[Release]XapSpyAnalysis - a graphical tool for runtime analysis - Windows Phone 7 Development and Hacking

Hi XDA developers!
Today I present you my first open source software called XapSpyAnalysis. You can download a compiled version and the sourcecode at xapspyanalysis.codeplex.com. It is an extension to Behrang Fouladis excellent XapSpy tool.
First, you need to use XapSpy. You need to start XapSpy and select a XAP package you want to analyse. It will be unpacked, stripped from its licence information, patched, signed and repacked. The next step is to launch the Emulator. This is automatically done from XapSpy. After it is booted, the application will get deployed to the emulator. After this is completed, XapSpy will inform you, that you can run the Monitor from inside XapSpy. This is where XDEMonitor kicks in. It will log all method calls and its variables it can get from the emulator log window. When you are finished, you can stop the recording and save the file to your harddisk.
This file can be loaded into XapSpyAnalysis. It will parse the file and display its raw content in the first tab. You can now switch between different views. You can display a table that contains all method calls with their variables, the DLL file from where the method call originates and its time. The next tab lists all method names and their number of calls. The next tab lists statistic values like how many method calls were registered and how many of them were unique method calls.
The final tab displays a graphical analyis of the method calls. The x axis displays the point of time, when the method was called. The y axis displays the number of method that was called. This is an unfortunate restriction from the used graphic framework. You can find a legend on the right side of the diagram. It maps the numbers to method names. But you can also point your mouse cursor on any of the data points in the diagram. A tooltip will be availabe that shows you the corresponding method name.
Now some screenshots:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This screenshot shows an application, that crashes three times. You can see this from the data points starting with method 0 (InitializeComponent) and method 22 (Application_UnhandledException).
This screenshot shows an application that is properly executed and closed. It starts with method 0 (InitializeComponent) and calls a camera chooser (which is why method 0 is again called). This is a good example to see how Windows Phone 7 Multitasking and tombstoning works, because you can see when the methods Application_Deactivated and Application_Activated are used.
I hope this tool might be useful for some of you, especially when you want to understand how an application works. The apps can be even obfuscated. You will than only see method names like A, B, C etc. You can even check what other applications do, when they crash and that without having the source code.
If you have any ideas or find some bugs (and there will be bugs ) you can write me here on XDA or at Codeplex bugtracker. Already existing bugs and limitations can be found in the codeplex documentation.
Cheers,
Markus

rudelm said:
Hi XDA developers!
Today I present you my first open source software called XapSpyAnalysis. You can download a compiled version and the sourcecode at xapspyanalysis.codeplex.com. It is an extension to Behrang Fouladis excellent XapSpy tool.
First, you need to use XapSpy. You need to start XapSpy and select a XAP package you want to analyse. It will be unpacked, stripped from its licence information, patched, signed and repacked. The next step is to launch the Emulator. This is automatically done from XapSpy. After it is booted, the application will get deployed to the emulator. After this is completed, XapSpy will inform you, that you can run the Monitor from inside XapSpy. This is where XDEMonitor kicks in. It will log all method calls and its variables it can get from the emulator log window. When you are finished, you can stop the recording and save the file to your harddisk.
This file can be loaded into XapSpyAnalysis. It will parse the file and display its raw content in the first tab. You can now switch between different views. You can display a table that contains all method calls with their variables, the DLL file from where the method call originates and its time. The next tab lists all method names and their number of calls. The next tab lists statistic values like how many method calls were registered and how many of them were unique method calls.
The final tab displays a graphical analyis of the method calls. The x axis displays the point of time, when the method was called. The y axis displays the number of method that was called. This is an unfortunate restriction from the used graphic framework. You can find a legend on the right side of the diagram. It maps the numbers to method names. But you can also point your mouse cursor on any of the data points in the diagram. A tooltip will be availabe that shows you the corresponding method name.
Now some screenshots:
This screenshot shows an application, that crashes three times. You can see this from the data points starting with method 0 (InitializeComponent) and method 22 (Application_UnhandledException).
This screenshot shows an application that is properly executed and closed. It starts with method 0 (InitializeComponent) and calls a camera chooser (which is why method 0 is again called). This is a good example to see how Windows Phone 7 Multitasking and tombstoning works, because you can see when the methods Application_Deactivated and Application_Activated are used.
I hope this tool might be useful for some of you, especially when you want to understand how an application works. The apps can be even obfuscated. You will than only see method names like A, B, C etc. You can even check what other applications do, when they crash and that without having the source code.
If you have any ideas or find some bugs (and there will be bugs ) you can write me here on XDA or at Codeplex bugtracker. Already existing bugs and limitations can be found in the codeplex documentation.
Cheers,
Markus
Click to expand...
Click to collapse
Fascinating! I'll have to check this out against my xaps

I tried to follow the instructions but they were a bit confusing. The program crashes every time I select a XAP

@snickler: I am looking forward to your feedback
@MJCS: Ok, where do you get stuck? I still need to write a better documentation I guess
You downloaded Behrangs XapSpy and replaced the XDEmonitor files with the files from my version? Do you use the WP7 or WP7.5 SDK? There is an important difference regarding the naming of the emulator. In WP7 it is called Windows Phone 7 Emulator, while in WP7.5 it is just Windows Phone Emulator.

I am using 7.5
**
Ahhh I just noticed the 7.1 binaries. Now it works. Thank you!!!

Glad to hear I am really looking forward to your feedback!

Related

[RELEASE] Phone7Market for Windows PC v2.0 Alpha B2: finally Mango full support!

Phone7Market (previously Windows Phone 7 Marketplace) for Windows PC is an application suite. There is one application to search the Marketplace application catalog, other can download the xap packages and the last one can deploy any application to a WP7 device or emulator. Intended only for testing free apps and your own apps.
** Version 1.7 or older: To allow Mango applications in this app, read: http://forum.xda-developers.com/showpost.php?p=17427269&postcount=261
** Version 1.2 or newer: now display only fully free applications (not trials/paid/device branded apps) following the xda anti-piracy policy **
Features/updates:
Please see http://ried.cl/mobile/wp7desktopmarketplace.html for the changelog, also there is a quick video showing how to use the program here: http://www.screencast.com/t/9PkvJL50b
Requirements:
Windows Phone 7 device (unlocked) or emulator
Windows PC with Microsoft .NET Framework 4
It should require the Windows Phone SDK because the dependency of Microsoft.Smartdevice.Connectivity.dll assembly
Screenshot:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Download:
Setup program now available!:
Phone7Market v2.0 Alpha (setup)
The deployer application supports different commandline options (for batch operations for example):
Code:
wp7-deploy.exe path\to\xap\file.xap -destination[modifiers]
destination (required): is just one letter d=device, e=emulator
modifiers: up to 3 letters s=replace assemblies signatures, r=remove DRM, l=autolaunch
Example:
rem This deploys test.xap to the emulator and autolaunches the application
wp7-deploy.exe test.xap -el
rem This deploys mytest2.xap to the device replacing the signatures with your own certificate and removing the drm description file
wp7-deploy.exe c:\mytest2.xap -dsr
More info:
http://servicios.ried.cl/
Suggestions and todo:
Support for Mango 7.1 SDK! really soon (preview2?) Ready!! in the Alpha B2, search and deploy working now
Automatic updater Next priority... still
Smartpatcher functionality (to allow any "cracker" to make patches, for example to allow lg apps in other devices, etc) In progress...
Details panel (in search results)
Multi downloads/deploys?
Note:
Files attached in this post are just for backup. The most recent version will appear first in the link listed above. Please use attached files only for testing purposes.
Do not download the ATTACHED FILES if you want the latest release.
Thanks ! Now I can check the apps in the market place before I get my VZW WP7...
Does not deploy app. Tested on one of my developed applications.
microhaxo said:
Does not deploy app. Tested on one of my developed applications.
Click to expand...
Click to collapse
Any error message? Can I have you file to test it?
Says the file you tried to deploy is already installed retry?
BandWidth is the app - free in marketplace (i made sure to uninstall it on phone before deploy)
microhaxo said:
Says the file you tried to deploy is already installed retry?
BandWidth is the app - free in marketplace (i made sure to uninstall it on phone before deploy)
Click to expand...
Click to collapse
Works perfectly to me, look: http://screencast.com/t/v9yVuSiLU ... mmm that message can be a mistake, it the deployment hangs between the execution and the unninstallation it might show that message, so it can be a problem with the execution.
I don't know if for a unlocked physical device you must send the new certify by mail and install it in your phone.
Hmm, yea the video show's it working. Might have to do with my phone being a dev unlock device?
I'll try it again tomorrow.
microhaxo said:
Hmm, yea the video show's it working. Might have to do with my phone being a dev unlock device?
I'll try it again tomorrow.
Click to expand...
Click to collapse
But can you deploy your app to the emulator?
Working on Emulator
I tested it on Emulator and its working for me.
Check this out: http://www.youtube.com/user/vbguy2011
Seems to do something similar
do not work for me!
I want install in my device but got error, my phone is unlocked and zune lunched!
Thanks!
But this doesn't seem to find everything. E.g. the manufactor specific apps like LG's voice-to-text. Or also some normal stuff like "Mehr Gehirnjoggen"
all in one application, works perfectly for me! thanks!
sIiiS said:
do not work for me!
I want install in my device but got error, my phone is unlocked and zune lunched!
Click to expand...
Click to collapse
Did you receive an error description?
Hades32 said:
Thanks!
But this doesn't seem to find everything. E.g. the manufactor specific apps like LG's voice-to-text. Or also some normal stuff like "Mehr Gehirnjoggen"
Click to expand...
Click to collapse
Sorry but now its limited to fully free apps (xda piracy policy). So it does not work for brand exclusive apps, trials or paid apps.
Please add device branded apps, trying samsung apps on htc phone is not piracy
Great! Works without a problem. Make sure to check all checkboxes when deploying. Will use this until I can microsoft for my activation tomorrow morning
tbk21 said:
Please add device branded apps, trying samsung apps on htc phone is not piracy
Click to expand...
Click to collapse
Sorry but I will keep just the generic fully free apps for now. I am not sure about what you said, if is legal or not.
working perfect in emulator and the device.
thanks for the application.
i am getting error, on emulator is fine, but on device i am getting:
error deploying to the device. it seems to be a licensing problem with application
any help?
thx
SOLVED - something was messed up with certificate
Spirit81 said:
i am getting error, on emulator is fine, but on device i am getting:
error deploying to the device. it seems to be a licensing problem with application
any help?
thx
SOLVED - something was messed up with certificate
Click to expand...
Click to collapse
same problem
Can u tell me how did u fixed that please?

KINO [Kin Opensource-FileManager]

Hi there!
As i said on a thread (bit long time ago), i had the intention of making an opensource file manager for the kin.
So i have been working on for two days, and i'm reserving this thread for its releases and descriptions.
It will be given as donationware, which means that you can take it for free and donate if you wish (or not to... )
SECURITY DISCLAIMER
- As you can imagine, by using this tool you have not guaranteed the operational state with your device and is provided "as is". You are the only responsable on the effects if could have on your device, even though i tested locally all the options for hours. Like you do for 3rd party non-certified software.
- DO NOT, i repeat DO NOT unplug the device nor close the program while writing or reading from the device. Errors states are unknown and you may scr3w up your flash memory.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
- If during the usage, it takes long, WAIT for the transmission to end. Errors are handled by the program and in the last cases there are 2 to 3 levels of error treatment, notificating you in the info box and storing a brief description on the "error.log" file when it's ultra. (I'm still human, new errors can appear).
- IF during this usage the kin gets a "Connected" window and the program is clossed without closing that window, then it's the time where you can unplug and it will reset the device communication values, pluggin again. If you reach this state without doing magic, notify it to solve the bug.
Characteristics
- Libusb driver given for the kin (needs to remove the Zune one)
- Windows (XP,7) 32/64 bits. Linux (through Mono), Mac Osx(through Mono Framework) Compatibility
- Developed in pure c# (using libusbdotnet)
- Developped in layers:
----> Usb
----> Mtp Functions
----> Mtp<->Interface manager
----> Interface
Images V0.01
Requirements
- OS:
---> Windows
------->Net Framework 2.0
------->Libusb-win32 driver(provided below)
---> Linux
------->Root mode to access the devices.
------->Mono
------->Libusb 1-0 components
---> Mac OsX (Checked with Snow Leopard, PAIN IN THE ASS)
-------> Mono framework
-------> Libusb-1.0 source (sourceforge)
----------> Modern OSX compile for 64 bits. Mono needs 32 bits. Compile (as root) with:
Code:
sudo su
./configure CC="gcc -m32"
make CC="gcc -m32"
make CC="gcc -m32" install
*Note: it takes a looooooooooooooooooong time to load the first time. be patient
*Note2: if mono yells about needing X11 for Winforms, download Wireshark for OSX, which has X11 easy installation inside (needed for it).
Download links
Kin Driver (libusb-win32): (Create one with InfWizard for the kin PID and VID)
32 bit version: http://www.mediafire.com/?0nhrdn7f5je6dcx
64 bit version: (please use above version)
Source: ***Still needs a bit more documentation, cleaning and binary testing for errors ***
* Note that i DONT have a 64 bit hardware, so i based its compatibility on the failed running in my Windows 7 (aka "this is for other architecture error")
** Note that to use this driver you MUST remove the Zune driver. I recommend to test it on a clean virtual machine first
Functions
- TreeView Kin Storage explorer (Auto Resyncs after each operation)
---> Select one or multiple items with the checkboxes next to them.
- Batch upload to the kin (to the root of the tree)
---> Select one ore more files from the selection dialog and go go go. Any file, anytime
-------> **Danger** pressing twice will upload files twice, be patient.
- Multiple file download from the kin
----> Mark any file from the tree and press "Download". The file will be downloaded to a subfolder "Downloads" next to the exe, where the tree storage has been replicated.
-------> **Danger** Folder and Playlists and other files are just logical, and have no size, so program deals with them as folders (and are created emptied in the local system at the pc)
- Multiple file delete
-------> Mark any file from the tree and press "Delete". After confirmation, the files selected will be removed from the device.
-------> **Danger** Folders are not deleted. Infobox at the bottom will inform you if a file could not be deleted.
-------> **Danger** I trickied it so the storage root could not be deleted... ahhh smart little fellas.. you were already thinking in that huh! rofl.
Known issues
- During my random tests around, i found that sometimes (dunno why exactly), the kin <-> Kino communication skips a step, messing up the mtp communication schema. The solution i used in this release was to show the root storage without children nodes. As this case is an error, you should tell me if you know a repeatable way to get it so i can retest and solve it.
To keep going with the kin, close Kino, and unlock the Connected window (slide your finger over it) and unplug & plug the usb again.
F.A.Q.
- Q: No donation button in the end?
- A: Nope. Just when it proves to be useful .
- Q: This works with Kin One devices?
- A: No. I only have access to Two (bricked) and TwoM devices, so cannot test for the little round turtle.
- Q: Do you provide a driver for Kin?
- A: Yes. It is only a bridge from the programs to the libusb-win32 functions. Unfortunately, you would have to remove the zune driver (Hardware manager) before using this one.
- Q: This bricks kin devices?
- A: At all.
- Q: This can hack the device?
- A: No. This is only a tool to upload and download files to your kin. If later it's used to hack, good anyway
- Q: Can this upload *any* file to the kin storage?
- A: Yes, binary files like exe, cab,pdf, ... will be labeled as 0x3000 (undefined filetype) for the kin.
- Q: Can i take the code and make my version called OmgKinManager?
- A: Yup. It would be a nice detail to include a little text in "about..." regarding me though
kk, apart from the above, i'm a bit stuck on the uploading procedure, doing it dinamically, not with known filesizes like i tested before.
I will try to get it to work and allow multiselection file dialogs.
Later, downloading, which is easier, as i just request files. I will try to make the selectable tree work, so several files can be downloaded at a time.
Btw, the tree is not a demo, it's my real storage, being asked to the kin. It's a long process, as i ask for the id's and their values to the kin to create a Tree structure, later parsed by the interface.
Whenever that and deletion is done, i will upload both the driver and the program/source to the public.
For Zune's functionality lost scared people, i would suggest to try on a windows virtual machine first (which i will do to test for .net framework requirements and so)
Way cool imn glad to see some progress
Nice work! I spend a lot of time on this forum reading posts and 75% of the time it's your post. You've spent a lot of time working on this project and we all appreciate it. Expect a donation from me in the near future
I'm speechless.
Hey john, you have only gotten into the media section correct? What type of things have you gotten to do if i may ask. If you want, I can help get "into" the other parts of the phone. A.K.A contacts. That's my main concern right now. I could care less of customizing the OS (which I will get to if you care to lend a hand.) Since I don't want to Say anything just yet, send me an email to [email protected]. I would like to help. I'm on my phone at the moment but tomorow I'll post how i got the phone into a writeable state (which I don't know if it still work. I've only tested twice.) If it doesn't work tomorrow, I'll donate my time during the week helping you guys. I may need to get a new battery.
P.S. It's taking me awhile to do this becuase I dont want to brick my phone. Im definately not using my enV touch!
please, read the faq above. this is not a hacking thing, but a sync one.
to be honest, i dont care about contacts cause i dont use this phone to make calls and i just wanted it to be more open. pinned apps or phone settings storage would be my only interest apart storage folder.
also, i dont want to keep secrets or long term waiting things. post what you want or dont post, but dont make it a teaser of nothing. plus i dont wanna go emailing people.
Props to you. Great utility, if it were able to get deeper into the system. Then it would be golden.
Edited for many reason
As some other forumeer seems to have gotten into the phone system, imma halt this development till acess range is shown (filesystem / storage / settings), if any.
There's no need to redo all the required mtp subsystem if we can get there by other (easier) means. OS native explorer, for example.
just go ahead and work on it in case the other guy fails. ^.^
oaktree333 said:
just go ahead and work on it in case the other guy fails. ^.^
Click to expand...
Click to collapse
Nice future-sight on this post
I just tested the file upload in the command-line again with static (coded by hand) filesizes.
Here is a new vid (hahaha famous ultralowres) where a file is upload to a just-formatted kin (CB+power).
File: dstpa.mp4 (BEP- Don't stop the party), 33.1MB
Destination: Kin storage root
Playable after upload: yup!
Mp4 tags: At all .
Just a upload showcase, not just naming the procedure .
nice nice ^.^
more freedom in file management I like.
woot goodjob
I have to give you kudos for your dedication. You kept at it even after you bricked your first kin.
I patiently await a release.
I'm trying to get the alpha release up today (tonight here).
I was in the mood and moved my coding-ass. Solved most of the problems on-the-go, but downloading.
I'm trying to allow multidownload keeping same directories on the pc... just cause i wanted to... rofl.
Hummmmm,
EVERYDAYIAMSHUFFLIN
Mmm after discovering several things, and implementing a lot of bugfixes (didnt know some things about MTP), there it is.
here, and all the versions are updated and uploaded in the 1st post, among the driver for it.
As posted there, i suggest to use it on a virtual machine with .net framework 2.0 cause the removal of the zune's driver for the kin.
You can now take your kin and (if the driver & program behave correctly), upload the files you want to the Kin.
Any type of file, any time.
I'm pretty naughty telling this, but apart from uploading....... i don't check for the file contents... so if any of you want to turn a .exe into .mp4 to look for exploits i wouldnt blame you for testing....
Double naughty if i say that Zune doesnt load info from the files itself, but only what was transfered from MTP (.. poor fella)
You can check that, cause it will only load the filename and name of the mp3, ... cause i did that (before today, i just sent filename, which makes its name blank on zune, like you saw in my video from BEP).
Hope you all enjoy and no errors appear.. rofl.
Btw, there's no donate option, cause i think it's more fair to think about that when the program is known to work, and not just alpha releases .
It's 02:53 AM here, so i better go to bed, to work tomorrow and that things....
I just wish this thing could play games lol.
@Johnkussack
Wow. I have to say thank you for putting your time and effort into really hacking this phone. I can't wait to see someone get android or wp7 running on this thing (if it's even possible with the hack you have, I'm not sure). Ether way, thanks for everything.

[HACK] Using complete Windows API in Windows Store app (c++)

As we know, MS prohibits using most of standard Win32 API in Windows Store applications. Obviously there are lots of ways to overcome this limit and to call any API you like, if you are not going to publish your app on Windows Store. And here is one of them.
Idea is really simple and rather old (lots of viruses use it): search for kernel32.dll base in memory, then parse its exports for LoadLibraryA and GetProcAddress, call them - and get profit.
Writing here so this post can be indexed by google.
Partial code:
Code:
void DoThings()
{
char *Tmp=(char*)GetTickCount64;
Tmp=(char*)((~0xFFF)&(DWORD_PTR)Tmp);
while(Tmp)
{
__try
{
if(Tmp[0]=='M' && Tmp[1]=='Z')
break;
} __except(EXCEPTION_EXECUTE_HANDLER)
{
}
Tmp-=0x1000;
}
if(Tmp==0)
return;
LoadLibraryA=(t_LLA*)PeGetProcAddressA(Tmp,"LoadLibraryA");
GetProcAddressA=(t_GPA*)PeGetProcAddressA(Tmp,"GetProcAddress");
CreateProcessA=(t_CPA*)PeGetProcAddressA(Tmp,"CreateProcessA");
HMODULE hUser=LoadLibraryA("user32.dll");
MessageBoxA=(t_MBA*)GetProcAddressA(hUser,"MessageBoxA");
MessageBoxA(0,"A native MessageBox!","Test",MB_OK);
STARTUPINFO si;
memset(&si,0,sizeof(si));
si.cb=sizeof(si);
PROCESS_INFORMATION pi;
CreateProcessA("c:\\Windows\\system32\\cmd.exe",0,0,0,FALSE,0,0,0,&si,&pi);
}
Complete project is attached. It contains sources and compiled appx files for side-loading.
Code compiles fine for x86/x64 and ARM, tested on x86/x64. Can someone test it on ARM? Ability to sideload metro apps is required.
The application should output a MessageBox, then execute cmd.exe.
A note: Windows Store application runs in a sandbox and as a limited account, so most of API returns "access denied". You can check this in a launched CMD - it displays "access denied" even on a "dir" command because normally "modern ui" apps don't have even read access to c:\.
To overcome this - add "all application packages" full control to the directories/objects you like (for example to c:\).
Works perfectly on my Windows 8 x64 Tablet :good:... its not ARM based though ...
Can i use this to run a non-store app?
Here is the catch, I have managed to get the installed (not the installation) file from a kind member here on XDA. But when I paste the folder in:
C:\Program Files\WindowsApps\Microsoft.ZuneMusic_1.0.927.0_x64__8wekyb3d8bbwe
The app isnt seen on the metro UI?
Any way to start a scanner of some sorts so that I can see the app in Metro.../?
THanx a ton!
Plz feel free to laugh a little at my noobish question...im stil learning..
Works perfectly on my surface RT!
but type dir in CMD returns "access denied".
There are no code signature checks from the command prompt that you launch.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Code:
#include <iostream>
void main()
{
std::cout << "Hello RT World!\n";
}
Compiled as an exe with info in http://stackoverflow.com/questions/...op-programs-be-built-using-visual-studio-2012
Open properties of your disk c:, go to the security tab and add "ALL APPLICATION PACKAGES" == full control. In this cage "dir" command would work, and your apps would be able to access whole filesystem.
Sorry if it's unrelated, but does RT check signatures for loaded DLLs too? Can one run regedit and change some system CLSID to point to unsigned library, will it be loaded?
Simplestas said:
Sorry if it's unrelated, but does RT check signatures for loaded DLLs too? Can one run regedit and change some system CLSID to point to unsigned library, will it be loaded?
Click to expand...
Click to collapse
Unless the dll is loading with a restricted security policy (such as through a Metro app) it is checked, yes.
Excellent work on the 'App1' technique of starting a cmd prompt from a modern app, and the fact it can run other unsigned cmd line apps.
Note that the cmd prompt still runs in the modern app container and probably has lots of restrictions
And also it only runs when the modern app is running and effectively freezes when the modern app goes into the background and suspends
Don't seem to be able to run win32 gui apps from the cmd prompt it starts -- they start but immediately terminate, presumably because the full win32 stuff cant initialise in a modern app container.
But can tum gui win32 api's, like the create dialog one, from the App1 modern app
Luckily we can also test, investigate and debug this on an intel Windows 8 system (dual monitor is best) when trying to work out what is going on, and then test on ARM after that.
@Simplestas: LoadLibrary is also blocked, I'm afraid. One fo the first things I tried was creating a DLL compatible with the built-in rundll.exe program and using that. It failed to load the third-party library.
@xsoliman3: Don't forget the debugger. You can't run it on the RT device right now, but there are (official) tools for debugging RT apps remotely. That should allow connecting to the child process and seeing what happens as it starts up.
GoodDayToDie said:
@Simplestas: LoadLibrary is also blocked, I'm afraid. One fo the first things I tried was creating a DLL compatible with the built-in rundll.exe program and using that. It failed to load the third-party library.
@xsoliman3: Don't forget the debugger. You can't run it on the RT device right now, but there are (official) tools for debugging RT apps remotely. That should allow connecting to the child process and seeing what happens as it starts up.
Click to expand...
Click to collapse
Great seeing you again!
Anyways, I determined from some work with the VS Remote Debugger that the integrity checks are enforced in ZwCreateUserProcess. But, I bet LoadLibrary has its integrity checks in user-mode, since it normally doesn't access any functions using a call-gate to the kernel on Windows 7, which would mean we can modify it to allow us to load unsigned DLL's.
However, with this vulnerability, I had a different. What about allowing a native application to open, such as Notepad, and before it reaches the entrypoint, remotely injecting a different application to be ran (this would involve some sort of custom LoadLibrary + CreateRemoteThread pair of functions)? With the VS Debugger, you can already attach to any native process in user-mode and modify running code, data, and even the context (e.g. registers and similar data).
That suggestion is possible, and for trivial operations (i.e. replacing some strings in a program, or causing it to take one branch instead of another) people have already done so. Doing a wholesale replacement would be tricky, but should be possible (perhaps aided with WinDBG scripts or similar).
GoodDayToDie said:
Doing a wholesale replacement would be tricky
Click to expand...
Click to collapse
Not so tricky, I've already made a prototype on desktop Win8. Just make an ARM DLL that implements a PE loader using only 2 WinAPI functions - LoadLibrary (used only to get kernel32 handle) and GetProcAddress. Inject that DLL code and data sections via debugger, fixup relocs (you can minimize their amount in your "loader DLL" by not using global variables, placing all code into one file, not using CRT at all, and so on, ARM makes it easy to create position-independent code), and call your injected code via debugger passing it the address of LoadLibrary and GetProcAddress as parameters. Your code than would do what you wish - load and execute an unsigned DLL that you specify.
With this trick you can load EXE files too, as all ARM EXEs contain relocs by default.
But this way is too inconvenient to the end-user, so should be avoided. I really think that MS left enough holes for us to "unlock" unsigned apps on retail WinRT devices.
I'm already thinking on buying an Asus tablet with 3G (instead of waiting for a better device that I wish), so after NY holidays I'll join your game
Ah, that's a much more clever approach than actually trying to load the full program using the debugger itself... if it works. LoadLibrary triggers the same signature check that CreateProcess does (or rather, the system calls that they do will perform that check; if it was user-mode we could bypass it with the debugger). Your method may work, but since the desktop doesn't have the signature check anyhow, prototyping it there doesn't actually mean it will work on RT. Try it out and let us know how it goes, and if it works, posting your source would be awesome!
GoodDayToDie said:
Ah, that's a much more clever approach than actually trying to load the full program using the debugger itself... if it works. LoadLibrary triggers the same signature check that CreateProcess does (or rather, the system calls that they do will perform that check; if it was user-mode we could bypass it with the debugger). Your method may work, but since the desktop doesn't have the signature check anyhow, prototyping it there doesn't actually mean it will work on RT. Try it out and let us know how it goes, and if it works, posting your source would be awesome!
Click to expand...
Click to collapse
He doesn't mean making a prototype and importing from kernel32.dll. He means manually mapping the PE file, then using either CreateRemoteThread or modifying the context of a thread already launched to run it once it's in the memory address of another process. It's basically DLL injection with our own implementation of LoadLibrary. It would work because LoadLibrary doesn't use any system calls except to map memory (and mapping memory doesn't have integrity checks of any sort, and it shouldn't be design -- e.g. VirtualAlloc).
A bigger problem I thought of is automating this. I took a quick peek with Wireshark at my remote debugging session and saw HTTP with what appeared to be a proprietary protocol. In order to automate this from another computer (or any mobile device for that matter), we would need to reverse engineer the protocol. Or, an alternative would be to hook into Visual Studio once the debugging session is launched (maybe just a nice VS plugin would work?).
mamaich said:
Code:
void DoThings()
{
char *Tmp=(char*)GetTickCount64;
Tmp=(char*)((~0xFFF)&(DWORD_PTR)Tmp);
while(Tmp)
{
__try
{
if(Tmp[0]=='M' && Tmp[1]=='Z')
break;
} __except(EXCEPTION_EXECUTE_HANDLER)
{
}
Tmp-=0x1000;
}
if(Tmp==0)
return;
Click to expand...
Click to collapse
I was looking through the provided sample -- wouldn't our own GetModuleHandleA implementation be a better way of doing this? I'm just thinking should the alignment be changed in kernel32.dll it may be better to have something like this:
Code:
522 if (!name)
523 {
524 ret = NtCurrentTeb()->Peb->ImageBaseAddress;
525 }
526 else if (flags & GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS)
527 {
528 void *dummy;
529 if (!(ret = RtlPcToFileHeader( (void *)name, &dummy ))) status = STATUS_DLL_NOT_FOUND;
530 }
Source: http://source.winehq.org/source/dlls/kernel32/module.c#L504
Grabbing the Peb (NtCurrentTeb()->Peb) would involve pulling from the FS register at offset 0x30. Implementing this on ARM could be trickier, as I'm not sure of the inline assembly or availability of intrinsics (not to mention, it would be stored somewhere else than the FS register).
Now, for the PC, it appears __readfsdword is available as an intrinsic, so this *should* work on x86 installations of Windows 8.
mamaich said:
Not so tricky, I've already made a prototype on desktop Win8. Just make an ARM DLL that implements a PE loader using only 2 WinAPI functions - LoadLibrary (used only to get kernel32 handle) and GetProcAddress. Inject that DLL code and data sections via debu
Click to expand...
Click to collapse
I think this approach (of injecting own loader as far as understand) has such problem(even if implemented & automated)
Loaded exe can have own dependant dlls(any complicated-usefull proj has) that it cant load because of signing checks (and even more problems if it uses dynamic loading of own dlls and getprocaddress)
Or do i miss somth in your idea?
Will I be able to read/write to a parallel port using this method? Do the limited store apps have sufficient permissions to do that? Writing to a parallel port requires calling
Code:
hndleLPT = CreateFile("LPT1",(GENERIC_READ | GENERIC_WRITE), 0, 0, OPEN_EXISTING, 0, 0);
. Will this succeed?
Will I be able to successfully load this: http://www.highrez.co.uk/Downloads/InpOut32/default.htm ?
---------- Post added at 03:01 PM ---------- Previous post was at 02:11 PM ----------
This looks like an improved method to get the base address:
http://tedwvc.wordpress.com/2013/07/19/finding-the-kernel32-dll-module-handle-in-a-windows-store-app-using-approved-apis/
You should be able to do that using CreateFile2, which is permitted in Store apps already (no need to use the rest of the Win32 API). As for the permissions, I don't know, but it will probably work.
I mean, assuming your computer *has* an LPT port. I haven't seen one of those in a while...
how about the other way round? can a desktop app have access to the full windows 8 api (including those reserved for win store apps only)?

WP7 FTP+HTTP Client public library - need testers

Hi Friends.
I did some attempts to make working WP7 FTP(+HTTP) library. It may allow to endpoint applications to list, upload and download ANY files (include binaries etc.) from FTP or HTTP servers.
The simpliest way is to use web service. I have got working one, but based on closed code hacked, then it is possible for my internal use only, not for public presentation. Second problem is web services unstability.
Second way is native code, allowed by RootProject or custom ROM. First I tried MFC Internet+FTP classes. But WinInet functions are disabled or not present in WP7 core (or I do not know only, how to allowe them).
Then I have got public multiplatform source FTPClient library, based on native sockets management, and did (very small) changes in it to be usable at unlocked WP7. Library is working now. But, only simple native test application is finished and I have no free time now.
If you somebody want to participate, write here or send me PM. I will send FTP account to site, containing full source code and FTP test subsite too.
It is needed:
1. To repair SIZE command. On some servers library gets code 550 SIZE is not allowed in ASCII mode (library changes mode in download time only).
2. To make better, WM/WP consistent interface.
3. To make managed wrapper (we will do it to w.i.n.c.o's wNativeCom library and as Phone Commander plugin, but WP7DllImport wrapper is needed too).
4. To make automatical tests or to test all functions manually.
5. To refactorize all project by used code opensource licence.
Martin7Pro said:
Second way is native code, allowed by RootProject or custom ROM. First I tried MFC Internet+FTP classes. But WinInet functions are disabled or not present in WP7 core (or I do not know only, how to allowe them).
Click to expand...
Click to collapse
WININET is working and internally used by MS apps.
ultrashot said:
WININET is working and internally used by MS apps.
Click to expand...
Click to collapse
Thanks for info. I thought that it must be used. But, when I use WinInet CE6 API, I have got error "This function is not supported on this system". What I must do to use InternetConnect() etc? Thanks, M.
Martin7Pro said:
Thanks for info. I thinked it must be used. But, when I use WinInet CE6 API, I have got error "This function is not supported on this system". What I must do to use InternetConnect() etc? Thanks, M.
Click to expand...
Click to collapse
I don't know what you use and from where do you get this error - it mustn't happen if you use APIs directly.
ultrashot said:
I don't know what you use and from where do you get this error - it mustn't happen if you use APIs directly
Click to expand...
Click to collapse
Code:
HINTERNET hInternetConnect;
HINTERNET hOpen = InternetOpen (L"FTP",
INTERNET_OPEN_TYPE_PRECONFIG,
NULL, NULL, 0); /// This function works OK.
if ( !hOpen )
{
AfxMessageBox(L"Failed to open WinInet");
}
else
{
hInternetConnect =
InternetConnect(hOpen,
m_URL,
INTERNET_DEFAULT_FTP_PORT,
m_Username,
m_Password,
INTERNET_SERVICE_FTP,
INTERNET_FLAG_PASSIVE,
0); /// This function returns error.
if( hInternetConnect ){
AfxMessageBox(L"Internet Connect succeded");
/*
if(FtpGetFile(hInternetConnect, m_Filename_Remote, m_Filename_Local, 0, 0, FTP_TRANSFER_TYPE_BINARY, 0))
{
}
else{
AfxMessageBox(L"Get File Failed");
return false;
}
*/
InternetCloseHandle(hInternetConnect);
}
else
{
CString csError = ErrorString(GetLastError());
TRACE(csError);
AfxMessageBox(csError);
return false;
}
InternetCloseHandle(hOpen);
}
returns:
This function is not supported on this system. Error code : 78
And another, bigger problem:
When I uncomment FtpGetFile part, application is compiled and deployed OK. But after starting it does nothing, it does not want to start totally. I do not understand, how can the unused portion of the code affect the behavior of the application starts.
Socket library does not do anything similar.
Microsoft!!!
http://support.microsoft.com/kb/2735592
But patch is developed for ARM >=5 only and licensed to PB customers.
Finished - test binaries
Hi friends. There are binaries for testing. Predefined values download nice picture from our Czech glamour atelier to your "Storage card" device directory, but you can try much other servers, directories and accounts. All directory contents may be downloaded to your :Storage card" directory, no selecting is possible in example. I mean there will problems after firewalls etc., post your feedback. WinInet really does not work on WP7 for FTP servers, there is used little changed class from D. J. Bernstein and codeproject. If anybody know, how to export STL templates from dll, help me. Use "Exit" button for appclosing instead WP7 usual "Esc".
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Edit: There is actual version (without licencing conflict probably).
Managed wrapper will be added later (by wNativeCom probably). XAP istallable example for non-developers in deeper future.
Code is totally thread unsafe, after validation I will use http://forum.xda-developers.com/showthread.php?t=2208647 for it.
You can try unfinished Silverlight version:
http://wp7ftp.howto.cz/XDA/FTPClientExample.xap ... will be updated. EDIT: Xap 1.1 version is available from April 5th.
http://wp7ftp.howto.cz/XDA/FtpClientLibrary.dll ... this native library is needed in your device "\Windows\" directory (download and transport it to place). EDIT: If it not works on any device, try to delete \Windows\FtpClientLibrary.dll and install xap 1.1 version only.
Preliminary results:
1. Native FTP library works well.
2. Managed/Native callbacks synchronisation works well. (Thanks to MS idiots I must code all desktop like functionality again). There is a most important part for mechanism studying.
3. Silwerlight for WP7 is the most stupid and bugged Microsoft feature.
Simple app description:
Type Host, User, Pass and Remote (dir) values. You can stay predefined for testing. Tap to "Connect". You can see result in scrollable block on the bottom. If unsuccess, check your internet connection and typed strings, try again. If success, tap to second empty line under "Remote" (thanks to normal multiselectbox WP7 absention). Check wanted file names and tap do bottom cross (is it normal in ListPicker to have two crosses???). Tap to "Download". It is all. You can tap to "Disc.", change remote path or server values and tap to "Connect" again. First empty line under "Remote" contains remote directories list, but I am too busy to finish any logical directory tracing with bugged and unlogical Silverlight Toolkit features.
Known bug: Edit: Solved in 1.1 version. If deadlock occures still (unavailable FTP response), app restart (or phone reboot) helps you. Do you know anybody, if SL TextBox has limited capacity and how to bind string list to ListPicker?
Attention: "Connect" again after successfull previous connect and without disconnect = possible memory leaking!
Note: It is FTP. Must wait for all directives any seconds. If unsuccess, try the same again. This is normal FTP beahiour by mobile connection.
If anybody want, libraries are opensource and you can download them from the same FTP, which is used as predefined example values, or equal http http://wp7ftp.howto.cz/XDA/. You all have full FTP access, do not change anything important, upload relevant patches only! Managed part (Visual Studio 2010 for WP) is usable along by FTPClientUIDebugManagedWrappers.sln solution. I want to add FTP as plugin to Phone Commander only, I mean two-pane UI is the best solution of the FTP client. But, standalone FTP client can be usable too, when somebody Silverlight experienced will repair listControls behaviour there (all n/m callbacks are prepared, UI finishing is necessary only). Download only is finished in native library, upload will repaired in next versions.
Version 1.3
Uploaded FTPClient v 1.3 (the newest version is allways on http://wp7ftp.howto.cz/XDA/FTPClientExample.xap) solves ListPicker issues. Instead Remote Directories ListPicker is used totally wrong, but functioning global strings listbox, I am too busy to solve SL toolkit bugs now.
Known bug: Native library losts connection sometime and does not inform main application about it. You will see empty directories list from non-empty directories in this case. Application (or sometime device) reset helps you.
Known restriction: Server must be typed by name alias, not by IP address. I do not know why still, it will probably repaired in future versions.
Version 1.4
V 1.4:
Repaired file unselect after directory changing.
Showed "./././.." instead ".." as "Up" directory for better tapping.
Response TextBox content is rounded to 1000 characters. Is it a known TextBox bug to show any first characters only?

[TOOL][ADB][ROOT] Windows Android Commander USB-WIFI File Manager built-in AUTO ADB

Android Commander - Windows ADB USB/WIFI FULL FEATURE ROOT EXPLORER
​This is the very finest full featured automatic ADB file explorer for your phone which allows you to access
and use all of the functions of your phone including ROOT directly from your windows computer.
You don't even need to know any ADB commands to use ADB functions since they are all automated​
No more need to flash ZIP files including ROMS and installing APK's using your phone.
Now it all can be done right from your Windows computer using Android Commander.​
If you would like to check it out, here is the direct download link: Android Commander
Check out this screen capture of what Android Commander looks like
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
NOTICE: This is NOT a flashable zip or an APK - This is a Windows application.
With some phone models you may need to download ADBD Insecure from the Play Store.
Here is the play store download link: https://play.google.com/store/apps/details?id=eu.chainfire.adbd
After it's installed open the app and click on "Enable insecure adbd" before using android commander.
If you like this program please consider giving the developer panpiotrm a PayPal donation.
Click HERE to donate and be sure to visit his website at: http://androidcommander.com
Please note: I am not the developer of this fine program.
Here is a list of all of the features and options​
Multi device support easy switching between devices
USB Mode
WiFi Mode
No Device Mode
create logcat
virtual input
Device Info window
android files/dirs properties window
change files and dirs permissions from properties window
toolbar search in maps and market on the phone
open url in phone browser
address tabs
bookmarks in extended window
search on web android market button in app info window
delete multiple files/dirs in win tab
sort by date in win tab and installer
remove apk association
signing files from context menu in win tab
customisable lists in program settings, you can change font size, colour position
progress bar on windows (win7/8)
copy multiple files/dirs between Device and PC
copy multiple files/dirs between Device folders
delete multiple files/dirs from Device
drag&drop multiple files/dirs from and to program
drag&drop files/dirs between program tabs
files/dirs properties
edit files/dir permissions
create bookmarks
new dir and rename options
batch/single apps install
install as private
install as update
install as system app
batch/single uinstall apps
uninstall system apps
uninstall and keep app data
batch/single apps backup to any dir on Device/PC
app details
search app on Web
full windows integration
search apps in device
search location on device Google Maps
open URL in device browser
device ROM partitions
battery checker
run any shell command
run sh script from PC
messages coloring
message type filter
flash any zip update/ROM/mod from PC
flash recovery/boot/system/userdata/cache image from PC
emulate device keys
send text to device text field
sign any zip file
sign any apk file
program explorer integration
reboot, reboot to recovery, reboot to bootloader, power off device
screenshots
Phone Requirements:
ADB ROOT Access
BusyBox
Settings->Applications->Development->USB debugging” must be enabled
USB Cable
Computer Requirements:
Windows XP/Vista/7/8
ADB USB Driver
Java JDK
-------------------------------------------------------------------------------------------------
Be sure to give the developer of this app a big thanks and
if you like his work please support him by give a donation.
I use to love the crap out of this thing and used it daily. Definitely legit and definitely a have to have item for people. Easy to use and beyond useful. Great stuff.
I'm glad to see it back. The website and it was gone for a little while.
re: Android Commander
ShinySide said:
I use to love the crap out of this thing and used it daily. Definitely legit and definitely a have to have item for people. Easy to use and beyond useful. Great stuff.
I'm glad to see it back. The website and it was gone for a little while.
Click to expand...
Click to collapse
I really like it too, I have never seen anything even similar to it.
Do you happen to know any other windows file explorers which are even somewhat similar?
(not counting the wifi apps from the playstore which uses internet for basic & slow file copy)
As far as anything close to ADB Commander? No I dont. I know of these, which more just an adb with a easy friendly ui. But nothing even close to AC and its file manager and ui
http://forum.xda-developers.com/showthread.php?t=2237530
http://forum.xda-developers.com/showthread.php?t=2448464
http://forum.xda-developers.com/showthread.php?t=2248920

Categories

Resources