Develop Bugs

Application security

Hi!
I made this thread to clarify a few things about the application secuirity feature that allows only signed programs to run.
First, does an universal solution exist to remove this lock? After reading a lot of forums I only got more confused on this.
I also read that Orange users can ask them to remove the limitation. Are there experiences with other providers? (Paticularly German ones?)
Finally, I read something that I interpreted as if it is requested by the service providers. So if I buy a PDA at a store for full price and without SIM-lock, then will it be free of this limitation?
Thanks: Gabor

You misunderstood the issue.
WM 5 and newer OS do include security features that limit unsigned programs but not in any way that should concern the average user.
Basically if you install an unsigned app you will be asked if you want to run it or not by a pop up. This is similar to Windows XP with SP 2.
The real restriction is on replacing system files but freeware almost never does this.
There is no generic way of changing security polices because you need a registry editor signed by a trusted certificate and such things are not available to the general public (one was leaked for the HTC devices once, but they removed that certificate from newer models).
Also operators generally don't mess with security settings so it does not matter where you by the device.
The real problem is with smartphone devices (the kind without the touch screen) which can be locked completely to application installation.
Thats when you need to go to the provider for an unlock and thats when you may prefer buying one with cell co independent brand.

Maybe I interpreted it wrong, but I read things like "your phone must be application unlocked to use our program" or "please help, this program does not run on my PDA because it is not signed". I read the latter in relation to some game (they are not very likely to touch the system files as far as I know). Or is this a different thing from "application security"?

Well one type of application I know of that requires application unlock (on smartphones at least) is language support, like Arabic or Hebrew.
As for the second quote, since I don't know were it came from, there is no way of telling what the problem really is.
Personally I never had a game (or any other app) fail to run because of signatures.

Then I misunderstood it. I based my belief on J2ME, which needs digital signature even to make a TCP connection or send an SMS.
Is intercepting, swallowing and posting keyboard messages also permitted for unsigned apps? (I want to remap certain keys to arrow keys to make action games playable on the MDA Compact III, and other PDAs that have a trackball instead of arrow keys.)

Finally I found that one can generate his/her own certificate and sign stuff with that. As the last solution, when unlocking attempts fail, one can sign the desired programs.
Link: http://www.codeproject.com/useritems/signcode.asp

True, but I don't think you read it through. Creating your own cert and signing with it is easy, but you need to unlock security if you want to install your cert on the device.
Unless you install your custom certificate the device will not recognize it and treat the file as unsigned. This is a kind of 'catch 22', but if it wasn't so the whole certificate thing would be a complete waste of time (not that it isn't right now).

I read it thoroughly, in that article there was no mention of this.
My purpose is to detect and modify certain keystrokes on a HTC Artemis (a.k.a. P3300, MDA Compact III) in order to emulate a D-pad to make some action games playable (it has a small trackball instead of arrow keys). Will the security system prevent me from doing this?

I don't think you need to worry about certificates here (unless you are making a commercial product and can't have the user prompted with a question of whether to run the app).
Artemis is a PPC not Smartphone and security there is more relaxed so you should have no problem.
As for the article, they describe how to install the certificate, but neglect to mention that unless your provisioning cab it self is signed with an already recognized certificate it won't install.
By the way, if you have WM 5 or even WM 2003 Smartphone SDK you will find test certificates there along with a cab that installs them. This will save you the trouble of creating your own certificate but unfortunately that cab is not signed as well.

Thanks for the info.
The prompt can be turned off with this app: http://www.tweaks2k2.com/portal/filemgmt/singlefile.php?lid=16
It worked on my friend's MDA Compact 3 (the one I plan to buy).

So did you unlock your phone? i can't do that with mine...

user Agent string reg edit won't work on WM6.. JJ?

I've used many other roms, including Vp3Gs' and lvsw, but the "BLACK" roms are the only ones that enable me to log into my Wells Fargo because all other go to the page where it says that the IE is not compatible... is there any reason this happens? is there any ways to fix this on other roms?.. thanks

google user agent string
then find out how to change it in pocket ie. its a reg hack

I second this. You change that string and you can do the same on any ROM.

Proxy setting
I have 'disabled' proxy setting, and this has allowed me to use IE.
Hope this helps!

there was/is a app out there that basicly hides the fact that you are using a phone to acces the web i think it was tweak lite??? this was from a while back in the wm2003 days so i am not sure it is still around.
i stopped using my phone for heavy web browsing a while back and lost the cab for it. seemed like all it was is a reg hack.
maybe you can get one of the fantastic cooks around here to slap one together.
or buy opera i hear that it also does the same thing.

Buy Opera
If you get the paid for version of Opera, you can change it to identify itself as the "Desktop Version". This works well for me on the UK's National Rail website, which insists on giving me the rubbish cut-down version.

Well I've tried the desktop association with Opera, but I still can't access my online account with Wellsfargo because it is not a supported browser... I tried the user agent hack from WM5, but it won't work with WM6.. anyone out there... JJ? care to enlighten?

Changing the PIE User Agent is not as simple as a regedit anymore. The later builds of WM5 and all WM6 builds have the User Agent hard coded into the browser.dll in the \Windows folder. The User Agent string in the registry is now only for OEM's / Telco's to add any specific customisations.
The only way to edit the full User Agent string is to hex edit the browser.dll. If you search across all the Hermes forums (not just Wm6) there are numerous posts covering the topic.
Cheers
EDIT: Thanks for the below update PAPPL, seems my info was a bit out of date

Download "Schaps Advanced Configuration 0.9" here at xda-devs.
There you can simply change the User Agent in a User Interface!
The new WM6 Builds do have a UserAgent registrykey again. It's called "CustomBase"
Schaps Tool replaces this string.
browser.dll doesn't need to be hexedited anymore for WM6!
Only WM5 Aku3.x+ needs hexediting!

Thanks.. PAPPL.. I'm using schaps rom and have just been living with the fact that I can't do it..
Would I just have to change where it says Mozilla/4.0 to MSIE 6.0?

sry, but I browsed around and that all that had to be done with the registry but it doesn't seem to work with the advanced config tool... maybe I need to change the whole string to something else?

PAPPL said:
Download "Schaps Advanced Configuration 0.9" here at xda-devs.
There you can simply change the User Agent in a User Interface!
The new WM6 Builds do have a UserAgent registrykey again. It's called "CustomBase"
Schaps Tool replaces this string.
browser.dll doesn't need to be hexedited anymore for WM6!
Only WM5 Aku3.x+ needs hexediting!
Click to expand...
Click to collapse
So the "custombase" is a reg key? Where?

Jas - if you're still crusing by here... this would be a useful customisation in your Pimp toolset....

wpbear said:
So the "custombase" is a reg key? Where?
Click to expand...
Click to collapse
WM5 (max. AKU2.3): [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent] Default="Your Useragent String"
WM6: [HKLM\Security\Internet Explorer\User Agent] Custombase="Your Useragent String"
http://www.fiddlertool.com/useragent.aspx
Your string is shown in IE/PIE (User Agent:...)

PAPPL said:
WM5 (max. AKU2.3): [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent] Default="Your Useragent String"
WM6: [HKLM\Security\Internet Explorer\User Agent] Custombase="Your Useragent String"
http://www.fiddlertool.com/useragent.aspx
Your string is shown in IE/PIE (User Agent:...)
Click to expand...
Click to collapse
Thanks, I have been using a really old browser.dll to get CV to work guess I can stop doing that now.

Still doesn't work properly
I've done the registry change in CustomBase, but it still doesn't fix the problem
Useragentstring.com still reports my browser as Windows CE and I still get the WAP crap on some sites.
Using Opera set to "Desktop" fixes it, although Opera has other compatibility issues -and it's not compatible with my wallet.
WM6 is obviously still reading either the "Platform" setting in the WM5 key area, or it's doing something else equally creative.
I think the browser.dll hack is the only thing that is going to fix it, at this stage, anyway.
Anyone with any other ideas?

[App] Stkeys mobile

Since stkeys PPC (vb.net app) is way too slow, at least on my blueangel, i decided to try porting the original stkeys prog by wyse101 0x40 gmail.com to windows mobile as a native c app. So here it is, source included.
How to use:
Copy stkeys_mobile.exe to any folder on your phone.
Suppose you need to find the key for ThomsonAABBCC. Copy AABBCC to the clipboard.
Close any CPU intensive apps you might have running, so the program runs faster.
Run the program, and click OK to confirm or Cancel to exit.
Wait a bit (this program doesn't really have a GUI; bear with my inexperience in win32 coding).
After a minute or so, a messagebox shows up. Click OK to see the results with your default txt viewer. The results are always appended to \stkeys.txt.
Enjoy.

Hi
Sorry to sound dumb, thank for sharing but what exactly your app is doing ?

Exactly i also didnt understand ... what this app does?

It does the same as the original stkeys: guess the default WPA key in Thomson/Speedtouch routers. Read more on it here.

Hi.
I'm trying using this on my Xperia (WM 6.1) and give this error:
" Invalid SSID length (0). Exiting."
I already installed the .net framework.

kremlincrackers said:
Hi.
I'm trying using this on my Xperia (WM 6.1) and give this error:
" Invalid SSID length (0). Exiting."
I already installed the .net framework.
Click to expand...
Click to collapse
You have to copy the SSID to the clipboard. This program does not use the .net framework.

You may also take my SciLor's Wifi Penetrate (Other routers are also supported) for it. You will just need a rainbowtable to find the keys very fast (Just 200MB)!
http://www.scilor.com/wifi-penetrate.html

[Question] SIP Tutorial?

I've programmed in C++ before, and used all the Win32 apis etc., but I've never written a COM object in C++.
I had a look at the SIP sample in the WM6.5 SDK, and following some MSDN guides, I tried to use the wizards in VS2008 to create an ATL COM object. I think I got somewhere, because my SIP appeared in the list, however, none of my SIP functions ever got called, so I must have messed something up somewhere.
Does anybody know a decent tutorial or a blank SIP template I can look at?
Thanks

pomodoro coded with mortscript ?

Hi, I've just downloaded MortScript but haven't tried it yet on my htc touch dual. I wonder if it's possible coding something similar to this program
code.google.com/p/pomodairo/

MortScript is a scripting language without any UI capabilities.
The idea of a scripting language is mainly to automate things you could do manually.
So the answer to your question is no.

Well, I was thinking of something simpler as for the graphic interface. It would consist of a countdown and some input commands to introduce tasks and number of pomodoros, another control to read remaining tasks from a csv file and then show this information.
Could you provide some sample for a countdown in hh/mm/ss and reading from csv files ? How could I make visible the program so the user can activate easily the app without going to start/programs ?
Any help is very much appreciated! I'll post everything here