st December 2014, 07:10 PM |#5  
HD2Owner's Avatar
Inactive Recognized Developer
Flag Neuhausen am Rheinfall
Thanks Meter: 2,478
 
More
well done buddy. thanks for it.
The Following User Says Thank You to HD2Owner For This Useful Post: [ View ] Gift HD2Owner Ad-Free
21st December 2014, 07:22 PM |#6  
Member
Flag Ekaterinburg
Thanks Meter: 9
 
More
Can Interop unlock be achieved with that?
The Following User Says Thank You to winphoneuser For This Useful Post: [ View ] Gift winphoneuser Ad-Free
21st December 2014, 07:32 PM |#7  
ceesheim's Avatar
Retired Forum Moderator
Flag No Android Fanboys Please !!!
Thanks Meter: 2,293
 
Donate to Me
More
Quote:
Originally Posted by winphoneuser

Can Interop unlock be achieved with that?

no not possible ,this is just the beginning
The Following User Says Thank You to ceesheim For This Useful Post: [ View ] Gift ceesheim Ad-Free
23rd December 2014, 12:31 PM |#10  
FurballTheGreat's Avatar
OP Junior Member
Thanks Meter: 42
 
More
Released 1.1
A new release has been published which merges the 'dword' and 'string' commands into a unified set command which supports dword, qword, string, expand, multi-string & binary values. The full help for this command is as follows:-
Code:
SYNTAX: set <value name> <value type> <value>
The following are the value types supported by this command.

dword   - A hex or decimal dword value
   Example: set testvalue dword  1
            set testvalue dword 0xFFAA3311

qword   - A hex or decimal qword value
   Example: set testvalue qword  1
            set testvalue qword 0x12345678FFAA3311

string  - A string
   Example: set teststr string  "Hello"

expand  - A string
   Example: set testexp expand  "%PATH%;c:\test"

multi   - One or more string values
   Example: set testmulti multi  "str1" "str2" "str3" "str4"

binary  - The value parameter is a hex or decimal dword value
   Example: set testbin binary "0F A4 5F 12 0A"

A few minor bugs have also been fixed.
The Following 5 Users Say Thank You to FurballTheGreat For This Useful Post: [ View ] Gift FurballTheGreat Ad-Free
28th December 2014, 09:03 AM |#11  
ceesheim's Avatar
Retired Forum Moderator
Flag No Android Fanboys Please !!!
Thanks Meter: 2,293
 
Donate to Me
More
nice nice nice , this getting better by the day

I love using this for reg edits , because you can do it on the pc side what makes it sooo easy.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes