Develop Bugs

HTC Touch Pro2 as a HACKING tool?

Good evening folks,
I am considering buying the HTC Touch Pro2 when it is released in the USA on Tmobile. I would like to understand what hacking (security testing) tools are available on the Windows Mobile Platform. I am a security professional and have the desire to perform penetration testing from the HTC Touch Pro2.
It seems the MetaSploit framework is not available. I like to work with the command prompt, is the command prompt accessible on the HTC Touch Pro2? I've read some info about being able to mount ISOs or run emulators. Is there WiFi hacking software such as Kismet available?
Does anyone know what hacking tools are available for this platform?
Thank you!

Anyone have any ideas?

It doesn't run real windows, you can't get a command prompt. You'd be better off with a real machine.
There's a couple companies out there that sell WM devices for pentesting, but they are all provided with the hardware since they are focused on wifi and I don't believe the standard WM stuff lets you put it into promiscuous mode.
You'd probably be better off with an android device so you can just compile whatever you want.

MSFT products have never been suitable for comp-sec professionals.
You're better off connecting to a *nix box using either PocketPuTTY or using a webbrowser to connect to a remote server running metasploit.

Check out VxUtil, it gives you DNS, reverse DNS, port scan, ping, finger & so on. Pocket Putty is a good free SSH client, also does port forwarding.
OpenVPN works as well if that takes your fancy. Lots of security tools are available, they are just a bit obscure. I don't think nmap is around though.

thanks for the reply

Our company actually just released a new product (called Security Tools) that lets you ping, traceroute, do a WHOIS lookup, and even do port testing on your Windows Mobile phones. The port testing can even send clear text commands to a port such as 'GET / HTTP/1.0' to verify that it is a HTTP service listening on that port. The traceroute is also able to visually show the trace (if it's public IP address) on a map so you can kind of get a visual representation of where your traffic is going. Please feel free to try our one week free trial which lets you use the application for a week without limitations, so you can make sure everything works as you want before you buy.
You can visit the original post here at xda over at this thread:
http://forum.xda-developers.com/showthread.php?t=550473
or you can visit the website for the product at:
http://www.securenetworksystems.com/SecurityTools/

Punkster812:
I downloaded "security tool" , installed, got a license - and it was already expired...
Also, your company name is "secure network systems" and your web-pages are hosed in Microsoft IIS, and based on aspx .....seriously, if you wish to appear as a security company, you cannot use that crap.
the program with won't work because you serve old license, but one thing is clear; the icon is of very low resolution, and looks bad on WM6.5 or TouchFlo menu.
And: the long Device-ID is there only to annoy your customers, no pir8 would ever be bothered by it, so you may as well stick to 6 characters alphanumeric code +-+++...

AlCapone said:
Punkster812:
I downloaded "security tool" , installed, got a license - and it was already expired...
Also, your company name is "secure network systems" and your web-pages are hosed in Microsoft IIS, and based on aspx .....seriously, if you wish to appear as a security company, you cannot use that crap.
the program with won't work because you serve old license, but one thing is clear; the icon is of very low resolution, and looks bad on WM6.5 or TouchFlo menu.
And: the long Device-ID is there only to annoy your customers, no pir8 would ever be bothered by it, so you may as well stick to 6 characters alphanumeric code +-+++...
Click to expand...
Click to collapse
I am sorry that you had troubles with the trial download, if you PM me with your Device ID I can get you one. We are aware of the low resolution, but rather than focusing on a pretty icon, we worked hard on a functional program. The long Device ID is not to annoy customers, it is actual a very secure method that we use and if you are able to break it, I would be very impressed; I know it's long but it's to protect our intellectual property and no other licensing method existed that prevent piracy like this does. We know ever method is breakable, but this accomplished our goal of restricting to the pirates that are going to steal software no matter what.
As far as the server... you are using a Microsoft product as well for you phone. We very rarely use Asp.net through our site, in fact it's only for license generation and to set up an order, but doesn't actually handle purchases. So the site is secure and I am confused on why you think our site is so insecure. I love Linux and Apache as much as the next network administrator. 4 out of 5 of my personal pc's run Linux with one set up with Apache for my personal site, but for our business needs, we went with IIS.
Again I am sorry that it didn't work for you, I will double check to see if it's still properly generating license, and remember, the trial starts from when you download the license, not run the application with the license.

regarding IIS: http://www.internetnews.com/securit...Microsoft+Rushes+to+Patch+FTP+Hole+in+IIS.htm
This finally got some attention, it was in fact being exploited for years, over several versions.
Hosting software on vulnerable servers gives an opportunity for hackers to easily repack your CAB with spyware/dialer, and you can guess the rest. - such CABs must be inspected for each download.
Regrading long serial number, it only makes a brute force attack harder, at best, which is usually not the method used. You can as well trunk it to a 6-7 char/alphanumeric number, and it will work the same, but annoy people less.
Remember you are at a forum where people often reflash, and entering long serials each time (if cannot be exported from registry) - is boring, and a motivation to workaround.

I can't remember what it's called, but there is a CAIN port for Windows Mobile.

Fmstrat said:
I can't remember what it's called, but there is a CAIN port for Windows Mobile.
Click to expand...
Click to collapse
you are right; - it's simply "Cain for PPC:"
http://www.oxid.it/downloads/Cain_setup_PPC.ARM.exe
and yes, it's far away from the "real" Cain.

AlCapone said:
regarding IIS: http://www.internetnews.com/securit...Microsoft+Rushes+to+Patch+FTP+Hole+in+IIS.htm
This finally got some attention, it was in fact being exploited for years, over several versions.
Hosting software on vulnerable servers gives an opportunity for hackers to easily repack your CAB with spyware/dialer, and you can guess the rest. - such CABs must be inspected for each download.
Regrading long serial number, it only makes a brute force attack harder, at best, which is usually not the method used. You can as well trunk it to a 6-7 char/alphanumeric number, and it will work the same, but annoy people less.
Remember you are at a forum where people often reflash, and entering long serials each time (if cannot be exported from registry) - is boring, and a motivation to workaround.
Click to expand...
Click to collapse
Thanks for the link, I looked into and we are not vulnerable against the attack and never have been due to the attacks requirements (http://blogs.technet.com/srd/archive/2009/09/01/new-vulnerability-in-iis5-and-iis6.aspx). As far as brute forcing, without going into to much details, would be extremely difficult to do as it uses standards proven encryption algorithms. The extremely long serial that you are talking about is a unique ID for your phone. We know it's long and are always looking for ways to improve the licensing we use. The license is a file and not something that you key in, you copy to the installation directory; so you can keep a copy in your email, on your computer, flash drive, where ever for back up purposes in case you need to reload the app.
As far as reflashing, that is a very valid point. I am not 100% sure, but I believe reflashing should not hurt the license, which would hopefully mean you wouldn't have to enter your device id again. But if any one could confirm this, that would be appreciated. We know a lot of the people here are very advanced and know more about their phones then most the people at service providers or even the phone manufactures themselves sometimes, which is why we enjoy releasing our products here for testing before we release them to the public. In the little time that Security Tools has been up we have received some constructive feedback on what could be improved.

Punkster812 said:
As far as brute forcing, without going into to much details, would be extremely difficult to do as it uses standards proven encryption algorithms.
Click to expand...
Click to collapse
Right, that's why I said long numbers would be good for only that, once the calculation/verification routine is extracted for a keygen, it's no more job whatever the result is 6 or 50 digits long.
- Therefore, you might save your customers from all the boring entry, because no keygen /(or crack) will be more difficult by having more digits.

Windows Phone 7 - Introduction to the .xap (replaces .cab)

So, with WP7, we lose all support for the .cab and associated API as it exists now. Replacing it is the .xab format.
What's a .xap?
A .xap is a simple, every day .zip file, renamed to .xap. Inside, it contains the app and all relevant dependencies. There are a number of possible .xml files that could be included inside the .xap to determine things like required security access level, to tell the system which .dll contains the main() for the application, etc.
I believe the .zip also provides a container for the virtual filesystem available to the app (not sure on that, it may be stored in a separate container, have to analyze more)
At least initially, .xaps will only be available for deployment through the Marketplace.
Regarding preloaded applications by OEM/MO: Requirements are much more strict in this regard now due to frequent end-user complaints about "slow, laggy, etc" Stock ROMs. I know every one of you reading this knows what I mean Preloaded App Requirements (which will be distributed as .xap) as follows:
Maximum of 6 preloaded applications on the device, not to exceed 60MB
All preloaded apps must pass Marketplace submission process (some extended APIs are available to OEM/MO so the process is slightly relaxed in that regard)
The application(s) and all future updates must be free of charge.
The apps must launch without dependency on network availability.
The apps must persist through a "hard reset".
The apps must be updatable and revocable (!!!!) through the Marketplace.
The apps must notify the user at first launch of any capabilities to be utilized and get user consent (to access compass, accelerometer, network, etc.)
I've attached a .xap to this post for your examination. It's renamed to .zip for the attachment system to allow it.

Hehe.. this reminds of the "widgets" for Vista and 7 or the "apk"s for Android. Same stuff it sounds like Thanks for the info master Da_G

Does this mean .cab.pkgs are being changed too?

The .cab.pkg format remains intact for imageupdate (actually I haven't examined it in depth just yet, but all indications are that they have not changed .cab.pkg format)

Bump for visibility

Interesting...Wonder if there will be a process to convert some cabs to xabs.

Highly unlikely. xab's are silverlight applications meaning you have to use xaml , c# code and libabries all in one small zipped file. Cab's are Cabinent files that has an inf file that specifes what libabries and files are going to be enclosed in the file. To put it simply a xab is a standalone application that does not require extraction or installation to run and a cab is an application which requires an extraction and for its contents to be placed in specific areas in order for the dependents to find and use them.
Also to clarify. Local storage for xab's are not defined or stored in the xab file. they are defined by the silverlight runtimes which is handled by the os. As of now since there is little information as to how the windows phone internal structure is (apart from us knowing that windows phone will utilised microsoft unified storage.). on windows 7 and windws vista after u install the silverliht runtimes all xab's that request local storage is stored in <SYSTEMDRIVE>\Users\<user>\AppData\LocalLow\Microsoft\Silverlight\is .. Just note silverlight local storage works just like flash local storage. the only exception so far for windows phone is that u will not be able to access a lot of local directories just predefined stuff like music, pictures and documents.

Just before people get into bad habits; they are xap, not xab files. No relationship to cabs whatsoever save as a container format.

Da_G said:
Regarding preloaded applications by OEM/MO: Requirements are much more strict in this regard now due to frequent end-user complaints about "slow, laggy, etc" Stock ROMs. I know every one of you reading this knows what I mean Preloaded App Requirements (which will be distributed as .xap) as follows:
[*]Maximum of 6 preloaded applications on the device, not to exceed 60MB
Click to expand...
Click to collapse
That is just brain damaged. Pre-loaded apps add clutter, but they also cut down on cost. Choose your poison. Pre-loading has little to do with with speed penalties, when done properly. Frankly, if roms have the same ancient architecture under WM7, then Microsoft really needs some technical leadership replaced.
[*]All preloaded apps must pass Marketplace submission process (some extended APIs are available to OEM/MO so the process is slightly relaxed in that regard)
Click to expand...
Click to collapse
Now this is where some quality review comes in. It all depends on how good the standards are, and I dare say they will seem lower and lower as time passes. Hell, they're already admitting that OEMs will have relaxed standards.
[*]The application(s) and all future updates must be free of charge.
Click to expand...
Click to collapse
That's just silly. You'll get a bunch of lite software versions with next to zero shelf life instead of upgradable versions with marginal shelf life.
[*]The apps must launch without dependency on network availability.
Click to expand...
Click to collapse
what does this even mean? Does that mean no internet based app can be installed? All it really means is you have to quit gracefully if the network isn't available.
[*]The apps must persist through a "hard reset".
Click to expand...
Click to collapse
This is a good thing, but primarily a reflection of back when flash memory was in short supply. Haven't run into it in forever.
[*]The apps must be updatable and revocable (!!!!) through the Marketplace.
Click to expand...
Click to collapse
Well, updateable is good...but revocable? Maybe removable would be more consumer friendly. Makes me think of the PS3.
[*]The apps must notify the user at first launch of any capabilities to be utilized and get user consent (to access compass, accelerometer, network, etc.)
Click to expand...
Click to collapse
What I take from all of this is that
a) they want to drive more traffic through the marketplace.
b) they want to drive more traffic through Windows Certification
Good for the average consumer, great for Microsoft. Personally, the only point that has any value to me at all is a central marketplace. The rest of the bullets are ways for Microsoft to drive seperation between their brand name and many software vendor's crappy products.

ahhhha , sound interesting .

gguruusa said:
That is just brain damaged. Pre-loaded apps add clutter, but they also cut down on cost. Choose your poison. Pre-loading has little to do with with speed penalties, when done properly. Frankly, if roms have the same ancient architecture under WM7, then Microsoft really needs some technical leadership replaced.
Click to expand...
Click to collapse
I don't know, I wish MS enforced that same restriction on the Desktops OSes too. Nothing worse than getting a Dell or Sony PC full of preloaded gunk.
gguruusa said:
That's just silly. You'll get a bunch of lite software versions with next to zero shelf life instead of upgradable versions with marginal shelf life.
Click to expand...
Click to collapse
It's a big leap to come to that conclusion seeing as most software that ships with phone doesn't have additional charges. The restriction as I read it really means you just won't get a tonne of unwanted trial-ware on you shiny new phone.

Eoinoc said:
I don't know, I wish MS enforced that same restriction on the Desktops OSes too. Nothing worse than getting a Dell or Sony PC full of preloaded gunk.
Click to expand...
Click to collapse
maybe, but that same preloaded gunk cut the price of your dell and sony. While I don't like preloaded gunk, I don't like expense either. What I do like is being able to make the decision myself of how much gunk vs expense I am willing to tolerate.
It's a big leap to come to that conclusion seeing as most software that ships with phone doesn't have additional charges. The restriction as I read it really means you just won't get a tonne of unwanted trial-ware on you shiny new phone.
Click to expand...
Click to collapse
I agree it is target at no trial-ware. Any idea how people in the business world get around that? Lite versions of software (aka cripple-ware). Pay per use software. I'm sure there are other strategies. Frankly, if they enforce the ability to remove, I'm not that particular on how much gets pre-loaded. The fact of the matter is that the problem isn't how much crap comes with your phone; it is that you don't get to pick whether it is installed.

great find Da_G, so its XAB no more cabs

the0ne said:
great find Da_G, so its XAB no more cabs
Click to expand...
Click to collapse
XaB no.
XaP

tighoor said:
XaB no.
XaP
Click to expand...
Click to collapse
oops ..

How bad this is for the guys that dev here?
or... how good?

guessing .xap is short for XNA Application Package ?

vladimir2989 said:
guessing .xap is short for XNA Application Package ?
Click to expand...
Click to collapse
close, but no. In fact, it's actually a silverlight application package - it's been used for web stuff since silverlight released.

how to convert XAP to OEM/EXT package ?

I'm not sure what you mean by "OEM/EXT" package, but it's probably not possible. If you want to include an app with the phone, that *is* possible but the only way I know of is to include the XAPs in the ROM and then install them on first bootup. Probably not the best approach.

Desperately Needed

WP7 desperately need a 3g to wifi tethering app like myfi. I used to have an iphone but switched WP7 and now I need a 'myfi' like app badly.
Can someone some building this app ASAP.

at present it's not possible to even build one as there aren't any APIs for it. I'm sure this has been asked quite a few times on this forum already... please search... rather than just continually asking what people deem as a common requirement. also search the pinned threads as they're a good place to start for missing functionality...

There are APIs. Samsung phones can tether so yh APIs are there. WP7 is just CE with some changes/additions. Microsoft just isn't allowing access to the APIs...
Sent from my HD7 using Board Express

I would think that OEMs have a different set of APIs which provide them with native capabilities. I doubt the OEMs are writting their apps in just C# otherwise MS would have released those APIs as well.
also to note, those phones that can tether is done through the diagnostics, which would imply that they should be already in all windows phones and just dormant. i highly doubt it's specific to samsung phones. it may be that we only know how to do it with samsung phones now.

The Gate Keeper said:
I would think that OEMs have a different set of APIs which provide them with native capabilities. I doubt the OEMs are writting their apps in just C# otherwise MS would have released those APIs as well.
Click to expand...
Click to collapse
That's my point. The APIs exist, as does the base Windows CE system.
We just don't have the development tools nor do we have access to that level of the system to be able to write those applications ourselves.
We're limited to sandboxed Silverlight-based applications, but Microsoft and OEMs can use Native Code and APIs we don't have access to.
They exist, we just don't have access to them. Apple does the same thing with iOS.
Thanks for agreeing with me, though
also to note, those phones that can tether is done through the diagnostics, which would imply that they should be already in all windows phones and just dormant. i highly doubt it's specific to samsung phones. it may be that we only know how to do it with samsung phones now.
Click to expand...
Click to collapse
Which also means WP7 supports tethering. The functionality just isn't exposed to users in the general user interface, that is why you have to dig for it. The same thing is true for Sideloading XAPs, among other things.
It's there. The OS is totally capable of it. WP7 did, in fact, inherit a ton of functionality from Windows Mobile. The difference is that the new UI doesn't expose it to the user, and applications (and the system) are managed in a totally different way.
There's a huge difference between "does not exist" and "exists, but functionality is not exposed in the UI."
Windows on a PC can access drives, etc. by device name, but that is not exposed in the UI - for example. The same is true for many features in WP7 that are there by virtue of it being based on CE and tied (although Microsoft would want you to think differently) to Windows Mobile. They just chose not to expose this functionality.
Not saying it's totalyl based on WM, since that's obviously untrue. If that was the case stuff like full Exchange support, Video support for MMS, etc. would be working.
But the fact that this stuff is there and they're dragging their feet to allow users to use it is what's keeping lots of users off of WP7 at the moment. It's taking them too long to make changes that seem too simple... Maybe for the sake of security, I don't know. They haven't really been transparent with early adopters, IMO.
EDIT: Also, you can call Native Code from managed languages (C#, VB.NET, Java, etc.), so I'm pretty sure they are writing their apps in C# and only calling native code/libraries when they need to. Writing it in straight C/C++ is [potentially] more dangerous than using a Managed Language with Interop. I can't see Microsoft going for that.

Contact from Kin Developers

About 2 weeks ago, I took johnkussack's advice (I think it was him) and went to LinkedIn to try t be friends with anyone who came up on the search for "kin phone". In the invite email, I just said that I noticed they worked on the Kin phones and would like to ask them a few questions on how one could write to the phone. I have had 3 responses in the last 2 days.
Guy1: didn't know because he worked on the UI for the Kin Studio
Guy2: kindly told me he couldn't release an unauthorized build and that he would be breaking the law by doing so.
Guy3: This guy worked on the phone for over a year. He first told me I was breaking the DCMA by hacking/reverse engineering Kin, regardless of intent. Then he said this important thing:
"You are absolutely right in assuming that the device is locked; in fact, it has a hardware lock that is common to many such devices. When the devices roll of the manufacturing line the programming fuses are blown (literally) preventing any further programming of the device. This is all handled by hardware so unless you find a flaw with that you are out of luck."
So if this is true (sounds like it is), the "dream" is over. Hopefully there is some way that someone out there can find.
If I get more responses, I will post them here. Don't ask me to go back to these three who already replied and asked them more questions, I think I made some of them mad.

Hmmmm... I don't know whether or not the KIN models will accept OTA updates so that's a good question to ask. If OTA updates are possible then it's inherently possible to change the software. I wonder...

Yes, it was me the one who said about "linkedin".
But i also said "in one word NDA". You should known even before ask that the signed NDA are also legal contracts, so i prevented before asking them.
On the DCMA, yes.. on the USA. Outside the big country, the legal question is different and may not operate with that law. (if ever). If they provide a normal (legal?) way to unbrick my factory mode here, or to use the phone options, then i wait for the cost for it.
And everyone knew that hardware was not the way, just at the moment where first flash attempt failed. "Dream" is doable by software, if anything is to be done.
What i don't get is why to ask for rom rom roooooms, where we need drivers drivers driveeeeers... or sdk's. We won't get it anyway from MS, but no flashing means a rom is futile, non useful,crap pack of bytes.

But i also said "in one word NDA". You should known even before ask that the signed NDA are also legal contracts, so i prevented before asking them.
Click to expand...
Click to collapse
I figured I just take a shot in the dark; hope for the best and expect the worst. Since the phone and suuport from MS was discontinued, maybe the NDAs would be voided.
And everyone knew that hardware was not the way, just at the moment where first flash attempt failed. "Dream" is doable by software, if anything is to be done.
Click to expand...
Click to collapse
Good to know you still think there's a way.
What i don't get is why to ask for rom rom roooooms, where we need drivers drivers driveeeeers... or sdk's. We won't get it anyway from MS, but no flashing means a rom is futile, non useful,crap pack of bytes.
Click to expand...
Click to collapse
I just asked if "there is a way to get around the write lock". Had I known ahead of time to ask about drivers or SDKs, I would have put that in the msg.

I strongly believe that we could operate with the device,softwarewise. there is proof that the kin NAND memory (for now on, called "Storage" as label) is writeable. Not sure on the Rom part.
Of course, i mean.. just use it as a normal writable storage memory.
I posted how it could be done and would do it myself but, again, i bricked my phone, and available ones (through bidding sites) are so expensive to buy another one just for this (+ $150). Don't see a way to get it internationally again.
And even doing it, i'm not sure about what could be done just writing on the storage mem....

If the fuse byte is burn't should not it have prevented you from bricking?

kintwouser said:
If the fuse byte is burn't should not it have prevented you from bricking?
Click to expand...
Click to collapse
Nvitem bricked, not flashing bricked. You can succesfully write to the NVItems memory. But i guess it's just configuration memory and not the one "fused".

I just want to mention that jailbreaking a phone is NOT illegal in the United States! Geohot hacked the iphone... Apple went after him... Apple lost.
Also blowing the programming fuses seems a little fishy to me actually. No other phone does that. The majority of other phones have been flashed. I just think it would be pretty odd for a company to do that so that they no longer could update it. I am not sure I believe him. If this really was true... then why wouldn't Apple or Sony be doing it? This also doesn't make sense since Microsoft actually originally intended on putting WP7 on this as well as allowing apps for it. Check this article out:
http://www.intomobile.com/2010/05/12/kin-windows-phone-7-a-lot-closer-than-we-thought/

you must understand, its not possible to blow fuses in the hardware, it would be a top news story if they were able to keep the OS running in complience with the flash memory without it crashing. Obviously that was a lie to discourage us, and i dont even think that was a real kin developer, because microsoft clearly stated that all kin developers would be moved to WP7 or another programming section. And it doesnt matter if its legal or not to jailbrake phones, if we are porting a new OS, we wouldnt have modified the original OS, which is what jailbraking means. Most likely the OS is hidden deep in the flash memory with a write - protection. If you think its saying access denied because they said the fuses were blown, its wrong. They must just have a password or code that needs to be sent continuasly to the phone to access files. If the fuses were blown, then nothing would be able to be accessed by zune, because it would be impossible to reach the memory.

soninja8 said:
Most likely the OS is hidden deep in the flash memory with a write - protection. If you think its saying access denied because they said the fuses were blown, its wrong. They must just have a password or code that needs to be sent continuasly to the phone to access files. If the fuses were blown, then nothing would be able to be accessed by zune, because it would be impossible to reach the memory.
Click to expand...
Click to collapse
Not my expertise field, but this mobiles can (and in fact they do) have several memories, storing the OS in the ROM memory and all the data on the NAND memory (our "8gb" storage).
Zune software has protocols to query for available storages (requiring its label/id) and is allowed to write/read to it. If you dare to click on update version (at least in the 1st version I tried) it expressed that the option was not "available" to that device without web requesting data, apparently.
So.. in the nand flash we may only have the equivalent of a SD Card. And my last wince PDA showed that as /Storage too, apart from main wince ROM.

You can format the nand memory using win explorer if in fact it is the 8gig storage. I did this and it deleted all pics,albums etc. It was interesting to note that we cannot copy or view these pics without an access error but it does let me delete them.
I just wan't to be able to get my pics off this piece of crap without emailing them.

I posted it once. You are able to:
- Query storage properties (label, size, id,...)
- Query storage folders
- Query folder files.
- Query tracks / albums / playlist / images / anyZuneSupportedFile
- Delete * file (whatever)
- Format the storage
You are "unable" to:
- Upload (create) a file into the device
- Download a file from the device.
MTP protocol tools allows you to do so, from command line (not quite sure if they are available on Win32 OS's), but... fails to operate with this device when it comes to the "unavailable" operations.

I am curious as to which former developers you contacted?
I was doing some research and noticed that Microsoft acquired the company Danger, Inc. After Microsoft purchased them, the former president of Danger went to develop Android (later acquired by Google). One thing I read was that most of Dangers employees left after being purchased by Microsoft. Apparently these people don't like Microsoft all that much! I also looked into it a little more and found one of the founders of Danger who had a twitter account. Of course all of his tweets were via a "KIN". Thought that was interesting. It seems to me that these former Danger employees would be interested in helping out if they don't hold to high of an esteem for the big "M".

seems like this is your first "inside the move" trying-to-hack/reverse a thing, so i will say:
people involved doesnt wanna risk through legal issues, even if they were pissed off, just for "some kids" to have a driver or rom. NDA are strong there, and they could either sign them or leave (if leaving, they don't have the interesting things).
At most you would get bad-mood or good-luck comments, and ocassionaly (very uncommon), leaks (wont happen here).

yeah, they purchased danger for an amazing 500 million dollars, which they later developed the kin with it, they were planning to put windows phone 7 on it, but they were to behind and released it with the old windows CE, then the former developer moved to work on a free source OS, later called android. Google wanted to get android while it was cheap, so they bought that company, and made the old developer as 2nd engineer.

Maybe not worth yet, but we should get more *info* about the SBL mode (aka "Ms Pink Bootstrap), as coinflipper said that it was the way to flash OS or parts (like radio's).
I have been trying even OMA wap WBXML bootstrap examples with it, but as we dont know if our phone is standard, it's like looking for a water drop in the sea of possibilities.
We do not need a guide on how to do something, but what-to-do with it.

Maybe, JUST MAYBE, we could design a program like bitpim. I am a mac user and when I used bitpim with my enV touch, I used to edit all sorts of files. Examples would be phone info, server info etc. We could make a program like that to get the info. I know programming may be hard, but its worth a shot. I hate the OS on this phone, ESPECIALLY WHEN YOU PIN APPS! THEY LOOK HORRIBLE

Kinuser1 said:
Maybe, JUST MAYBE, we could design a program like bitpim. I am a mac user and when I used bitpim with my enV touch, I used to edit all sorts of files.
Click to expand...
Click to collapse
We can't. If we have not the protocols or the supported phone features (protocols, drivers, documentation,...) you cannot guess it and put it into visual basic (or Xcode) and then by *magic*get the program you want.

i will admit that i know very little about protocols and drivers but i would like to point out that bitpim is open source, and that the code can be found here ->
http-//sourceforge.net/scm/?type=svn&group_id=75211 (change "-" to ":")
i seem to recall bitpim already having limited support for the kin, but perhaps with a little research and a little code tweaking we can find ways to improve it? i'm not sure how feasable it is as i have very little experience with programming for phones/usb devices, but it's just a thought.

slimeq said:
i will admit that i know very little about protocols and drivers but i would like to point out that bitpim is open source, and that the code can be found here ->
http-//sourceforge.net/scm/?type=svn&group_id=75211 (change "-" to ":")
i seem to recall bitpim already having limited support for the kin, but perhaps with a little research and a little code tweaking we can find ways to improve it? i'm not sure how feasable it is as i have very little experience with programming for phones/usb devices, but it's just a thought.
Click to expand...
Click to collapse
We can't. If we have not the protocols or the supported phone features (protocols, drivers, documentation,...) you cannot guess it and put it into visual basic (or Xcode) and then by *magic*get the program you want.
Click to expand...
Click to collapse
The above applies to any software you want. Unless you magically found documentation or files (like OP), there's no way to. So f#cked.
The thing is always the same, tweaking tweaking... what to tweak, huh?

HTCutility.dll used for direct access to TCB chamber

As it is known that HTCUtility.dll will provide complete, unrestricted access to the TCB chamber on HTC devices, can this be used to unlock (at any level) the OS?
I have not heard anyone speaking of it and exists on my HTC Arrive. Seems to be a bypass for unrestricted access to anything within HTC devices.
I am looking at it myself, but thought I would share.
See details here...
http://labs.mwrinfosecurity.com/files/Advisories/mwri_htc-htcutility-kernmem_2011-11-10.pdf

Your link is down

very interesting but you link is down so please fix it so I can take a look. I too have a HTC arrive and have been working on an unlock.

Don't know what happened to the link.
Here is the link to the google docs version.
https://docs.google.com/viewer?a=v&...1C1HkN&sig=AHIEtbTwK-r8RyAyFmt1ai119m7EVAqsNA
-Paul

This looks promising, I'd like to know if what's written there is true ...

The paper is a couple months old, so it *could* have been patched by HTC... but hey, it also might not have been! This bears investigation post-haste.
It's easy enough to use this to execute some arbitrary code at high permissions, which is certainly useful as-is (do things like unrestricted registry and filesystem access). The real potential of it, though, is to turn off the security restrictions for specific apps. Essentially, get the benefits of a "fully unlocked" ROM but on a stock ROM, and only for the apps you specify.
One thing to note here: this is still going to require an interop-unlocked phone. It's opening a handle to a driver, and just like everything else that does so, it needs ID_CAP_INTEROPSERVICES. This is great news for owners of interop-unlocked/unlockabe phones (since this makes interop-unlock useful again) but probably doesn't help on 2nd-gen phones or on the Arrive (unless you want to roll back to NoDo, in which case this can probably be used to make an interop-unlock that works on Mango, though it wouldn't be easy).

I hope some one gets this working for the Arrive ASAP

Oh this was talked about a while back. It was patched back in NODO

Really? The paper is from only 3 months ago (assuming USA numeric date style, 2 months otherwise). You don't typically publish security advisories for things that were patched more than 6 months prior.
In any case, HTCUtility.dll still exists on my phone. No idea yet if that IOCTL still works, though. I'll try it out in any case, and report back.
For those asking about it for the Arrive though, you're likely out of luck even if this works. It is *not* a way to interop-unlock a phone, and it is *not* a way around interop-unlock. It's a way to do more things on an interop-unlocked phone. You can't even reach a driver (which is what HTCUtility.dll is) unless your app has ID_CAP_INTEROPSERVICES - that's what the capability is actually for, accessing drivers - and you can't install a homebrew app with that capability unless interop-unlocked (or on pre-Mango).

GoodDayToDie said:
I'll try it out in any case, and report back.
Click to expand...
Click to collapse
Thank you

GoodDayToDie said:
Really? The paper is from only 3 months ago (assuming USA numeric date style, 2 months otherwise). You don't typically publish security advisories for things that were patched more than 6 months prior.
In any case, HTCUtility.dll still exists on my phone. No idea yet if that IOCTL still works, though. I'll try it out in any case, and report back.
For those asking about it for the Arrive though, you're likely out of luck even if this works. It is *not* a way to interop-unlock a phone, and it is *not* a way around interop-unlock. It's a way to do more things on an interop-unlocked phone. You can't even reach a driver (which is what HTCUtility.dll is) unless your app has ID_CAP_INTEROPSERVICES - that's what the capability is actually for, accessing drivers - and you can't install a homebrew app with that capability unless interop-unlocked (or on pre-Mango).
Click to expand...
Click to collapse
Yeah I think it was mentioned here on XDA and it was believed to already have been patched.

I think by "patch" they mean that Interop was restricted as of Mango, thereby securing this exploit, in Mango. But for those that are Interop unlocked, this should still grant full access to everything else.
Just my observations. I have an Arrive and am not Interop unlocked yet, so I can't test it.
Looking at the hand-free provisioning to see if I can find a way to leverage that....
-Paul

It works. I successfully opened a handle, read a kernel-mode memory address, modified it, confirmed the modified value, and restored it.
Next trick: finding something really useful to change. Ideally, probably the process security info - if I can simply elevate a given process to full permissions, then I'm golden.
Will share code soon. If somebody knows where I can find the important part of the process info, let me know - I have a little familiarity with NT process contet blocks, but none with CE ones (if it even uses such a structure).

GoodDayToDie said:
It works. I successfully opened a handle, read a kernel-mode memory address, modified it, confirmed the modified value, and restored it.
Next trick: finding something really useful to change. Ideally, probably the process security info - if I can simply elevate a given process to full permissions, then I'm golden.
Will share code soon. If somebody knows where I can find the important part of the process info, let me know - I have a little familiarity with NT process contet blocks, but none with CE ones (if it even uses such a structure).
Click to expand...
Click to collapse
All the information looks like it is in the advisory. KDataStruct is what you want. That is equivalent to the PEB in Windows CE.

GoodDayToDie said:
It works. I successfully opened a handle, read a kernel-mode memory address, modified it, confirmed the modified value, and restored it.
Next trick: finding something really useful to change. Ideally, probably the process security info - if I can simply elevate a given process to full permissions, then I'm golden.
Will share code soon. If somebody knows where I can find the important part of the process info, let me know - I have a little familiarity with NT process contet blocks, but none with CE ones (if it even uses such a structure).
Click to expand...
Click to collapse
Can you confirm this works only on already Interop Unlocked device ?
Thx for your efforts.

Could htclv.dll be helpful in setting security on an app? It supports the following functions:
LVModInitialize LVModUninitialize LVModAuthenticateFile LVModRouting LVModAuthorize LVModGetPageHashData LVModCloseAuthenticationHandle LVModGetHash LVModProvisionSecurityForApplication LVModDeprovisionSecurityForApplication LVModGetSignerCertificateThumbprint LVModSetDeveloperUnlockState LVModAuthorizeVolatileCertificate LVModGetDeveloperUnlockState
In particular the "Deprovision Security for App" and "Get/set DeveloperUnlock" or maybe "Authorize Volatile Certificate"....
Or maybe htcpl.dll which seems to be the HTC policy engine interface. Supports:
GetFunctionTable PolicyCloseHandle PolicyEngineInit PolicyRuleAbortTransaction PolicyRuleAddRawData PolicyRuleBeginTransaction PolicyRuleBuildRawData PolicyRuleCommit PolicyRuleCommitTransaction PolicyRuleCreate PolicyRuleDelete PolicyRuleFindFirst PolicyRuleFindNext PolicyRuleGetInfo PolicyRuleOpen PolicyRuleParseRawData PolicyRuleReadRawData
These all look good to modify the security policies on HTC, assuming Interop-Unlocked.
-Paul

@dragonide: Confirmed, this requires interop-unlock since the very first step is opening a handle to a driver.
@Paul_Hammons: The LVMod functions look quite interesting indeed. Where are you getting these functions from (straight out of the DLLs, or some doc somewhere, or decompiled code, or...?), are they user or kernel entry points, and what permissions do they require? The ability to modify app security doesn't do as much good if you already have to be high-privileged to call it, though it might simplify my current goal.
@n0psl3d: Cool, I'll get to work on it.

@n0psl3d: KDataStruct contains kernel information, but I'm pretty sure what I need is in a PROCESS struct (such as is pointed to by pCurPrc). The problem is, I can't find any documentation for that struct. I'm searching online but so far coming up empty. CE doesn't seem to use PEBs or TEBs as I've seen them on NT (not terribly surprising, but annoying).
EDIT: I'm downloading the Embedded CE toolkit, which comes with source code. It'll take a while but hopefully that will have what I need.

OK, digging through the CE source I've found some interesting things. No idea if this will work yet; it'll be exciting just to make it compile.
PROCESS struct -> hTok (handle to a Token) -> phd (PHDATA, pointer to the handle data) -> pvObj (PVOID to the actual object, which is probably a TOKENINFO) -> psi (pointer to ADBI_SECURITY_INFO) -> contains the actual ACLs and privileges, and can be created from an account ID.
Probably the easiest option is to find a relatively high-privilege process and clone its token or some such. Token re-use (if I increment the reference count, this should work) may be easier. Modifying an existing token might also be doable.
Anyhow, I'm not going to have this finished tonight, but it'll get there. For those wondering wht you can do with this, it basically breaks you out of the sandbox entirely. You can call any function, access any resource, etc. that is available to a userland process (executing in kernel mode is also possible but trickier). Practically speaking, this makes all the other high-privilege COM DLLs useless - instead of ComFileRW, just use the file IO methods (anywhere you want), instead of DMXMLCOM just call ConfigProvXml directly. Even things like launching native EXEs directly should become possible (run those Opera ports on a stock ROM, for example).

I'm sorry, I still don't know what any of that means. But it sounds good! I wish I knew how to do this kind of stuff. Thanks for all of your work!