I am aware that this has been asked many many times, but i don't see a thread for this issue. I would like to know what attemps have been made to get some sort of support. I am by no means a developer, but i will try my best to get things running. Would it be something as simple as taking a a file out of a current android phone with the same specs and modding for use with a touch pro.
I'm simply curious if there is a thread or website around that discusses this and other issues in more detail.
I'm no kernel hacker, but I am...curious.
That's what i would like to know. facts about how far the development is. Maybe we could start a thread that has such progress stated. Where only the devs would be able to post, so we can have us a look.
The best you can do is read the IRC logs from #htc-linux. I think I recall reading in the logs that klinux had gotten OpenGL working on the Pro2, even with applications like Neocore (thought they're apparently slow).
You have to be a little bit more clear on what you mean by "open gl working".
I'm the developer who was working on the open gl for the klinux build. Bottom line is that open gl is working, but not with hardware acceleration. We used then nexus one drivers (adreno200) to enable things a live wallpapers. But it's so slow its not even worth it.
Now to get hardware 3d working 100%? a lot more work and testing. lol.
Well is hardware 3d working for any of the current android ports in any capacity?
Also, I'm so used to reading hardware specs in Desktop computer form. But with these phones, the only thing I know about them is the CPU manufacturer, model number, and speed.
Is there a separate chipset that handles audio graphics etc, or is it completely SoC.
I read about recent Android ports on the iPhone, and it seems they already have things like external audio working. Is this because the hardware on the iPhone similar to another HTC Android phone, more so than the hardware in the Rhodium?
awesome thread... actually informative and supportive.
i think what the OP is saying is how can us lowerscale highend users be more involved, perhaps in the debugging, data gathering... we could start a -sub group dedicated to each corresponding issues... bill gates didnt invent windows, him and his crew did. the more the merrier eh?
I have a long running reverse engineering thing going on. I have been looking for more info other than IRC. I would like to put my good skills to work w/out starting from scratch. Any info?
EDIT: I did find this, It has some helpful starting info: http://www.androidonhtc.com/wiki/Get_Involved
This is a great thread! I've been wanting to get in on some of this action. Hopefully this will reduce some of the clutter in Reefer's thread.
I meant to get hardware acceleration working. How far has this come along since i posted this??
Only Diamond / Raphael has hardware 3D enabled so far.
Very limited 3D for "low resolution" could be enabled in blackstone or other devices with workaround but that is somehow meaningless.
phh has tried different combinations of memory allocation but in vain.
so am I... given up at the moment.
mcdull said:
Only Diamond / Raphael has hardware 3D enabled so far.
Very limited 3D for "low resolution" could be enabled in blackstone or other devices with workaround but that is somehow meaningless.
phh has tried different combinations of memory allocation but in vain.
so am I... given up at the moment.
Click to expand...
Click to collapse
Phh recommended to trace down mem locations used by wince and that has been done but it still refuses to fire up once pmem.c is modified.
Recently i got the wince dmesg from my rhod in hopes that a cold boot would show as to how the 3d is being activated but that also showed no results. I get this crap when Manila is launched.
[ManilaToday](34156): ### Launching manila ###
23:20:09 [DISP] DrvEscape::HTC_SET_3D_LAUNCHING_FLAG.
I'm not sure what HTC_SET_3D_LAUNCHING_FLAG is.
The next step would be to make an android app and trace down what the hell the libgles_qcom driver is actually doing to see if it is working properly. If you load up ahi2dati.dll on winmo you can actually use the functions to show crap on the screen so i'm hoping the same can be done on android.
Not sure what else can be done at this stage.
[ACL] said:
Phh recommended to trace down mem locations used by wince and that has been done but it still refuses to fire up once pmem.c is modified.
Recently i got the wince dmesg from my rhod in hopes that a cold boot would show as to how the 3d is being activated but that also showed no results. I get this crap when Manila is launched.
[ManilaToday](34156): ### Launching manila ###
23:20:09 [DISP] DrvEscape::HTC_SET_3D_LAUNCHING_FLAG.
I'm not sure what HTC_SET_3D_LAUNCHING_FLAG is.
The next step would be to make an android app and trace down what the hell the libgles_qcom driver is actually doing to see if it is working properly. If you load up ahi2dati.dll on winmo you can actually use the functions to show crap on the screen so i'm hoping the same can be done on android.
Not sure what else can be done at this stage.
Click to expand...
Click to collapse
Ok, i would love to help out as i have never rly done anything like this b4. What exactly are you doing. How do you get HTC_SET_3D_LAUNCHING_FLAG?
How would i open a .dll, i dont think these can just be opened up to see what they are doing. I am on the dark side of the moon here. I know whats going on, but have no clue what to do to help.
garage_man said:
Ok, i would love to help out as i have never rly done anything like this b4. What exactly are you doing. How do you get HTC_SET_3D_LAUNCHING_FLAG?
How would i open a .dll, i dont think these can just be opened up to see what they are doing. I am on the dark side of the moon here. I know whats going on, but have no clue what to do to help.
Click to expand...
Click to collapse
I actually found HTC_SET_3D_LAUNCHING_FLAG on the wince dmesg. You can do this by doing a pwf dump.txt 0x16a00000 0xFFFF0 in haret. I did it after a cold boot to see if anything is done to the gpu once wince boots.
Loading the dll is easy. just make a simple win32 app and do a loadlibrary. This part works but it's not helping on android. I'm interested to see what mcdull thinks since i think he has ventured a lot into this as well. Right now if we can make a simple app in android to load the libgles_qcom.so directly and trace every step, i think that would be helpful to see where we are failing. I'm close to giving up..lol i already took 2 sick days from work to get to where i am now so i could use some help.
Here is what i got out of the chip in wince.
name: ATI HandHeld Interface
versions: 2.07.05110.34681
Revision: 0
ChipID: 1362104322
revisionid: 0
TotalMemory: 15990784
BusInterfacemode: 2
InternalmemSize: 262144
ExternalMemSize: 0
Surface info: 800x480
surface total bytes 768000
dwFrameBufferPhysical=0x14c00780 m_dwFrameBufferVirtual=0x57e00000 dwFrameBufSize=0xbb800
Most people here could probably not help with the hardcore kernel dev stuff, but I guess if you need memory locations or so (be it for opengl/sound etc) I think there a a LOT of people that are willing to run some apps that dump a txt file with debugging info & mem locations to their SD-card and send you that
I would love to help with developing, even if it means that I have to boot into winmo and android all night long and gather certain information, memory-adresses, try different versions of programs with all kinds of parameters etc.
Star-Lite said:
Most people here could probably not help with the hardcore kernel dev stuff, but I guess if you need memory locations or so (be it for opengl/sound etc) I think there a a LOT of people that are willing to run some apps that dump a txt file with debugging info & mem locations to their SD-card and send you that
I would love to help with developing, even if it means that I have to boot into winmo and android all night long and gather certain information, memory-adresses, try different versions of programs with all kinds of parameters etc.
Click to expand...
Click to collapse
We need more devs in general. I ran a trace on a basic app that runs 3d. So there is still a lot of crap to examine.
I'm willing to kill my touch pro 2 and remove the CPU to trace the JTAG locations but I only have the datasheet from the MSM7200/7500, not sure if it will be the same locations. I bet if I hooked up my Segger I could see exactly what is failing on the OpenGL and sound side since alot of hardware debugging is done this way...just sucks I dont know for sure if the pinouts are the same. I'm done it on quite a few different phones and boards over the years so its not a big deal. Omap3430 was simple to trace and the OMAP3530 had the exact pinouts.
BinaryDroid said:
I'm willing to kill my touch pro 2 and remove the CPU to trace the JTAG locations but I only have the datasheet from the MSM7200/7500, not sure if it will be the same locations. I bet if I hooked up my Segger I could see exactly what is failing on the OpenGL and sound side since alot of hardware debugging is done this way...just sucks I dont know for sure if the pinouts are the same. I'm done it on quite a few different phones and boards over the years so its not a big deal. Omap3430 was simple to trace and the OMAP3530 had the exact pinouts.
Click to expand...
Click to collapse
Sounds crazy.. i love it.
I was messing around today and made a small app to load the libgles_qcom.so directly to see if i can replicate my winmo success. Most of the ahi functions are included in the android driver as well except for AhiDispSurfGet which made it impossible for me to draw anything on screen.
The chip did pump out the same info as i posted before and it matches so thats a step in the right direction. Means we can recognize the chip with no problems and all 15.25 memory is reporting as well. If i had more documentation on those functions exported im sure i can get the chip to try to display something directly.
Interesting bit of info I read and perhaps someone can clarify this here. The Sprint Touch Pro 2 uses the Qualcomm MSM7600 processor. The AT&T Tilt2 (GSM phone) uses the MSM7201A processor. The "A" refers to the smaller 65nm die size (I believe).
From what I've read, some changes occurred on the MSM7200 -> MSM7201 due to patent infringements. The next question is, is the MSM7201A and MSM7600 essentially the same chip, just different hardware for CDMA/GSM?
I guess the "libgles_qcom.so" library is used in many other HTC Android phones, but for some reason it's failing on the touchpro2/tilt2, and we're not sure why (although logically it sounds like the library should work as it's used by other android phones with the same chipset)? I'm no kernel dev (I write .NET/c# apps which are much easier than kernel stuff), but am somewhat familiar w/ linux and perhaps can assist in development..
NewbTrader said:
Interesting bit of info I read and perhaps someone can clarify this here. The Sprint Touch Pro 2 uses the Qualcomm MSM7600 processor. The AT&T Tilt2 (GSM phone) uses the MSM7201A processor. The "A" refers to the smaller 65nm die size (I believe).
From what I've read, some changes occurred on the MSM7200 -> MSM7201 due to patent infringements. The next question is, is the MSM7201A and MSM7600 essentially the same chip, just different hardware for CDMA/GSM?
I guess the "libgles_qcom.so" library is used in many other HTC Android phones, but for some reason it's failing on the touchpro2/tilt2, and we're not sure why (although logically it sounds like the library should work as it's used by other android phones with the same chipset)? I'm no kernel dev (I write .NET/c# apps which are much easier than kernel stuff), but am somewhat familiar w/ linux and perhaps can assist in development..
Click to expand...
Click to collapse
learn haret/haretconsole and take a look a the kernel. good place to start. Feel free to come into the irc board if you have any questions
Related
Hey developers,
Believe me, I tried searching quite a lot but couldn't find an answer, never tried this kind of developing ever.
Let's say that my point is to disable part of screen - eg below 400px will not work - my app will catch those mouse events and stop them.
I tried speaking with Chainfire on IRC but he went for gaming or so and he offered me injecting dll's. I'm not sure if that would be the best idea since I'd prefer to do it on background rather than loading it with all apps.
I was thinking another few minutes and how about loading it as driver or some kind of touchscreen filter and running inside device.exe or any other kernel process (or just as background process, doesn't matter those few kB in memory).
Thanks for any push in any way of doing this, believe me, you won't regret the result . OndraSter
Not sure this is possible with the Win32 HWnd stuff, you can catch and handle Window Messages only within the Window said messages are posted to. Never seen a way to do it system wide. Would probably involve replacing some fairly fundamental components. Same sort of thing we are looking at to get multi-touch working correctly on the HD2.
I heard someone got it working with keyboard, but mouse not because of lack LL_MOUSE stuff etc
maybe develop a driver, like i.e. Touch response does.
Yep that was one of two things that came to my mind - driver or service...
But I have no idea where to start with it though...
[SINGULARITY] -
Singularity
Singularity (and the language of such Sing#) is a Microsoft operating system currently on codeplex as RDK 2.0 which is now core to this project - getting Sing# and Singularity to run on ARM (hd2) then can easily boot NT or anything and everything - essentially, NT will happen, but is irrelevant, as need to here first give MAGLDR an d HD2 ability to run Common Language Runtime AND Singularity (.ARM ver of .X86) -
GOAL= make ARM Singularity Kernel run on HD2 then run apps using this core as native apps or strap out onto whatever...
See update on last page of this thread.
ntonhd2 said:
Cotulla: repsonse to your question along with basic test build, just for compile practice run (check for errors), was succesfull; this is for ARM low level bootloader (ARMLDR ) which runs on ARM (hd2, ultimately here) and then grabs LDR (ntldr) then all other files (see my reply) then NTOSKRNL.EXE -> its attached for you to download on next page - thanks again for your input .
NT on ARM:
http://www.microsoft.com/presspass/press/2011/jan11/01-05SOCsupport.mspx
http://www.microsoft.com/Presspass/Features/2011/jan11/01-05SinofskySOC.mspx
http://www.bloomberg.com/news/2010-...ion-of-windows-for-arm-chips-at-ces-show.html
http://thecoffeedesk.com/news/index.php/2009/04/23/net-could-be-key-in-windows-on-arm-netbooks/
http://www.osnews.com/story/24165/Windows_NT_on_ARM_It_s_a_Server_Thing
Please also read my last post regarding Xbox running NT.
And understand I AM TALKING ABOUT NTOSKRNL with Native CLI and not running full WindowsXP or 7 or watever! .
hi xda, put this in hd2 general as could be relevant to linux or wp7 or hd2. Thinking of starting project here of pretty grand scale if people are interested. Now that a lot of work has already been done i think it will not be as hard as it may appear or sound at first.
I am thinking about using new wp7 bldr +- oal +- nk.exe to set up emulation of bios expected on pc then trying to jump to 2003 server equiv ntoskrnl.exe. (and then probably just a native command line interface like alex ionescu tinykrnl project back in the day, a ncli for nt with usb keyboard and not much more to start with: Further dev much later).
Nk will handle underlying lack of pci, bios, ints, and addresses, (+is firmware) but actual switching to nt kernel is for real after that: To build a strapping kernel with ce7/wp7 architecture and initial drivers that goes on to then launch full nt kernel.
Yeah - i have \nt\private\ntos\ source code and no it is not the normal nt4 or other w2k leak- it is a complete and buildable kernel; pm me and i will give proof, or the code if you can build and want to work on this. This is not x86/x64 work obviously so is not for those without ability: Need to do some heavy lifting to get recompile build happening for arm, qualcomm ' snapdragon nt :d. Otherwise is only emulation and not a good idea. This is 2be real. As non-x86/x64 support for nt (nt4 did ppc, mips, and now ia64) this kinda porting is not a foreign concept: There is sufficient info out there with reference to everything from softpc.new (inside ms code) to wow64cpu.dll and other x86/x64 specific init routines, spinlock and interrupt handling, asm code samps, bochs methods, qemu methods, et.al. Which can be used in one way or another or taken over if required: If all taken into account to paint big picture: Use of emulation technology methods for non-emulation project just opens up underlying logic. That is it. This is also why i suggest using wp7/ce7 base 4 init. Do not want emulation. Real deal here only. I refer to all these items above as observations which could be taken into account if need be: From tinykrnl, reactos, bochs, wine, efi, and other such things can make porting over kernel easier: At the end of the day, ce7/wp7 ' bldr, oal, nk.exe (or whatever derivatives thereof) will be 'firmware' in big picture. Another reason i am considering wp7 as base to strap is drivers are there to make a ce+bios or efi-type (?) pre-loader that takes all ce7 initialization further and passes on to nt (nk.exe runs including all setup as would be done by ntldr, a fake or psuedo-real ntdetect.com, system.hiv then passes data structs to our ntoskrnl.exe) and do all that needs be done. I can handle pc side completely but need bit of help with someone who gets nkglobal and other structures and use of platform builder with experience prefered in creation of new bsp. Maybe other ways - instead of ce, ie- grub, linux, openbios, openefi, but either way just want to prove it could be done is all.
Click to expand...
Click to collapse
anybody here capable?
to quote Da_G:
Yup, RustyGrom pretty much has it covered. First, it's called "CE" for Compact Edition, and this is not a misnomer in any way. The system is designed to be as compact as possible (There are build-time switches for everything, so you can toggle off nearly all the components to acheive a very "light" image) obviously, including drivers for components not present would be a waste of space, as they would never get used. So there are none included. On the PC side of things the BIOS provides a basic level of functionality using a standard interface so generic drivers are created to bring the platform up to that level, and from there vendor-specific drivers can be loaded.
If you want to put an embedded device in terms of a desktop computer and loading Windows 7 on it, you start out with a fully assembled computer (video card, motherboard, cpu, ram, etc.) - power it on. It loads up the BIOS which initializes the basic hardware and begins to load the rest from the hard drive. The embedded device loads up the NAND XLDR, which provides only flash read/write support. The XLDR then loads the "EBOOT" or "IPL" into ram on typical devices. HTC doesn't use the EBOOT/IPL model as such (here already we're breaking away from the "standard" even further) and instead has that split out into mARM AMSS (a custom designed RtOS that loads and runs the Modem ARM CPU) and SPL. Once the AMSS loads the SPL into ram and executes it, the SPL initializes the aARM (apps ARM CPU), does various checks (are we in update mode? do we need to expose a flash interface to update the rest of the OS? do we just boot up the os and move aside?)
Then finally you get past the highly device-specific code and on to the (slightly) more generic CE Kernel/drivers which get copied into ram by the SPL and executed (Native Kernel/XIP partition)
So, how different is CE7/WP7 from that model? (Which is the model we have now in CE5.x/WM6.x) - The mARM AMSS provides a different interface and initialization proceedure. That means any of the WP7 drivers from a donor device we might port from would not work at all with our current AMSS. Which in turn means no boot without re-writing the drivers/kernel or AMSS.
So to compare it to a desktop PC once again, we need to write a BIOS, a Hardware Abstraction Layer, and a set of drivers for each component on the system (likely a good deal of the drivers would be usable once the rest is done)
Do I sound jaded yet? Yes, yes I am It's probably a factor of 10 more complicated than I thought it would be initially.
Here's the JTAG pinouts that need to be connected, btw. There are pins on both sides of the motherboard which also is truely a pain in my ****, as i originally intended to mount an external port on the HD2 so I could easily keep a JTAG connection with it, but you basically have to remove the entire motherboard to maintain a reliable connection, which really precludes running it on a live device.
Click to expand...
Click to collapse
JTAG working now .
Ummm expect to hear from Microsoft lawyers in 5....4....3....
RustyGrom said:
Ummm expect to hear from Microsoft lawyers in 5....4....3....
Click to expand...
Click to collapse
Yeah i would be in breach of the non-disclosure-agreement i signed so removed.
But i am in inner city cbd wifi hotspot area and jump around unsecured cafe signals and other businesses and also use proxy servers and..... on top of that..... my own added tweaks for safe measure!
so, cafe+wifi+proxy, +other_anon, means there is absolutely no chance.
RustyGrom said:
Ummm expect to hear from Microsoft lawyers in 5....4....3....
Click to expand...
Click to collapse
reading your stuff on ce7. is this a bad idea you think? or not possible? no interest? i think it can be done.
ntonhd2 said:
reading your stuff on ce7. is this a bad idea you think? or not possible? no interest? i think it can be done.
Click to expand...
Click to collapse
I just don't think it's possible or worth it to bother trying to port NT to ARM while Microsoft is doing the same already. You're not going to be able to put together the team required meanwhile hiding from MS. It's just a stupid idea imo and really has no benefit. I mean what's your end goal here? To run Win7 on our devices?
Judging from this and other posts you have made, I suspect the most "source" you have is the "Windows Research Kernel", which is the source for a portion of ntoskrnl.exe from Server 2003 SP1, approximately. That would be no-where near enough, and it's not even enough to compile "just a kernel". It actually has a number of pre-compiled parts that it just pulls in.
Not to mention such a project is just asking to get shot down in a legal firefight. The WRK is given to academic institutions for studying the world's most popular desktop kernel, and is done so under a strict NDA.
ntoskrnl.exe by itself isn't enough to produce a workable OS anyway, especially one from the Server 2003 era.
hounsell said:
Judging from this and other posts you have made, I suspect the most "source" you have is the "Windows Research Kernel", which is the source for a portion of ntoskrnl.exe from Server 2003 SP1, approximately. That would be no-where near enough, and it's not even enough to compile "just a kernel". It actually has a number of pre-compiled parts that it just pulls in.
Not to mention such a project is just asking to get shot down in a legal firefight. The WRK is given to academic institutions for studying the world's most popular desktop kernel, and is done so under a strict NDA.
ntoskrnl.exe by itself isn't enough to produce a workable OS anyway, especially one from the Server 2003 era.
Click to expand...
Click to collapse
Sigh.. why don't people read before they make these ridiculous and thoughtless posts? Realize that there are people from Microsoft ON these threads. Also, RESEARCH IN DEPTH BEFORE POSTING SUCH A THREAD.
snickler said:
Sigh.. why don't people read before they make these ridiculous and thoughtless posts? Realize that there are people from Microsoft ON these threads. Also, RESEARCH IN DEPTH BEFORE POSTING SUCH A THREAD.
Click to expand...
Click to collapse
There are more microsoft people on xda than most realize .
RustyGrom said:
I just don't think it's possible or worth it to bother trying to port NT to ARM while Microsoft is doing the same already. You're not going to be able to put together the team required meanwhile hiding from MS. It's just a stupid idea imo and really has no benefit. I mean what's your end goal here? To run Win7 on our devices?
Click to expand...
Click to collapse
sure, sourcecode factor (nda) and secrecy/MS are complexities: but not as hard as people think here: it is TWO COMPLETELY DIFFERENT THINGS TO TRY AND GET WINDOWS7-ON-ARM to what I suggested (NT-CONCEPT-ON-ARM-WITH-Native-CLI) and no I would not use WRK sourcecode (lol) as part of my daywork i have access to (not ce) full sourcecode.
see my last post here,
can be done .
hounsell said:
Judging from this and other posts you have made, I suspect the most "source" you have is the "Windows Research Kernel", which is the source for a portion of ntoskrnl.exe from Server 2003 SP1, approximately. That would be no-where near enough, and it's not even enough to compile "just a kernel". It actually has a number of pre-compiled parts that it just pulls in.
Not to mention such a project is just asking to get shot down in a legal firefight. The WRK is given to academic institutions for studying the world's most popular desktop kernel, and is done so under a strict NDA.
ntoskrnl.exe by itself isn't enough to produce a workable OS anyway, especially one from the Server 2003 era.
Click to expand...
Click to collapse
What does this statement really mean?
might be a bad idea on hd2, fine, accepted, but your comment at the end doesn't make sense to me. so, ntoskrnl.exe for wp7 or nt4 (another era than 2003 .net) would make a difference? that is silly. besides, i made it clear that a psuedo-firmware setup would be required to setup the datastructures that NTLDR would prepare (along with NTDETECT.COM, and bios+pci_bus+ACPI interaction, (plus system or setupreg.hiv)), etc: so what are you saying exactly? my point was to not run any win32 or win64 gui or subsystem. never even mention win32k, gdi, etc. I was very clearly talking about native cli (ntdll.dll) and a prompt- maybe usb keyboard- as ARM NT Conceptual. Please, enlighten me . PS> yeah, I know the wrk and am fully aware of \prebuilt\ libraries and obj code: but, no, I was not intending on using this as base. I admit, hd2 nt prob bad idea: btw was ARM NT concept more than anything! and yeah, with the secrecy and legal issues it would be too complex and overwhelming to do so, accepted, but if I were truly to do this NO i would not use WRK lol .
And regarding Microsoft, yes, I accept that there are a LOT of employees on xda and it is crawled and watched for obvious reasons: covered that.
PPS> re WRK, no, would (if i were to try doing this that is) use what I already have access to as part of my work> under full NDA I have full source to a few different bases including all of 2003 and even HyperVServer and AzureOS trees. .
unfortunately I do not have windows phone 7 code access though! Thanks.
RustyGrom said:
I just don't think it's possible or worth it to bother trying to port NT to ARM while Microsoft is doing the same already. You're not going to be able to put together the team required meanwhile hiding from MS. It's just a stupid idea imo and really has no benefit. I mean what's your end goal here? To run Win7 on our devices?
Click to expand...
Click to collapse
Yep...... but there is a LOT of portability in the original nt4 and even w2k trees with alpha, mips, ppc, os2+posix, original softpc.new+ntvdm, and even newer, that would let this be done a lot easier than most realize: remember here that:
I AM NOT SAYING LETS RUN WIN32 ON OUR HD2: I AM SAYING LETS TRY RUN NTOSKRNL ON ARM.
big difference guys.
RustyGrom, I assume your talking about ARM-Cortex etc (msnt-2-arm)..... THIS is what i wanted to do but a much more lightweight and ms-testing-protocol-free-process; homebrew version in experimental state would ensure much speedier development: it is not that hard a concept to attempt to port over an earlier (nt4 or w2k) kernel FIRST then look at better (2003 & 7) memory management etc: the point here is PROOF OF CONCEPT NT ON ARM: that is it, like what you refer to. Read my first post: any remember tinykrnl.org? Alex Ionescu ? Reactos? it could be done a LOT easier than you all think!
only NT on ARM official stuff i am aware of is this (rumour/talk/concept/theory/design atm):
http://www.microsoft.com/Presspass/Features/2011/jan11/01-05SinofskySOC.mspx
http://thecoffeedesk.com/news/index.php/2009/04/23/net-could-be-key-in-windows-on-arm-netbooks/
http://www.osnews.com/story/24165/Windows_NT_on_ARM_It_s_a_Server_Thing
If you know NT like i do- then you would see it could readily be done but yes, I admit I do not know enoug about 'phones'/ce-platform. That's why I started THIS THREAD HERE: to get some thought on the subject is all .
what then would be major problems to overcome then and this is assuming concept of say:
0). hd2 power on
1). ipl/equiv
2). hspl.
3). magldr
4). dft leo70 rom
5). bsp/oal, bldr/uldr, OS.NB ->(NK.EXE).
6). remap, reinit, load and place (prep) data structures expected by ntoskrnl.exe (osloader, detect, pci, bios, etc).
7). jump to ntoskrnl.exe
?
For the record, a few years ago i did this exact thing: ported nt kernel over to another platform. myself and others re-wrote ntoskrnl.exe (+hal+drivers) and integrated osloader.exe(ntldr), and all data structures as would be passed to kernel from ntldr, registry system hiv, ntdetect, missing bios, missing interrupt+dma+pci-bus+acpi+power, etc into one (debug/xdk) single DEFAULT.XBE.
it only worked on XDK debug kit xbox consoles with serial+scsi+128mbRAM (and a custom lpc debug mod) but it worked. using code from intel and tianocore EFI/UEFI toolkits (and bits and pieces from here and there) and concepts such as PALcode as used by non-x86 osloader (.exe not ntldr) for simulacrum bios/firmware you can pass a predefined set of structures to ntoskrnl and ensure processor regs etc ARE ALL GOOD AND SYSTEM IS READY then call into KiSystemStartup, ExpInitializeExecutive, and begin modified phase0 of NTOSKRNL.EXE.
similar thing was done with CE.NET for Xbox - a default.xbe with linux code b4 NK.NB0
worked and works .
anyway, how u wanna solve the next problems?
1)missing CL compiler for ARM with same set of features like CL for X86.
(CL version for ARM for WCE doesn't have all features supported and usually outdated)
2)this ARM compiler store exception info in other format (not SEH frames, but universal table for functions ".pdata")
3)which files u exactly wanna build for ARM? is it "ntoskrnl.exe bootvid.dll hal.dll"?
4)which final results u gotta got?
5)why u need touch WP7? u can just look to example code in Android kernel and implement something. so replace PC standard timer realization inside HAL.dll with QSD8250 specific timer code. it's much better to start.
how many ppl u have in ur team?
Cotulla said:
anyway, how u wanna solve the next problems?
1)missing CL compiler for ARM with same set of features like CL for X86.
(CL version for ARM for WCE doesn't have all features supported and usually outdated)
2)this ARM compiler store exception info in other format (not SEH frames, but universal table for functions ".pdata")
3)which files u exactly wanna build for ARM? is it "ntoskrnl.exe bootvid.dll hal.dll"?
4)which final results u gotta got?
5)why u need touch WP7? u can just look to example code in Android kernel and implement something. so replace PC standard timer realization inside HAL.dll with QSD8250 specific timer code. it's much better to start.
how many ppl u have in ur team?
Click to expand...
Click to collapse
************************************************************
update: Attached is ARM low level bootloader just built; this could be used to load LDR and then ntoskrnl.exe .
************************************************************
Please let me know your thoughts and please try to get this to run with debug if you can and pass results & thoughts back to me - Cheers. Hopefully it built ok. What do you think of using this method then? but with FULL & PROPER NTOSKRNL.EXE!
************************************************************
Hi Cotulla, thanks for your reply: appreciate it here.
[also much thanks for hspl, magldr, dft android, leo70ROM. .]
ok, sorry if this is a bit all over the place, i have cut and pasted my answers around to try clean it up but it is late and i think my brain is a bit dead sorry, but answers are here anyway . hope makes sense. firstly please have a look at this video and let me know what you think .
http://www.youtube.com/watch?v=RFNuY2OFRjU
that is ARM..... i am going through build environment and sourcecode now..... thoughts?
http://www.youtube.com/watch?v=n3v4YC9RT-g&feature=related
can learn a lot from wine. i agree with you on linux. same for virtualization, emulation, etc, like bochs qemu everything . sandboxing and hypervisor unveils a LOT . another thing i wanted to ask you was what do you think of FPGA technology for reverse engineering unknown systems? for example, if i were to start almost any project, like say leo70DFTrelease, or NT on Xbox, or whatever, doesnt matter, i think it is worth spending the time or money (for private company to do it for you) and have an FPGA version of the target device being hacked (hd2 in leo70rom case) and then undo the software problems from a hardware logic perspective. just the way i have worked on things many times and it works for me anyway. but I digress.......... . if i were to have done wp7hd2 (leo70rom) and magldr, then i would have had to have had (for me, not as good a dev as you) a FPGA based HD2 made up that ran in every way same but with which i could get right in there and do whatever i needed to do to see response& debug. let me know what you reckon... ok... digress now :
1)missing CL compiler for ARM with same set of features like CL for X86.
(CL version for ARM for WCE doesn't have all features supported and usually outdated)
what features specifically we need here?
what about tweaking this:
http://reactos.colinfinck.de/files/RosBE-Windows/RosBE-ARM-1.0.exe
2)this ARM compiler store exception info in other format (not SEH frames, but universal table for functions ".pdata")
http://www.reactos.org/wiki/PSEH
http://www.reactos.org/forum/viewtopic.php?f=9&t=5716
reading up on _IMAGE_CE_RUNTIME_FUNCTION_ENTRY. just going over stacks and frames and overall exception handling on ARM. are there any issues with reverse execute, virtual unwind? for this type of execution- how would you handle?
more to the point- how would you do this project lol.
problems with prolog/epi? what about moving over x86 asm code? i am right now typing this to you whilst getting updated on specifics on registerslooking at emulators to see this in action. i am reading these here. let me know if on right path and please put up links to whatev will make this project concept a reality . Cheers .
see here
http://www.cl.cam.ac.uk/~mwd24/phd/swarm.html
http://gcc.gnu.org/onlinedocs/gcc/ARM-Options.html
http://www.codeproject.com/KB/threads/StackWalker.aspx?msg=2818356
can you recommend any compiler, emulator, os, setup, even equipment (JTAG etc etc) i should use, buy, try?
3)which files u exactly wanna build for ARM? is it "ntoskrnl.exe bootvid.dll hal.dll"?
depends on method: i agree (see below) that probably android or (htc-)linux is probably more likely to work but leo70_rom made me think maybe jump from (touch wp7) nk.exe? and are you saying use linux as in LinuxBios type setup?
would need emulated bios, pci bus fixed up (?), QSD timer HAL, ACPI (?), etc ,,, so probably would end up with the following:
a) BIOS (ce7 exe or linux ?): options here could be to make NT think it is running on PALcode, uEFI, or standard ACPI BIOS (your thoughts?). I think uEFI (tianocore/Intel) is best bet here perhaps. this would include MBR code (efi equiv or pal equiv depending) and any psuedo-real or "real" initialization i think.
b) mbr execution merged to and included in above, bootsect. in sim' 'firmware'.
c) $LDR$ @ OSLOADER.EXE (osloader.exe is non-x86 ntldr as im sure you know WITHOUT the code to run ntdetect.com and acts in PALcode architecture to pass on predefined data structues from firmware: tells NTOSKRNL.EXE where and what 2 execute).
d) HAL.DLL (timer, power/acpi, spinlocks, interrupts). another reason i leant towards WP7 as pre-NT launcher is because i assumed that something like BSP, OAL, etc, could be maybe used as base: if not for code, then logical base. what base(s) did you use to create WP7 if i may ask? ie: CE7? I have just installed Platform-Builder. but yeah, i here you regarding android/linux kernel example: ultimately are you saying better, easier, more logical, to go with android/linux you think Cotulla?
e) BOOTVID.DLL
f) KDCOM.DLL (if wp7 would make use of KITL?)
g) drivers as required including the following: ntbootdd.sys (?) might allow easier diversion from bios lack of INT13 and other support: remap to whatever can handle this properly. equivalents for ACPI.sys, filesystem drivers, other power, basics. how should i be looking at things from NT side of things, as in \ObjectTypes like \??, \Global?? etc .... and items like ROOT device in ARM (either CE or linux preloaded) context? any thoughts on how object manager would need to be brought up? for me, now, that is where it gets crucial and is core.
h)SMSS.EXE (NATIVE.EXE) but to begin with could just get drivers and all that working first and strap up into cmdcons (SPCMDCON.SYS). just blue-screen SMSS (windows setup) enough to prove kernel to run on ARM cpu. your thoughts?
i) SYSTEM reg key hive (setupreg.hiv etc?)
...
4)which final results u gotta got?
Tinykrnl type native CLI.
http://www.betaarchive.co.uk/imageupload/1193217573.or.99024.jpg
with USB keyboard support like htc-linux then go from there..... would love a prompt from which could just call any given call - be it CreateProcess or NtCreateProcess or ANYTHING: and it just does it (with debug/KITL) without question . but native NT command line is good for now. not going near win32.
5)why u need touch WP7? u can just look to example code in Android kernel and implement something. so replace PC standard timer realization inside HAL.dll with QSD8250 specific timer code. it's much better to start.
yeah....
I thought linux probably would end up being better: just liked symmetry of windowsCEx-strapping-windowsNTx: making a windowsCE-EFI/BIOS: but yeah, something like LinuxBios (android kernel etc) would be a lot easier in the end yeah? All this is overly simplified and very conceptual but there are basic answers. . once a solid idea has been formed then this could actually be done i think. and before Microsoft . Do you believe Reactos-ARM-build environment could be used? Am i missing anything? 9 people team+myself (+any help you can offer) would make 10 (+1). I think this is a good idea to at least try and i believe with your assistance, guidance, well, it would get done and then complete the HD2 line up fully. . In conclusion, right now, I need ARM emulator software, platform builder, and fully working Compact Edition 7 on HD2 to get some more thoughts and try few things out in platform builder debug then can get final decision, design, plan and start to get everything working. Even though will probably go with Linux/Android obviously as above, I still need 2see init on CE7 on HD2 and be able 2use this along with whatever else we can! have a look at all above links... thanks.
Cotulla, thanks again 4reply>please PM [email protected] something but not posting..... await your PM.
what about this ( http://research.microsoft.com/en-us/projects/singularity/ ) could be of use to NT port with respect to CLR ? haha, or just outright hd2 port Microsoft RDK OS ' singularity ' ? .
************************************************************
update: Attached is ARM low level bootloader just built; this could be used to load LDR and then ntoskrnl.exe .
************************************************************
Please let me know your thoughts and please try to get this to run with debug if you can and pass results & thoughts back to me - Cheers. Hopefully it built ok. What do you think of using this method then? but with FULL & PROPER NTOSKRNL.EXE!
************************************************************
I don't have big knowledge of Windows NT system, but I think it's must be enough to provide basic stuffs for kernel start up.
I guess NT using only int13 services for reading data from disk, int15 services used to detect memory configuration and int10 for initial boot mode.
Because it's embedded hardware, the devices in the system are fixed and limited. So it's enough to provide fixed values for kernel, like available ram memory range.
No need of using any complex systems with CE / Linux.
About CE, you can get almost full kernel sources in PB6.0, trial can be downloaded from MS site.
afaik it's enough to load kernel and dependent modules (drivers) to ram and then run them. after this action kernel drivers should able to run properly on hardware.
About Reactos, I appreciate work of involved people, but I doubt that it's stable
About this project, I don't know yet if I will contribute. I am looking how much it's interesting for me
I always have interesting different things in my hobby as well, so I have choose that to do As well, me is part of DFT team, I need discuss it with them
Now I am asking you to understand more details about your idea(s)
Cotulla said:
I don't have big knowledge of Windows NT system, but I think it's must be enough to provide basic stuffs for kernel start up.
I guess NT using only int13 services for reading data from disk, int15 services used to detect memory configuration and int10 for initial boot mode.
Because it's embedded hardware, the devices in the system are fixed and limited. So it's enough to provide fixed values for kernel, like available ram memory range.
No need of using any complex systems with CE / Linux.
About CE, you can get almost full kernel sources in PB6.0, trial can be downloaded from MS site.
afaik it's enough to load kernel and dependent modules (drivers) to ram and then run them. after this action kernel drivers should able to run properly on hardware.
About Reactos, I appreciate work of involved people, but I doubt that it's stable
About this project, I don't know yet if I will contribute. I am looking how much it's interesting for me
I always have interesting different things in my hobby as well, so I have choose that to do As well, me is part of DFT team, I need discuss it with them
Now I am asking you to understand more details about your idea(s)
Click to expand...
Click to collapse
sure....... . anything ReactOS -freeldr, any arm code, whatever, is just to get basic idea up- to see the actual jump whilst watching (be it by jtag, kitl, usb, or telepathy interface to QD) and go from there; although im sure you could use ReactOS arm code lowlevel bootloader to jump into EITHER "freeldr" or proper "ntldr" or "osloader.exe" (modified of course to have no pci bus scan and the rest.....) that is the dilemma: either jump COMPLETELY like winmo6-android with all structures setup DIRECTLY INTO KERNEL and avoid the whole LDR side of things in that sense anyway; or, well, totally from scratch rebuild loader and subsequently deal with 'firmware' issues... i really do not care in the end if its a jump from one kernel to another (one os to another) because project here is to RUN NT ON ARM/HD2 and not to necessarily have it homogenous down to LDR.
as long as thread, memory, native api, other calls, all that, is truly ntoskrnl = you are running nt on your arm hd2! .
LDR does not matter.... total new rebuild or jump.... whatever comes first .
Thanks Cotulla, yes, we understand where your coming from re do not need linux, ce, and complexities there and i agree: just want to use these for initial testing and deployment of early code with some kitl, debug.... on other notes, trying to put all into organized groups, slowly but surely yes, with bit of faith we will get there in the end .
if totally up to me i would probably take intel/tianocore EFI specification as the base if this could somehow be easily made to run on ARM in this particular context. ie EFI on a HD2!
look at this raw control power!>>> http://www.ami.com/support/doc/AMI_Debug_UEFI_Dsheet_PUB_2008-06-10.pdf
also along these lines, just briefly (is helpful in concept design):
http://x86asm.net/articles/uefi-hypervisors-winning-the-race-to-bare-metal/index.html
http://sourceforge.net/projects/gnu...orig.tar.gz/gnu-efi_3.0h.orig.tar.gz/download
http://x86asm.net/articles/introduction-to-uefi/
http://sourceforge.net/projects/efidevkit/
http://www.logic.nl/Products/Technology/BIOS-and-EFI.aspx
ok, summing up thoughts here>>>
0) object manager and objects; going over arm & ce7, as well as winmo6 and other ce, and comparing with nt and win32/64; just looking at how on final arm release, the \ObjectTypes will be different in the end. very interesting stuff.
1) LACK-OF. no pci bus which is highly expected by ldr/detect so make kernel prob see system in 'PALcode' or EFI mode. pass ldr data structs to kernel in that type of form. otherwise gets very messy and we are not going to hack around because you will end up with an emulator !. this will work but key is determing what 'firmware' passes this data to nt kernel - not from our perspective- but as NT.
2) BIOS. INT services are not used by kernel in that way after it becomes supervisor so will redo drivers unless preload remap somehow. INT only there during ntldr (or can load in ntbootdd.sys to supply these) and this is all pre-phase0 and is very early on.
3) HAL and clk
4) INT services are not used by kernel in that way after it becomes supervisor so will redo drivers unless preload remap somehow. INT only there during ntldr (or can load in ntbootdd.sys to supply these) and this is all pre-phase0 and is very early on.
5) kitl and kdcom
6) registry to pass on (setupreg).
8) filesystem, screen, other drivers
9) final native cli (ntdll.dll) or maybe initially just spcmdcon.sys.
above not in order ..... sorting it all out though .....
ok, looks daunting but like i said before you could get up an nt kernel in setup mode with setup ldr and drivers and old blue screen "dos" mode native subsystem which uses the SMSS.EXE and NTDLL.DLL that are seperately contained in \i386\system32\ or \cmdcons\system32\ - very limited subsystem but is full nt os at kernel . so........ if not ce and not linux preloading, WOW . it is quite an amazing project but doable; so basically just need to see how this armldr (low level strap - be it Reactos or my own clean job- will do both) code runs on the device itself and step by step add the rest in as required! but i still believe actual dev be better jumping from preexisting environment having kitl or some sort of serial or usb debug already there and then working way down to lowest possible level; so, basically, working backwards down to processor.
Doing it all from scratch and CLEAN . (in the end!). .
my brain just straight up exploded.
thanks a lot.
http://www.youtube.com/watch?v=xKc_XGuvNIk .
for the record:
so far without any errors have successfully been able to build the ntdll.dll, hal.dll, smss.exe, bootvid.dll, fastfat.sys, for ARM with no modifications at all, but not yet done a build on the LDR or NTOSKRNL.
just testing compiler here is all and not writing new: this is very early on and i have changed absolutely nothing.
once fill in gaps will give it a go on hd2.
attached.
About 2 weeks ago, I took johnkussack's advice (I think it was him) and went to LinkedIn to try t be friends with anyone who came up on the search for "kin phone". In the invite email, I just said that I noticed they worked on the Kin phones and would like to ask them a few questions on how one could write to the phone. I have had 3 responses in the last 2 days.
Guy1: didn't know because he worked on the UI for the Kin Studio
Guy2: kindly told me he couldn't release an unauthorized build and that he would be breaking the law by doing so.
Guy3: This guy worked on the phone for over a year. He first told me I was breaking the DCMA by hacking/reverse engineering Kin, regardless of intent. Then he said this important thing:
"You are absolutely right in assuming that the device is locked; in fact, it has a hardware lock that is common to many such devices. When the devices roll of the manufacturing line the programming fuses are blown (literally) preventing any further programming of the device. This is all handled by hardware so unless you find a flaw with that you are out of luck."
So if this is true (sounds like it is), the "dream" is over. Hopefully there is some way that someone out there can find.
If I get more responses, I will post them here. Don't ask me to go back to these three who already replied and asked them more questions, I think I made some of them mad.
Hmmmm... I don't know whether or not the KIN models will accept OTA updates so that's a good question to ask. If OTA updates are possible then it's inherently possible to change the software. I wonder...
Yes, it was me the one who said about "linkedin".
But i also said "in one word NDA". You should known even before ask that the signed NDA are also legal contracts, so i prevented before asking them.
On the DCMA, yes.. on the USA. Outside the big country, the legal question is different and may not operate with that law. (if ever). If they provide a normal (legal?) way to unbrick my factory mode here, or to use the phone options, then i wait for the cost for it.
And everyone knew that hardware was not the way, just at the moment where first flash attempt failed. "Dream" is doable by software, if anything is to be done.
What i don't get is why to ask for rom rom roooooms, where we need drivers drivers driveeeeers... or sdk's. We won't get it anyway from MS, but no flashing means a rom is futile, non useful,crap pack of bytes.
But i also said "in one word NDA". You should known even before ask that the signed NDA are also legal contracts, so i prevented before asking them.
Click to expand...
Click to collapse
I figured I just take a shot in the dark; hope for the best and expect the worst. Since the phone and suuport from MS was discontinued, maybe the NDAs would be voided.
And everyone knew that hardware was not the way, just at the moment where first flash attempt failed. "Dream" is doable by software, if anything is to be done.
Click to expand...
Click to collapse
Good to know you still think there's a way.
What i don't get is why to ask for rom rom roooooms, where we need drivers drivers driveeeeers... or sdk's. We won't get it anyway from MS, but no flashing means a rom is futile, non useful,crap pack of bytes.
Click to expand...
Click to collapse
I just asked if "there is a way to get around the write lock". Had I known ahead of time to ask about drivers or SDKs, I would have put that in the msg.
I strongly believe that we could operate with the device,softwarewise. there is proof that the kin NAND memory (for now on, called "Storage" as label) is writeable. Not sure on the Rom part.
Of course, i mean.. just use it as a normal writable storage memory.
I posted how it could be done and would do it myself but, again, i bricked my phone, and available ones (through bidding sites) are so expensive to buy another one just for this (+ $150). Don't see a way to get it internationally again.
And even doing it, i'm not sure about what could be done just writing on the storage mem....
If the fuse byte is burn't should not it have prevented you from bricking?
kintwouser said:
If the fuse byte is burn't should not it have prevented you from bricking?
Click to expand...
Click to collapse
Nvitem bricked, not flashing bricked. You can succesfully write to the NVItems memory. But i guess it's just configuration memory and not the one "fused".
I just want to mention that jailbreaking a phone is NOT illegal in the United States! Geohot hacked the iphone... Apple went after him... Apple lost.
Also blowing the programming fuses seems a little fishy to me actually. No other phone does that. The majority of other phones have been flashed. I just think it would be pretty odd for a company to do that so that they no longer could update it. I am not sure I believe him. If this really was true... then why wouldn't Apple or Sony be doing it? This also doesn't make sense since Microsoft actually originally intended on putting WP7 on this as well as allowing apps for it. Check this article out:
http://www.intomobile.com/2010/05/12/kin-windows-phone-7-a-lot-closer-than-we-thought/
you must understand, its not possible to blow fuses in the hardware, it would be a top news story if they were able to keep the OS running in complience with the flash memory without it crashing. Obviously that was a lie to discourage us, and i dont even think that was a real kin developer, because microsoft clearly stated that all kin developers would be moved to WP7 or another programming section. And it doesnt matter if its legal or not to jailbrake phones, if we are porting a new OS, we wouldnt have modified the original OS, which is what jailbraking means. Most likely the OS is hidden deep in the flash memory with a write - protection. If you think its saying access denied because they said the fuses were blown, its wrong. They must just have a password or code that needs to be sent continuasly to the phone to access files. If the fuses were blown, then nothing would be able to be accessed by zune, because it would be impossible to reach the memory.
soninja8 said:
Most likely the OS is hidden deep in the flash memory with a write - protection. If you think its saying access denied because they said the fuses were blown, its wrong. They must just have a password or code that needs to be sent continuasly to the phone to access files. If the fuses were blown, then nothing would be able to be accessed by zune, because it would be impossible to reach the memory.
Click to expand...
Click to collapse
Not my expertise field, but this mobiles can (and in fact they do) have several memories, storing the OS in the ROM memory and all the data on the NAND memory (our "8gb" storage).
Zune software has protocols to query for available storages (requiring its label/id) and is allowed to write/read to it. If you dare to click on update version (at least in the 1st version I tried) it expressed that the option was not "available" to that device without web requesting data, apparently.
So.. in the nand flash we may only have the equivalent of a SD Card. And my last wince PDA showed that as /Storage too, apart from main wince ROM.
You can format the nand memory using win explorer if in fact it is the 8gig storage. I did this and it deleted all pics,albums etc. It was interesting to note that we cannot copy or view these pics without an access error but it does let me delete them.
I just wan't to be able to get my pics off this piece of crap without emailing them.
I posted it once. You are able to:
- Query storage properties (label, size, id,...)
- Query storage folders
- Query folder files.
- Query tracks / albums / playlist / images / anyZuneSupportedFile
- Delete * file (whatever)
- Format the storage
You are "unable" to:
- Upload (create) a file into the device
- Download a file from the device.
MTP protocol tools allows you to do so, from command line (not quite sure if they are available on Win32 OS's), but... fails to operate with this device when it comes to the "unavailable" operations.
I am curious as to which former developers you contacted?
I was doing some research and noticed that Microsoft acquired the company Danger, Inc. After Microsoft purchased them, the former president of Danger went to develop Android (later acquired by Google). One thing I read was that most of Dangers employees left after being purchased by Microsoft. Apparently these people don't like Microsoft all that much! I also looked into it a little more and found one of the founders of Danger who had a twitter account. Of course all of his tweets were via a "KIN". Thought that was interesting. It seems to me that these former Danger employees would be interested in helping out if they don't hold to high of an esteem for the big "M".
seems like this is your first "inside the move" trying-to-hack/reverse a thing, so i will say:
people involved doesnt wanna risk through legal issues, even if they were pissed off, just for "some kids" to have a driver or rom. NDA are strong there, and they could either sign them or leave (if leaving, they don't have the interesting things).
At most you would get bad-mood or good-luck comments, and ocassionaly (very uncommon), leaks (wont happen here).
yeah, they purchased danger for an amazing 500 million dollars, which they later developed the kin with it, they were planning to put windows phone 7 on it, but they were to behind and released it with the old windows CE, then the former developer moved to work on a free source OS, later called android. Google wanted to get android while it was cheap, so they bought that company, and made the old developer as 2nd engineer.
Maybe not worth yet, but we should get more *info* about the SBL mode (aka "Ms Pink Bootstrap), as coinflipper said that it was the way to flash OS or parts (like radio's).
I have been trying even OMA wap WBXML bootstrap examples with it, but as we dont know if our phone is standard, it's like looking for a water drop in the sea of possibilities.
We do not need a guide on how to do something, but what-to-do with it.
Maybe, JUST MAYBE, we could design a program like bitpim. I am a mac user and when I used bitpim with my enV touch, I used to edit all sorts of files. Examples would be phone info, server info etc. We could make a program like that to get the info. I know programming may be hard, but its worth a shot. I hate the OS on this phone, ESPECIALLY WHEN YOU PIN APPS! THEY LOOK HORRIBLE
Kinuser1 said:
Maybe, JUST MAYBE, we could design a program like bitpim. I am a mac user and when I used bitpim with my enV touch, I used to edit all sorts of files.
Click to expand...
Click to collapse
We can't. If we have not the protocols or the supported phone features (protocols, drivers, documentation,...) you cannot guess it and put it into visual basic (or Xcode) and then by *magic*get the program you want.
i will admit that i know very little about protocols and drivers but i would like to point out that bitpim is open source, and that the code can be found here ->
http-//sourceforge.net/scm/?type=svn&group_id=75211 (change "-" to ":")
i seem to recall bitpim already having limited support for the kin, but perhaps with a little research and a little code tweaking we can find ways to improve it? i'm not sure how feasable it is as i have very little experience with programming for phones/usb devices, but it's just a thought.
slimeq said:
i will admit that i know very little about protocols and drivers but i would like to point out that bitpim is open source, and that the code can be found here ->
http-//sourceforge.net/scm/?type=svn&group_id=75211 (change "-" to ":")
i seem to recall bitpim already having limited support for the kin, but perhaps with a little research and a little code tweaking we can find ways to improve it? i'm not sure how feasable it is as i have very little experience with programming for phones/usb devices, but it's just a thought.
Click to expand...
Click to collapse
We can't. If we have not the protocols or the supported phone features (protocols, drivers, documentation,...) you cannot guess it and put it into visual basic (or Xcode) and then by *magic*get the program you want.
Click to expand...
Click to collapse
The above applies to any software you want. Unless you magically found documentation or files (like OP), there's no way to. So f#cked.
The thing is always the same, tweaking tweaking... what to tweak, huh?
Hey, i was playing a bit with some files here and there, so i faked Xna to believe that kin was a zune (i'm a ninja) and then becoming asleep when suddenly i launched the first non-official app on the kin.. although it didn't work.
It's the result of a bad deployment of a XNA game template, which runs till the loading part, where it's broken and does nothing.
On the other hand, it's listed on the recent apps tab, and i was able to re-do the deployment. I wasnt able to redo after some time, even rebooting the Kin.
Yup, i know it does nothing but... makes you wonder if working apps can be made and yak yak yak.
Fyi, i was able to reboot succesfully but the app must be in a temp space, cause it didnt showed anymore nor in recent apps, nor in the menu. Kino showed me that there were no further files, other than mines.
i thought that a video would show things that are real and ... well.. all. So it's attached.
I wont tell how it goes in the very end till i'm able to reproduce it, and also, cause i *cough* modified *cough* some file in my windows to do so (not distributing them, for legal reasons and so). In any case, i would just tell how to get the same file, through a process.
I h4ck3d this thing, now, where are my cookies? (just kidding)
Edit:
Disclaimer
Ha! Before doing anything, this is going to scr*w your XnaFramework 3.1 Zune capabilities, so.... backup first, backup first... did you backup?
Ha 2.0. This is you, doing it personally. If it's not legal there (?) i take no responsabilities from what you do. If you crash your windows/zune/kin... i won't pay it.
Procedure
- Install Visual studio 2008 c# express (or 2008 if you have it... legally and so on) for free from microsoft.
- Install the Xna framework 3.1 (I also installed 4.0 but... it's not going to work for other tests i wanna make... so.... i wouldnt do it)
- Install the Xna framework 3.1 zune extensions
- Install a hex editor ... my favourite is HxD but others, like ultraedit32 or... [insert other here] will work. Notepad is not a hex editor.
- Look for "XnatransZ.dll" under "c:\program files\common files\microsoft shared\xna" (or just common files will only have one or two inside). There are Am64 folders with it (64 bits) and X86 (32 bits), of course, you are going to edit the one you use and so....
- Backup... remember to backup... backup... man, do a backup. Then open the file
- Search for the following HEX pattern: 5a 00 75 00 6e 00 65 00 00 00
(which is "Z.u.n.e..."). Make sure that on the right side on HxD shows Zune alone and not "Z.u.n.e.D.e.v.i.c.e.", or so. Replace it (overwriting left side on Hxd) with: 4b 00 49 00 4e 00 00 00 00 00 (which is "K.I.N....")
- Save the file.
- Now use the xna device center to add a new device, and pick a Zune (yup, a zune). Kin will appear there if done correctly.
Explanation
Why this change? Well, seems like it's pretty much stupid things around.
First i thought that as there were only a few models of zune, the xna would have the PID and VID values for their devices.
Then through *magic process* i saw that it just looked at the "Zune" text and compared it with the devices on the system. So i changed the zune driver info to name the Kin as "Zune" (haha smart approach huh!) but the Zune software is sooo smart, that it changed the device name under device manager... Wow!
So... i checked that file and ... through *magic process* i found out that it checked the devices statically (using "Zune"), so as i couldn change my device name, i turned that string into ours: "KIN" and.. magic worked...
Surely, not going to help us... but it's kind of a weird thing that it worked "as is" (Xna detects the phone as compatible) even if later it says that the needed runtimes werent present at the phone (it's ok, the files for gaming aren't probably on the kin).
That means that microsoft could modify the Xna to let development on the kin, but was out of it, not the kin market i guess.
hmm.. if this XNA application doesn't appear on first page... then how did you launch it in the first place?
Any way of receiving already made apps?
You wrote to phone's unreachable memory?
Tutorial?
Too many question? umad?
Try to get one of the phones apps and see how they are coded so you can get one to launch
Antonpup said:
hmm.. if this XNA application doesn't appear on first page... then how did you launch it in the first place?
Click to expand...
Click to collapse
Deployment launched it if i had the device connected, in a non error state, and with the screen showing the home (apps) window. IF it was with the screen turned of, it didnt showed anything (quite meh). Then i realizzed that it was on the recent
Antonpup said:
Any way of receiving already made apps?
Click to expand...
Click to collapse
Who knows yet?
Antonpup said:
You wrote to phone's unreachable memory?
Click to expand...
Click to collapse
Not sure of where this app went, must recheck at night
Antonpup said:
Tutorial?
Click to expand...
Click to collapse
When is repeatable or a working thing. I said, i modified files which is not the same as redevelop things. this is clearly a hack (of the files,not the device itself).
Great to hear of more potential progress here.
I'm curious, JohnKussack... was it my comment about XNA a while back that led you in this direction?
Marcellus1 said:
Would Zune apps loaded through KinO run? What about XNA apps?
Click to expand...
Click to collapse
Marcellus1 said:
Great to hear of more potential progress here.
I'm curious, JohnKussack... was it my comment about XNA a while back that led you in this direction?
Click to expand...
Click to collapse
Unfortunately, not. I was inspecting the Xna software for about 1 day or more before posting this. A few days before your post, i was able to upload anything with KinO and tried it without success.
This comes from *other* ways, which we have no idea about how they work. I will skip the part where i found how it all works when looking for a "Zune".
I've been experimenting with all the kin related test for a year (not continuosly) and went curious about "why Xna device center doesnt recognize the kin?". The answer is pretty much stupid: because it looks for the Zune.
I updated the first post about how to operate with the Xna framework, although it doesnt let you do anything, it's a lame thing.
Pretty cool findings, man. So are you able to duplicate this on both the TWO and TWOm versions of the OS? Are the results the same?
(actually, I don't even know if your current working device can be switched between the original and M versions of the OS)
klamation said:
So are you able to duplicate this on both the TWO and TWOm versions of the OS? Are the results the same?
(actually, I don't even know if your current working device can be switched between the original and M versions of the OS)
Click to expand...
Click to collapse
I prefer not to play Russian Roulette with RB+power option, and getting a kintwo or a brick atm. If i was on verizon coverage area... mmmm might be. I'm getting this on my new phone, which is a Kin Two M (2 yellow dots model to be exact)
I will try to send programs till i figure out what could work or i get bored. In the end... microsoft abandoned the kin, so unless we test things... we'r stuck with the phone.
maybe one of this lame programs lets us read(even only reading) the normal filesystem.
In any case... i will try some helloworld!
I could kiss you right now
johnkussack, I've been reading all of your posts on here and... wow. I'm amazed at your knowledge and how much you have been able to figure out. You are so close to getting apps on this phone!
I know nothing about Windows hacking/development, but I have had experience with Android development on old WM6 devices. The hardware on this phone is capable of running android, the only thing stopping it is not being able to test the builds. If you figure out how to get apps to launch, one of the ones I suggest you put on your list is Haret.exe, then maybe we can send the android files to the phones storage and... well, I'm rambling on and on right now. Anyways, here's what I am thinking after reading all that you have done:
On my old Env2, the device was locked to only run BREW games, which was a pain because you can't torrent them Flash games couldn't be launched from the SD card or the internal memory, but some genius figured out that the calculator and the world clock were flash apps. So by connecting your phone to your PC and using bitpim (at least I think it was bitpim) you could replace the world clock or calculator with 2 flash games, like pac man.
So, I'm assuming that the apps already on the Kin are .exe or something, couldn't you just replace the calculator on the kin with a file system explorer?
You probably know all of this, I hope this post helped in some way and didn't just waste your time...
Good Luck! - Jeff
Jemilio3 said:
...So, I'm assuming that the apps already on the Kin are .exe or something, couldn't you just replace the calculator on the kin with a file system explorer?
You probably know all of this, I hope this post helped in some way and didn't just waste your time...
Good Luck! - Jeff
Click to expand...
Click to collapse
The main complication with this is, we haven't found any way to get access to the main file system of the phone (the one containing the Windows Mobile OS files). BitPim gives access to one small area, and MTP (using John's KinO software) gives access to another area.
If we could find a way to gain access to the main operating system of the phone, then we're almost assured victory.
@Jemilio3 Thanks for the compliments hehehe.
As was very well explained by Klamation, we do not have access to the filesystem where the OS is (at least for now), we are kind of stuck with what we have.
From my past experiences with a win mobile 2003 pda, the system will be a fixed rom memory, user available space (configuration & temp values) and a storage card (our storage now).
So when we CB reboot the kin, just configuration & storage are cleaned.
I'm still operating on what to do with my pc, the disk is half dead, but isnt sata, so no replacement easily... reinstalling on another external disk to test things....tomorrow
There are several things to test by now:
-test for deployment tools on the xna3.1
-deployment of apps using xna 3.1 and openzdk deploy tools
-xna 3.1 deployment with visual studio (for ages testing)
.... a lot hahaha
It's very strange that the device is so locked down. Music and videos sync to the main memory, right? Maybe the solution isn't to hack the device, but to hack the program that syncs the music.
I wish I could help with the testing, but the only Kin I have access to is my dads, so I can't mess with it. Maybe I will call the people who made the Kin and see if they will help us.
Jemilio3 said:
Maybe I will call the people who made the Kin and see if they will help us.
Click to expand...
Click to collapse
We already tried this. Microsoft, Sharp, and Verizon didn't help much. They mostly dropped support for the phone.
Jemilio3 said:
Maybe I will call the people who made the Kin and see if they will help us.
Click to expand...
Click to collapse
Antonpup said:
We already tried this. Microsoft, Sharp, and Verizon didn't help much. They mostly dropped support for the phone.
Click to expand...
Click to collapse
You are more than welcome to call. Past experience is you'll get a run-around of people telling you to call the other company, if you're lucky.
I've tried calling a few people (within Verizon) and basically reached dumb tech support people. (minor rant, how can you work in tech support when you are a self-proclaimed "non technical person"??)
If you do contact anyone more than the customer service and tech support staff with no information, like somebody who advises you to contact somebody else, please take note of whom they say to contact, and their own name/contact information. If we can actually get the right people, or at least get a lead on the right people to contact, maybe we can make progress within the companies.
@John
If you ever need parts or anything im sure all of us on here are willing to help, including me.
Jemilio3 said:
Maybe the solution isn't to hack the device, but to hack the program that syncs the music.
Click to expand...
Click to collapse
That's what KinO is for .
The OS memory and the music/pictures/etc storage is different, so only apps should be able to use it.
@soninja Thanks . I guess that i will use one my several external disks instead the zombie one, but yesterday i had to classify ~200gb of info & videos into others before formatting it and reinstalling linux. My data inside was a mess rofl so it took about 4 hours.
In any case, thanks to awesome71717 & some random analysis i did on the kin mtp, i saw that most of the MTP commands used on the Zune HD app deployment are present on the kin MTP commands list, so at least deploy is available, even if it's not using XNA code, but c# code or so.
I know this might be a stupid question (this is really my 1st phone I've ever worked with)
but is there a way to push an XNA framework to the kin or something along those lines or would that just be pointless work?
jthree2001 said:
I know this might be a stupid question (this is really my 1st phone I've ever worked with)
but is there a way to push an XNA framework to the kin or something along those lines or would that just be pointless work?
Click to expand...
Click to collapse
Probably easier to just test what works from the xna or c# examples. I dont want to deal with microsoft things more than needed. Legal issues and that things. I try to draw a line there.
I'm not 100% sure I understand how this all works but have we figured out how the browser adds links to the main menu? Or possibly where this is located?
What are we able to access at this time?
Heratiki
One thing that I seem to notice is that even though this forum may have some releases that people can use it seems to lack both information and tools to get into trying to help the community. Some people, such as me and im sure many others, have some, even if only basic, skills but the process of applying them to the field of Windows Phone. For example a while back I wanted to tinker with the Windows Phone emulator but I failed to find working tools to dump and reconstruct the ROM and sadly no documentation to look at the format to see whats going on. I once saw a tool for HTC ROM's I think but that has since disappeared. Some of the old formats are at least partially known but burried somewhere deep in this forum where it becomes a pain to find them.
Specifically I would be interested to know if there are ways to actually debug the assemblies using tools like IDA on either the emulator or an actual phone (even though they were compiled to different instr sets they still probably mostly share the same code). I am also wondering what tools could be used to atleast compile native binaries, even if they can't be executed yet.
I personally have a little reversing experience and a fair amount of coding experience yet the current barrier of lack of information seems overwhelming and deterring. I can't say I will have either the experience or time to get us all further but I wouldn't mind tinkering with my phone and/or it's operating system and isn't that the whole point of this community?
It would interest me if there are others who feel the same way and whether there are others out there who could maybe help to get others started. XDA has a wiki but it seems to be mainly "consumer" orientated.