Samsung Focus/Omnia Hacks needed - Windows Phone 7 Development and Hacking

Guys, I like the progress on the HTC devices.. at the same time I think we need to focus (no pun intended) on trying to achieve this same progress on the Samsung phones. From what I've seen, we are able to at least write to the registry on existent keys. We need more. The samsung WP7 device owner community is a little lonely right now.

Where have you seen the ability to write to keys on the Focus? From what I understand, registry writing is restricted to first-party apps and HTC devices due to their driver DLL.

pixeltec said:
Where have you seen the ability to write to keys on the Focus? From what I understand, registry writing is restricted to first-party apps and HTC devices due to their driver DLL.
Click to expand...
Click to collapse
Sorry, I didn't state that clearly. I've looked at a few threads stating that some sort of writing to the reg was successful, but only to existing keys by using the Samsung DLLs?

Here's the functions they provide...
void Init();
void Deinit();
void Run(int mode);
void End();
void SetInput(int type);
void Back();
void GetDispInfo(out uint svcMode, [MarshalAs(UnmanagedType.SafeArray)] out byte[] info);
void GetEvent(int type, out int pEvent);
void SetEventCOM(string name);
void LaunchExe(string exe, string arg);
void DoHiddenKey(int hashcode);
void GetLockingStatus(out uint m_dwLockFacility, [MarshalAs(UnmanagedType.SafeArray)] out byte[] pPasswd);
void SetLockingStatus(out uint m_dwLockFacility, string data, out uint m_dwStatus, [MarshalAs(UnmanagedType.SafeArray)] out byte[] result);
void GetIMSI(out string IMSI);
void GetIMEI(out string IMEI);
void DoHiddenKeyWithResult(int hashcode, out string jobName);
void WaitNamedEvent(int timeout, string name);
void RegSetDWORD(uint HKEY, string pwszPath, string valueName, uint value);
void RegGetDWORD(uint HKEY, string pwszPath, string valueName, out uint value);
void RegSetString(uint HKEY, string pwszPath, string valueName, string value);
void RegGetString(uint HKEY, string pwszPath, string valueName, out string value);
void ReadTextFile(string path, out string result);

pixeltec said:
Where have you seen the ability to write to keys on the Focus? From what I understand, registry writing is restricted to first-party apps and HTC devices due to their driver DLL.
Click to expand...
Click to collapse
Writing to the registry is possible using the Samsung native DLLs (on the focus too I assume).
I can provide a sample app for that if anyone is interested.

RustyGrom said:
Here's the functions they provide...
void Init();
void Deinit();
void Run(int mode);
void End();
void SetInput(int type);
void Back();
void GetDispInfo(out uint svcMode, [MarshalAs(UnmanagedType.SafeArray)] out byte[] info);
void GetEvent(int type, out int pEvent);
void SetEventCOM(string name);
void LaunchExe(string exe, string arg);
void DoHiddenKey(int hashcode);
void GetLockingStatus(out uint m_dwLockFacility, [MarshalAs(UnmanagedType.SafeArray)] out byte[] pPasswd);
void SetLockingStatus(out uint m_dwLockFacility, string data, out uint m_dwStatus, [MarshalAs(UnmanagedType.SafeArray)] out byte[] result);
void GetIMSI(out string IMSI);
void GetIMEI(out string IMEI);
void DoHiddenKeyWithResult(int hashcode, out string jobName);
void WaitNamedEvent(int timeout, string name);
void RegSetDWORD(uint HKEY, string pwszPath, string valueName, uint value);
void RegGetDWORD(uint HKEY, string pwszPath, string valueName, out uint value);
void RegSetString(uint HKEY, string pwszPath, string valueName, string value);
void RegGetString(uint HKEY, string pwszPath, string valueName, out string value);
void ReadTextFile(string path, out string result);
Click to expand...
Click to collapse
How do you use these functions? I keep getting:
System.MethodAccessException
Plus ive looked at the AppUtil.dll using Function Exporter and most of the functions above are not listed!

martani said:
I can provide a sample app for that if anyone is interested.
Click to expand...
Click to collapse
That'd be awesome if you wouldn't mind.

lyriquidperfection said:
How do you use these functions? I keep getting:
System.MethodAccessException
Plus ive looked at the AppUtil.dll using Function Exporter and most of the functions above are not listed!
Click to expand...
Click to collapse
Take a look at the requirements in my blog post here : http://www.martani.net/2010/12/reading-imei-on-windows-phone-7-devices.html
basically you need a
<Capability Name="ID_CAP_INTEROPSERVICES" /> inside the <Capabilities> tag in the WMAppManifest.xml file.
a WPInteropManifest.xml file in the root of your solution containing:
PHP:
<?xml version="1.0" encoding="UTF-8"?>
<Interop>
</Interop>

martani said:
Take a look at the requirements in my blog post here : http://www.martani.net/2010/12/reading-imei-on-windows-phone-7-devices.html
basically you need a
<Capability Name="ID_CAP_INTEROPSERVICES" /> inside the <Capabilities> tag in the WMAppManifest.xml file.
a WPInteropManifest.xml file in the root of your solution containing:
PHP:
<?xml version="1.0" encoding="UTF-8"?>
<Interop>
</Interop>
Click to expand...
Click to collapse
Ok im lost now, I much preferred programing for WM6.5, was a hell of alot easier and you didnt need any of this added xml crap!

pixeltec said:
That'd be awesome if you wouldn't mind.
Click to expand...
Click to collapse
I posted a sample that uses the LaunchExe method to launch an application.
http://forum.xda-developers.com/showthread.php?t=820455&page=8
Now what exactly needs to be passed to the registry functions is another question...

pixeltec said:
That'd be awesome if you wouldn't mind.
Click to expand...
Click to collapse
Here is the app (source code + xap), it's fairly simple actually
http://forum.xda-developers.com/showthread.php?p=10552193#post10552193

martani said:
Here is the app (source code + xap), it's fairly simple actually
http://forum.xda-developers.com/showthread.php?p=10552193#post10552193
Click to expand...
Click to collapse
Great, I'll take a look tomorrow. What parts of the registry are we not able to write to? I assume even the DLLs from earlier in the thread won't allow us to write to restricted areas?

I may add Samsung support to my registry application, but I don't own a Samsung.
Is there a way to detect if a device is a Samsung device? For exemple a registry key
Thanks.

(nico) said:
I may add Samsung support to my registry application, but I don't own a Samsung.
Is there a way to detect if a device is a Samsung device? For exemple a registry key
Thanks.
Click to expand...
Click to collapse
I think you can look at this reg key
Code:
[HKEY_LOCAL_MACHINE\Software\HTC\operatorpkg]
"Version"="7.1.401.10291"
[HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo]
[COLOR="Red"][B][U]"OemName"="HTC" [/U][/B][/COLOR]
"MODeviceName"="HD7 T9292"
"OEMDeviceName"="Schubert"
[HKEY_LOCAL_MACHINE\Ident]
"FriendlyName"="HTC HD7"

Yes or this one
Code:
[HKEY_LOCAL_MACHINE\Ident]
"Name"="Samsung Cetus"

I don't really like Ident as it can be customized (mine say "SmartPhone").
Something like "HKEY_LOCAL_MACHINE\Software\Samsung" would be nice.
HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo looks good but I don't have access to this one without using plateform specific code.

(nico) said:
I don't really like Ident as it can be customized (mine say "SmartPhone").
Something like "HKEY_LOCAL_MACHINE\Software\Samsung" would be nice.
HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo looks good but I don't have access to this one without using plateform specific code.
Click to expand...
Click to collapse
Yes, I confirm there is the key "HKEY_LOCAL_MACHINE\Software\Samsung" (on Omnia 7), I suppose it's just for Samsung devices.

I've created a build with (potential) Samsung support.
I don't have a Samsung device so I can't test but you should be able to edit part of the registry (I'm using the DLL presented in this post so everything is not permitted).
Available here: http://bit.ly/gyN9nL
Note: This version should also give full edit support on HTC (not fully tested)

(nico) said:
I've created a build with (potential) Samsung support.
I don't have a Samsung device so I can't test but you should be able to edit part of the registry (I'm using the DLL presented in this post so everything is not permitted).
Available here: http://bit.ly/gyN9nL
Note: This version should also give full edit support on HTC (not fully tested)
Click to expand...
Click to collapse
I can confirm that parts of the registry can be edited on the OMNIA 7.
I have edited the following key: HKCU\Sytem\State\CallHistory\Missed Call Count
It works !
Thanks a lot.

(nico) said:
I've created a build with (potential) Samsung support.
I don't have a Samsung device so I can't test but you should be able to edit part of the registry (I'm using the DLL presented in this post so everything is not permitted).
Available here: <snipped>
Note: This version should also give full edit support on HTC (not fully tested)
Click to expand...
Click to collapse
Doesn't seem to be saving registry changes on my Focus. The OK button is enabled and doesn't return an exception when pressing it, but no changes seem to be applied and revisiting a key returns the default, unmodified value.

Related

Hard Reset programmatically corrupts microSD

I just got my Treo and noting the lack of a software reset (the need to use the stylus on the reset button really annoys me), I decided to build my own.
The Reset and Suspend part of my little program works like a charm and then I decided to improve a little more and add a Hard Reset feature, which would restore the device to its factory settings.
Searching high and low on the net I found two possible ways. The first one involved calling SetCleanRebootFlag() and then reset the device.
Code:
[DllImport("coredll.dll", SetLastError=true)]
public static extern void SetCleanRebootFlag();
[DllImport("coredll.dll", SetLastError=true)]
private static extern int SetSystemPowerState(IntPtr psState, PowerStateFlags flags, uint Options);
[DllImport("coredll.dll", SetLastError=true)]
private static extern bool KernelIoControl(int dwIoControlCode, IntPtr inBuf, int inBufSize, IntPtr outBuf, int outBufSize, ref int bytesReturned);
public static void SoftReset()
{
if (SetSystemPowerState(IntPtr.Zero, PowerStateFlags.Reset, 0x1000) != 0)
{
int bytesReturned = 0;
if (!KernelIoControl(0x101003c, IntPtr.Zero, 0, IntPtr.Zero, 0, ref bytesReturned))
{
throw new Win32Exception(Marshal.GetLastWin32Error());
}
}
}
public static void HardReset()
{
SetCleanRebootFlag();
SoftReset();
}
The other involved using the ConfigurationManager to process a XML that would perform a "RemoteWipe".
Code:
public static void HardReset()
{
XmlDocument doc = new XmlDocument();
doc.LoadXml("<wap-provisioningdoc><characteristic type='RemoteWipe'><parm name='doWipe' value='1'/></characteristic></wap-provisioningdoc>");
ConfigurationManager.ProcessConfiguration(doc, true);
}
The first method didn't work because after Windows Mobile 5 it ignores the CleanBootFlag; the second method worked... too much.
It corrupted the microSD on the device to the point that it needed to be reformatted in order to be recognized again.
Does anyone had any experience with that?

Turn off phone

I need to turn off the phone (radio?) in my application
The only thing I found is by using lineSetEquipmentState but I couldn't find how to work with it.
Another option is with the openNetCf.tapi but this dll isn't free.
Any ides?
Someone? something?
Other option will be if possible to call flight mode
You can do this via RIL:
Code:
RIL_SetEquipmentState(FHandle,RIL_EQSTATE_MINIMUM);
Here FHandle is handle to opened RIL.
TrashKalmar said:
You can do this via RIL:
Code:
RIL_SetEquipmentState(FHandle,RIL_EQSTATE_MINIMUM);
Here FHandle is handle to opened RIL.
Click to expand...
Click to collapse
Thanks for the info, seems the right way.
However something doesn't work, every thing looks ok, the hRes is 0 but nothing happens.
Any ideas?
Code:
[DllImport("ril.dll")]
private static extern IntPtr RIL_SetEquipmentState(IntPtr hRil);
public static bool SetAirplaneState()
{
IntPtr hRil = IntPtr.Zero;
IntPtr hRes = IntPtr.Zero;
hRes = RIL_Initialize(1, // RIL port 1
new RILRESULTCALLBACK(SetEquipmentStateCallback), // function to call with result
null, // function to call with notify
0, // classes of notification to enable
0x00000001, // RIL parameters
out hRil); // RIL handle returned
if (hRes != IntPtr.Zero)
{
return false;
}
hRes = RIL_GetCellTowerInfo(hRil);
waithandle.WaitOne();
RIL_Deinitialize(hRil);
return true;
}
private static void SetEquipmentStateCallback(uint dwCode, IntPtr hrCmdID, IntPtr lpData, uint cbData, uint dwParam)
{
waithandle.Set();
}
private static AutoResetEvent waithandle = new AutoResetEvent(false);
public delegate void RILNOTIFYCALLBACK(uint dwCode,
IntPtr lpData,
uint cbData,
uint dwParam);
public delegate void RILRESULTCALLBACK(uint dwCode,
IntPtr hrCmdID,
IntPtr lpData,
uint cbData,
uint dwParam);
alto said:
Code:
...
hRes = RIL_Initialize(1, // RIL port 1
new RILRESULTCALLBACK(SetEquipmentStateCallback), // function to call with result
null, // function to call with notify
0, // classes of notification to enable
0x00000001, // RIL parameters
out hRil); // RIL handle returned
if (hRes != IntPtr.Zero)
{
return false;
}
hRes = RIL_GetCellTowerInfo(hRil);
...
Click to expand...
Click to collapse
What do you want to achieve? If you want to turn off the phone, you should use RIL_SetEquipmentState. But in your code you obtain Cell Tower info via RIL_GetCellTowerInfo.
Also, if I remember rightly, you must specify RILNOTIFYCALLBACK in RIL_Initialize.
TrashKalmar said:
What do you want to achieve? If you want to turn off the phone, you should use RIL_SetEquipmentState. But in your code you obtain Cell Tower info via RIL_GetCellTowerInfo.
Also, if I remember rightly, you must specify RILNOTIFYCALLBACK in RIL_Initialize.
Click to expand...
Click to collapse
Correct, sorry I made mish-mash in the code I copied here.
My error was that I forgot to pass the second parameter to the SetEquipmentState function.
Works great now, Thanks!
Any chance of publishing this code?
Am I right in that it takes some time for the application to quit?
Thanks,
ajhvdb, this code works quite fine. And yes, it may take a while to quit app.
TrashKalmar said:
ajhvdb, this code works quite fine. And yes, it may take a while to quit app.
Click to expand...
Click to collapse
If I past your code into my code I'm missing RIL_Initialize, RIL_GetCellTowerInfo.
Sorry for being slow with this but I never used delegates and RIL before
If I past your code into my code I'm missing RIL_Initialize, RIL_GetCellTowerInfo.
Sorry for being slow with this but I never used delegates and RIL before
Bump

[Q] WP7 - Removing an XElement from an XML file

Hi there,
I'm having a big issue, when trying to remove an XElement from an XML file created in IsolatedStorage.
--------------------------------------------------------------------------------------------
Code to CREATE the XML file
Dim File_to_Create As String = "Tracks.xml"
Dim file As XDocument = <?xml version="1.0" encoding="UTF-8"?>
<dataroot xmlnsd="urn:schemas-microsoft-comfficedata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="Cartridges.xsd" generated="2010-11-23T14:26:55">
<Carts>
<CART_NAME>First</CART_NAME>
<CART_COLOR>White</CART_COLOR>
</Carts>
<Carts>
<CART_NAME>Second</CART_NAME>
<CART_COLOR>Black</CART_COLOR>
</Carts>
</dataroot>
Dim isoStore As IsolatedStorageFile = IsolatedStorageFile.GetUserStoreForApplication()
Try
If isoStore.FileExists(File_to_Create) Then
MessageBox.Show(File_to_Create + " TRUE")
Else
MessageBox.Show(File_to_Create + " FALSE")
Dim oStream As New IsolatedStorageFileStream(File_to_Create, FileMode.Create, isoStore)
Dim writer As New StreamWriter(oStream)
writer.WriteLine(file)
writer.Close()
MessageBox.Show("OK")
End If
Catch ex As Exception
MessageBox.Show(ex.Message)
Finally
'open selected file
Dim isoStream As IsolatedStorageFileStream
isoStream = New IsolatedStorageFileStream(File_to_Create, System.IO.FileMode.Open, System.IO.FileAccess.Read, isoStore)
Dim XML_File As XDocument = XDocument.Load(isoStream)
Dim Cart_Query As System.Collections.IEnumerable = From query In XML_File.Descendants("Carts") Order By _
CStr(query.Element("CART_NAME")) Descending, CStr(query.Element("CART_NAME"))
Select New Class_Cartridge_Data With {.Cart_Name = CStr(query.Element("CART_NAME")), _
.Cart_Color = CStr(query.Element("CART_COLOR"))}
Me.ListBox_Cartridges.ItemsSource = Cart_Query
isoStore.Dispose()
isoStream.Close()
End Try
--------------------------------------------------------------------------------------------
Code to ADD / EDIT XElement
Dim File_to_Create As String = "Tracks.xml"
Dim XML_IsolatedStorage = IsolatedStorageFile.GetUserStoreForApplication()
' Check that the file exists if not create it
If Not (XML_IsolatedStorage.FileExists(File_to_Create)) Then
Return
End If
Dim XML_StreamReader As New StreamReader(XML_IsolatedStorage.OpenFile(File_to_Create, FileMode.Open, FileAccess.Read))
Dim XML_Document As XDocument = XDocument.Parse(XML_StreamReader.ReadToEnd())
XML_StreamReader.Close()
' Update the element if it exist or create it if it doesn't
Dim XML_XElement As XElement = XML_Document.Descendants("Carts").Where(Function(c) c.Element("CART_NAME").Value.Equals("First")).FirstOrDefault()
If XML_XElement IsNot Nothing Then
XML_XElement.SetElementValue("CART_NAME", "Third")
Else
' Add new
Dim newProgress As New XElement("Cartridges", New XElement("CART_NAME", "Fourth"), New XElement("CART_COLOR", "Blue"))
Dim rootNode As XElement = XML_Document.Root
rootNode.Add(newProgress)
End If
Using XML_StreamWriter As New StreamWriter(XML_IsolatedStorage.OpenFile(File_to_Create, FileMode.Open, FileAccess.Write))
XML_StreamWriter.Write(XML_Document.ToString())
XML_StreamWriter.Close()
End Using
--------------------------------------------------------------------------------------------
Now my issue and request for some help!
If I use
XML_XElement.Remove
then the following exception is raised whenever I try to "refresh" the bounded ListBox
System.Xml.XmlException was unhandled
LineNumber=37
LinePosition=12
Message=Data at the root level is invalid. Line 37, position 12.
SourceUri=""
StackTrace:
at System.Xml.XmlTextReaderImpl.Throw(Exception e)
at System.Xml.XmlTextReaderImpl.Throw(Int32 res, String resString, String[] args)
at System.Xml.XmlTextReaderImpl.Throw(Int32 res, String resString)
at System.Xml.XmlTextReaderImpl.ParseRootLevelWhitespace()
at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
at System.Xml.XmlTextReaderImpl.Read()
at System.Xml.Linq.XContainer.ReadContentFrom(XmlReader r)
at System.Xml.Linq.XContainer.ReadContentFrom(XmlReader r, LoadOptions o)
at System.Xml.Linq.XDocument.Load(XmlReader reader, LoadOptions options)
at System.Xml.Linq.XDocument.Load(Stream stream, LoadOptions options)
at System.Xml.Linq.XDocument.Load(Stream stream)
at ListBox_Data_from_XML_LINQ.MainPage.Button_Create_XML_Click(Object sender, RoutedEventArgs e)
at System.Windows.Controls.Primitives.ButtonBase.OnClick()
at System.Windows.Controls.Button.OnClick()
at System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonUp(MouseButtonEventArgs e)
at System.Windows.Controls.Control.OnMouseLeftButtonUp(Control ctrl, EventArgs e)
at MS.Internal.JoltHelper.FireEvent(IntPtr unmanagedObj, IntPtr unmanagedObjArgs, Int32 argsTypeIndex, String eventName)
InnerException:
--------------------------------------------------------------------------------------------
In short, I can add or edit, but cannot DELETE an XElement...
Any ideas?
Thanks in advance!
Can you post the code you are using for XElement.Remove and use code tags so the formatting is right. Its the # button on the post toolbar.
Ren13B said:
Can you post the code you are using for XElement.Remove and use code tags so the formatting is right. Its the # button on the post toolbar.
Click to expand...
Click to collapse
Well, I did nothing special, just the XML_Element.remove, instead of adding a new xelement.
Then the error raises whenever I try to reopen the XML file.
My point is, how can I delete an specific xelement?
As far as I know, the following code should work
Code:
Dim XML_XElement As XElement = XML_Document.Descendants("Carts").Where(Function(c ) c.Element("CART_NAME").Value.Equals("First")).Firs tOrDefault()
If XML_XElement IsNot Nothing Then
XML_XElement.SetElementValue("CART_NAME", "Third")
Else
' remove the selected record
XML_XElement.Remove
End If
Honestly I don't know if the foregoing code is correct or if the issue is related to how WP7 handles the removal thus corrupting the original file.
Please let me know if you need anything else.
Any help is very appreciated!
PS: Thanks for the other replies, helped a lot!
Here's how I did it in c#. My xml file is very different than yours so the query will be different but the important parts are where you load and close the file streams and then write.
Code:
//Get users private store info
IsolatedStorageFile isoStore = IsolatedStorageFile.GetUserStoreForApplication();
IsolatedStorageFileStream isoStream;
//open selected file
isoStream = new IsolatedStorageFileStream(list, System.IO.FileMode.Open, System.IO.FileAccess.Read, isoStore);
XDocument xml = XDocument.Load(isoStream);
isoStream.Close();
//Find section
XElement sectionElement = xml.Descendants("section").Where(c => c.Attribute("name").Value.Equals(groupn)).FirstOrDefault();
//Find item and remove it
sectionElement.Elements("setting").Where(c => c.Attribute("name").Value.Equals(litem)).FirstOrDefault().Remove();
isoStream.Close(); //Seems unnecessary but it's needed.
//Write xml file
isoStream = new IsolatedStorageFileStream(list, FileMode.Create, FileAccess.Write, isoStore);
xml.Save(isoStream);
isoStream.Close();
Thanks again for your help, greatly appreciated.
However I'm still getting the same error.
Sorry for asking, but are you getting any errors when deleting in WP7 ?
My knowledge on XML is extremely new and I'm sure that I'm making some mistakes somewhere...
But so far, I cannot get past the same exception.
Seems that the XML gots "corrupted" after the delete operation.
On the other hand, if is not too much to ask for, using my current code, how will handle the delete of the selected record?
Thanks!
I have no problem at all removing elements in c#. I don't have vb support even installed right now. If you think it's a bug you should post on the forums at http://forums.create.msdn.com/forums/98.aspx
Ren13B said:
I have no problem at all removing elements in c#. I don't have vb support even installed right now. If you think it's a bug you should post on the forums at http://forums.create.msdn.com/forums/98.aspx
Click to expand...
Click to collapse
Problem is my country is not listed so I cannot register...
Here is the C# version of my current code for adding/editing
Code:
public static void ADD_XML_Record()
{
string File_to_Create = "Tracks.xml";
var XML_IsolatedStorage = IsolatedStorageFile.GetUserStoreForApplication();
// Check that the file exists if not create it
if (! (XML_IsolatedStorage.FileExists(File_to_Create)))
{
return;
}
StreamReader XML_StreamReader = new StreamReader(XML_IsolatedStorage.OpenFile(File_to_Create, FileMode.Open, FileAccess.Read));
XDocument XML_Document = XDocument.Parse(XML_StreamReader.ReadToEnd());
XML_StreamReader.Close();
// Update the element if it exist or create it if it doesn't
XElement XML_XElement = XML_Document.Descendants("Carts").Where((c) => c.Element["CART_NAME"].Value.Equals("dd")).FirstOrDefault();
if (XML_XElement != null)
{
XML_XElement.SetElementValue("CART_NAME", "bbbbb");
}
else
{
// Add new
XElement newProgress = new XElement("Carts", new XElement("CART_NAME", "dd"), new XElement("CART_COLOR", "ff"));
XElement rootNode = XML_Document.Root;
rootNode.Add(newProgress);
}
using (StreamWriter XML_StreamWriter = new StreamWriter(XML_IsolatedStorage.OpenFile(File_to_Create, FileMode.Open, FileAccess.Write)))
{
XML_StreamWriter.Write(XML_Document.ToString());
XML_StreamWriter.Close();
}
}
I tried your code but I'm having a bad time making it to work.
If not a big deal, please could you tell me how to modify it ?
I mean, if a record is found, instead of editing, to remove it?
Honestly I'm stuck and any help is more than apprecisted!
Ren13B said:
I have no problem at all removing elements in c#. I don't have vb support even installed right now. If you think it's a bug you should post on the forums at http://forums.create.msdn.com/forums/98.aspx
Click to expand...
Click to collapse
Ren,
Just to say thank you for your last code. I made a little mod and now it works ok!
Thanks a lot for helping me out!

Pacman.edb: The source of all app related goodness... if we can crack it

Sup..
So did some quick playing around today, trying to figure out where installed applications and their data is stored. Well, it didn't really take long, as I found \Application Data\Microsoft\PackageManager, containing pacman.edb and pacman.edb (as well as matching .snt files with 0 bytes).
If you're not already aware, the package manager stores the manifest data in it, which means any changes to the manifest do not take place unless the application is reinstalled, in which the package manager updates the database.
By manipulating this data, a lot of really neat things can happen. To my current knowledge, this includes:
-Hiding applications from the start list
-Enabling applications to resume on launch, rather than "replace" the previous entity
-Change icons, name, etc
-Manipulate application Tasks
-Better understand how the DRM and capabilities work
-etc etc
So here's what I know so far, and here's where I'm stuck. I have pacman.edb and pacman2.edb. The first file contains mostly system info, stuff I don't really recognize. The second file contains all the applications on the device, both system and user installed. This also lists all their tokens, capabilities, modes, flags, etc. But here's the issue: These files use some variation of CEDB, the Windows CE version of the EDB format.
Reading EDB is enough of a pain already, because not a lot of information is available on it. There are *some* CEDB tools out there, but they all seem to rely on old (WM2003) formats.
If I was good at reading bytes and figuring this kind of stuff out, I'd get to work, but that's never been my forté. If anyone has some useful info, knowledge I'm missing, or is really good with reading hex dumps, do share
Attached are the two files from my device. I realize they probably contain a great deal of info, but for the sake of trying to crack open this mess, I figured the embarrassment of publicly announcing that I have "Brostache" installed was well worth the potential benefits
Any info, pointers, etc, will be much appreciated by Windows Phone users alike, if we can get this figured out
Wow, lots of potential here. Among other things, I suspect that the interop-locked behavior is determined by a setting in here somewhere (after all, OEM apps with ID_CAP_INTEROPSERVICES work just fine even on an interop-locked Mango phone).
This also might allow the creation of custom "hubs" of apps, or at the very least the ability to invoke other apps from within an app (already possible with built-in apps but not yet with third-party).
GoodDayToDie said:
This also might allow the creation of custom "hubs" of apps, or at the very least the ability to invoke other apps from within an app (already possible with built-in apps but not yet with third-party).
Click to expand...
Click to collapse
That's been possible since.. June? May? Just use fiinix's DllImport library and execute the GUID. It's what my folders application uses.
I stand corrected, then. I've seen several apps that can invoke built-in apps but none that could invoke third-party.
Just providing with some information.
You are probably searching for those dll's:
- \SYS\CommsPlatform\unistore.dll
Code:
Resource data (not dll exports):
EDB_ReadRecordPropsWithPrimaryId
EDB_CeWriteRecordProps
EDB_CeReadRecordPropsEx
EDB_SeekAndReadRecordProps
EDB_CeDeleteRecord
EDB_CeOpenStream
-\SYS\CoreOS\coredll.dll
Code:
HANDLE CeOpenDatabase(PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, HWND hwndNotify)
HANDLE CeOpenDatabaseEx(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, CENOTIFYREQUEST *pReq)
HANDLE CeOpenDatabaseEx2(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, SORTORDERSPECEX *pSort, DWORD dwFlags, CENOTIFYREQUEST *pReq)
BOOL CeMountDBVol(PCEGUID pguid, LPWSTR lpszVol, DWORD dwFlags)
BOOL CeUnmountDBVol(PCEGUID pguid)
BOOL CeDeleteRecord(HANDLE hDatabase, CEOID oidRecord)
HANDLE CeFindFirstDatabaseEx(PCEGUID pguid, DWORD dwClassID)
BOOL CeGetDBInformationByHandle(HANDLE hDbase, LPBY_HANDLE_DB_INFORMATION lpDBInfo)
- CeOpenDatabase
fiinix said:
Just providing with some information.
You are probably searching for those dll's:
- \SYS\CommsPlatform\unistore.dll
Code:
Resource data (not dll exports):
EDB_ReadRecordPropsWithPrimaryId
EDB_CeWriteRecordProps
EDB_CeReadRecordPropsEx
EDB_SeekAndReadRecordProps
EDB_CeDeleteRecord
EDB_CeOpenStream
-\SYS\CoreOS\coredll.dll
Code:
HANDLE CeOpenDatabase(PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, HWND hwndNotify)
HANDLE CeOpenDatabaseEx(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, CENOTIFYREQUEST *pReq)
HANDLE CeOpenDatabaseEx2(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, SORTORDERSPECEX *pSort, DWORD dwFlags, CENOTIFYREQUEST *pReq)
BOOL CeMountDBVol(PCEGUID pguid, LPWSTR lpszVol, DWORD dwFlags)
BOOL CeUnmountDBVol(PCEGUID pguid)
BOOL CeDeleteRecord(HANDLE hDatabase, CEOID oidRecord)
HANDLE CeFindFirstDatabaseEx(PCEGUID pguid, DWORD dwClassID)
BOOL CeGetDBInformationByHandle(HANDLE hDbase, LPBY_HANDLE_DB_INFORMATION lpDBInfo)
- CeOpenDatabase
Click to expand...
Click to collapse
Ah, nice find! Any chance of running these DLLs on my desktop? I know the emulator is x86, but not sure about how marshal calls would work on an emulator module..
GoodDayToDie said:
I stand corrected, then. I've seen several apps that can invoke built-in apps but none that could invoke third-party.
Click to expand...
Click to collapse
Phone.Search.SearchFor("OMG how is this even possible :O");
-- Phone.AppLauncher.LaunchBuiltInApplication(AppLauncher.Apps.SearchHome, "SearchResults?QueryString=" + value);
---- LaunchApplication(GuidFromApp(app), value);
------ internalLaunch(guid, task);
[
var args = string.Format("app://{0}/{1}", guid.ToString("D").ToUpper(), task ?? "");
var re = DllImportCaller.lib.StringCall("aygshell", "SHLaunchSessionByUri", args);
]
The glorious "SHLaunchSessionByUri" allows us to start anything with any application guid.
Phone.AppLauncher.LaunchApplication("{8dc5214e-88fa-4c2d-a379-2cd74fe24b72}", "_default");
- To start DllImport Project from within DllImport Project
---------- Post added at 02:17 PM ---------- Previous post was at 02:08 PM ----------
Jaxbot said:
Ah, nice find! Any chance of running these DLLs on my desktop? I know the emulator is x86, but not sure about how marshal calls would work on an emulator module..
Click to expand...
Click to collapse
http://www.koders.com/csharp/fid0E5D18C95EDCC856BA4CB706535EC9933250BD56.aspx?s=usb
Code:
[PreserveSig]
IntPtr CeOpenDatabaseEx(
ref Guid pceguid,
ref int poid,
[In, MarshalAs(UnmanagedType.LPWStr)] string lpszName,
int propid,
[In] int dwFlags,
ref IntPtr /*CENOTIFYREQUEST*/ pReq);
This is the C# signature.
To be able to execute it, a c++ COM+ must make the call due c# cant do it alone.
fiinix said:
Phone.Search.SearchFor("OMG how is this even possible :O");
-- Phone.AppLauncher.LaunchBuiltInApplication(AppLauncher.Apps.SearchHome, "SearchResults?QueryString=" + value);
---- LaunchApplication(GuidFromApp(app), value);
------ internalLaunch(guid, task);
[
var args = string.Format("app://{0}/{1}", guid.ToString("D").ToUpper(), task ?? "");
var re = DllImportCaller.lib.StringCall("aygshell", "SHLaunchSessionByUri", args);
]
The glorious "SHLaunchSessionByUri" allows us to start anything with any application guid.
Phone.AppLauncher.LaunchApplication("{8dc5214e-88fa-4c2d-a379-2cd74fe24b72}", "_default");
- To start DllImport Project from within DllImport Project
---------- Post added at 02:17 PM ---------- Previous post was at 02:08 PM ----------
http://www.koders.com/csharp/fid0E5D18C95EDCC856BA4CB706535EC9933250BD56.aspx?s=usb
Code:
[PreserveSig]
IntPtr CeOpenDatabaseEx(
ref Guid pceguid,
ref int poid,
[In, MarshalAs(UnmanagedType.LPWStr)] string lpszName,
int propid,
[In] int dwFlags,
ref IntPtr /*CENOTIFYREQUEST*/ pReq);
This is the C# signature.
To be able to execute it, a c++ COM+ must make the call due c# cant do it alone.
Click to expand...
Click to collapse
Not even C# on my desktop, eh? hmm...
Jaxbot said:
Not even C# on my desktop, eh? hmm...
Click to expand...
Click to collapse
Heh, NOPE, needs and can only be executed from WP7
fiinix said:
Heh, NOPE, needs and can only be executed from WP7
Click to expand...
Click to collapse
Well, at least direct support suddenly became less of an issue =p But, won't we need higher privileges to go snooping around system databases?
Direct edit [blocked, umad?].
Edit on external placed EDB [ok]
<Macro Id="ELEVATED_RIGHTS_RESOURCE_GROUP_NAME" Description="Elevated Rights Resource Group SID" Value="S-1-5-112-0-0X14" />
You will need "Elevated Rights" to edit the file (when located @ /PACKAGEMANAGER/*)
- Editing from /Applications/Install/{GUID}/Install/ (you are OK)
- (Solution) Edit => override system file (maybe possible?)
"PACMAN.EDB" block policy
Code:
<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/FILESYS/PRIMARY/APPLICATION%20DATA/MICROSOFT/PACKAGEMANAGER/PACMAN.EDB" SpeakerAccountId="S-1-5-112-0-0-1" Description="Allow all in Standard Rights Chamber to access the Package Manager database ">
<Authorize>
<Match AccountId="S-1-5-112-0-0X14" AuthorizationIds="FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, FILE_LIST_DIRECTORY" />
<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="FILE_GENERIC_READ, FILE_READ_ATTRIBUTES, FILE_LIST_DIRECTORY" />
</Authorize>
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>
edit:
<Macro Id="STANDARD_RIGHTS_RESOURCE_GROUP_NAME" Description="Standard Rights Resource Group SID" Value="S-1-5-112-0-0X23" />
"Standard Rights" for enumerating the installed info.
fiinix said:
Direct edit [blocked, umad?].
Edit on external placed EDB [ok]
<Macro Id="ELEVATED_RIGHTS_RESOURCE_GROUP_NAME" Description="Elevated Rights Resource Group SID" Value="S-1-5-112-0-0X14" />
You will need "Elevated Rights" to edit the file (when located @ /PACKAGEMANAGER/*)
- Editing from /Applications/Install/{GUID}/Install/ (you are OK)
- (Solution) Edit => override system file (maybe possible?)
"PACMAN.EDB" block policy
Code:
<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/FILESYS/PRIMARY/APPLICATION%20DATA/MICROSOFT/PACKAGEMANAGER/PACMAN.EDB" SpeakerAccountId="S-1-5-112-0-0-1" Description="Allow all in Standard Rights Chamber to access the Package Manager database ">
<Authorize>
<Match AccountId="S-1-5-112-0-0X14" AuthorizationIds="FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, FILE_LIST_DIRECTORY" />
<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="FILE_GENERIC_READ, FILE_READ_ATTRIBUTES, FILE_LIST_DIRECTORY" />
</Authorize>
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>
edit:
<Macro Id="STANDARD_RIGHTS_RESOURCE_GROUP_NAME" Description="Standard Rights Resource Group SID" Value="S-1-5-112-0-0X23" />
"Standard Rights" for enumerating the installed info.
Click to expand...
Click to collapse
Ok, got a plan then =P If I have time today, I'll try and create a C# program to read edb files, and place my pacman files in the Install directory. My C++ is rusty though, so if you have time to waste, feel free to beat me to it
Not sure if im doing it right
- First time working with CE databases (Using google)
[Testing] Ill just check the error codes if success.
CEOID poid;
CeOpenDatabase(&poid, L"pacman.edb", 0,CEDB_AUTOINCREMENT, 0);
CEOIDINFO * info = (CEOIDINFO*)malloc(sizeof(CEOIDINFO));
ZeroMemory(info, sizeof(CEOIDINFO));
CeOidGetInfo(poid, info);
edit:
Making some progress:
- returned: ERROR_FILE_NOT_FOUND
MSDN: CeMountDBVol is obselete => use CeMountDBVolEx (above returned -1 (CeOpenDatabase))
Help code (Ce lib): http://nah6.com/~itsme/cvs-xdadevtools/itsutils/dll/PoomInterface.cpp
Current code:
Code:
typedef BOOL (*FN_CeMountDBVolEx)( PCEGUID pGuid, LPWSTR lpwszDBVol, CEVOLUMEOPTIONS* pOptions, DWORD dwFlags);
STDMETHODIMP CMangoClass::DatabaseTestWork()
{
FN_CeMountDBVolEx CeMountDBVolEx = (FN_CeMountDBVolEx)GetProcAddress(LoadLibrary(L"coredll.dll"), L"CeMountDBVolEx");
LPWSTR str = TEXT("pacman.edb"); // => ERROR_FILE_NOT_FOUND (different path needed)
CEGUID _mvolguid;
memset(&_mvolguid, 0, sizeof(CEGUID));
BOOL ok = CeMountDBVolEx(&_mvolguid, str, NULL,OPEN_EXISTING);
return ok;
}
edit 2:
Aw! FFS!
Changed to: TEXT("\\Applications\\Install\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Install\\pacman.edb");
- ERROR_ACCESS_DENIED
Maybe needs to be located in isolation storage or \Data\
edit 3:
WOAH
- NO_ERROR
TEXT("\\Applications\\Data\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Data\\IsolatedStore\\pacman.edb");
I could expect this due the WRITE+READ under \Install\ is policy blocked, where \IsolatedStore\ is full access (sandbox: "this-app")
edit 4:
What im currently able doing:
Code:
var db = "\\Applications\\Data\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Data\\IsolatedStore\\pacman.edb";
bool suc;
int guidAddr = DllImportCaller.lib.EDB_Mount(db, out suc);
if (!suc)
{
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
else
{
var sessionHandle = DllImportCaller.lib.EDB_OpenMounted(db, guidAddr);
//Currently trying to get this one working (erra: INVALID_PARAMETER) => Probably "SORTORDERSPECEX"
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
edit 5:
The db handles mounted (within pacman):
805306371,
805306369,
805306383,
805306381,
805306373
Code:
var first = DllImportCaller.lib.EDB_FindFirstDB(guidAddr);
var dbHandles = new List<int>();
int dbHandle;
var erraA = (WinError)DllImportCaller.lib.GetLastError7();
while ((dbHandle = DllImportCaller.lib.EDB_FindNextDB(first, guidAddr)) != 0)
{
dbHandles.Add(dbHandle);
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
var sortDuplicate = dbHandles.Distinct().ToArray();
Hey! I was working on that a while ago. But I'm too busy with other things, so I put it on hold. Good luck!
http://forum.xda-developers.com/showthread.php?p=15205597#post15205597
Ciao,
Heathcliff74
Heathcliff74 said:
Hey! I was working on that a while ago. But I'm too busy with other things, so I put it on hold. Good luck!
http://forum.xda-developers.com/showthread.php?p=15205597#post15205597
Ciao,
Heathcliff74
Click to expand...
Click to collapse
Could you send the C++ code for that?
I have come a long way, but it would speed up more
fiinix said:
Could you send the C++ code for that?
I have come a long way, but it would speed up more
Click to expand...
Click to collapse
Pwoo. I really got to look for that. Not sure I still have this. I will look for it tomorrow.
"Because i can"-moment: Attachment
Mom, look, i extracted the tables lol
Well, it works fast extracting the table names
Guys, this is awesome, and fantastic job whipping it up so fast - I'll try and step in when I can.
If you can edit the database file, it's quite possible we'll be able to replace it using the XAP exploit. No guarantee of course - the installer may take a lock on the DB file before unpacking the XAP, in which case the unpack would fail.
Of course, you'd need to not overwrite the database or your installed apps (and quite possibly the built-in ones) would probably stop working. I wonder if the phone would load a pacman3.edb if you put it in the right folder...

How to access byte[] array from hooked method?

I'm a noob when it comes to both java and xposed, although I can more or less "read" java. I'm trying to create my first xposed plugin.
This is in the source (via jadx) from my original apk:
Code:
private void onHandle(byte[] data, int start, int length) {
byte b = data[start];
I wrote in my plugin:
Code:
findAndHookMethod("com.syu.ms.dev.ReceiverMcu", lpparam.classLoader, "onHandle", byte[].class, int.class, int.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(XC_MethodHook.MethodHookParam param) throws Throwable {
[B]byte[] data = assetAsByteArray(param.thisObject, "byte[].class");[/B]
int start = getIntField(param.thisObject, "start");
int length = getIntField(param.thisObject, "length");
byte b = data[start];
....... etcetera .................
The bold part is what I need. I know that this line of code is wrong, but I'm already trying (monkey like) all kinds of constructions, but I always get an error.
How can I access that "byte[] data" from my original apk in my plugin?
The arguments are in 'param.args'. Since you want to access the first one, what you need is 'byte[] data = (byte[]) param.args[0];'
JoseRebelo said:
The arguments are in 'param.args'. Since you want to access the first one, what you need is 'byte[] data = (byte[]) param.args[0];'
Click to expand...
Click to collapse
Thanks a lot. It compiles fine now.
Now see if it really works

Categories

Resources