Develop Bugs

Question on "hand modified XIP chain"

Could you explain please (very short description) how you modified the xip chain for rom kitchen?
All I can see is the following:
- no length (0)
- no RSA1 signature
- only file entries
What I want to know:
- how to find phys. (ROM) position (do you use unused holes in rom?)
- is 0 length for ROM = autolength
- how to choose the RAM position
- why can length of RAM be 0
Please help. (I need this info for a smartphone project)

I did not bother setting the length, only the 'pvAddr' field is used.
I only make fileentries, because I have yet to implement the generation of modules. ( if I ever do ).
yes, I use unused holes in the rom.
actually, if you don't care about xip updates of other sections, you
may use addresses anywhere in the rom, where your data fits.
It does not nescesarily have to be contigous.
I just copied the ram setting from the other xip entries.

Thank you for the information.
Why don't you take romimage.exe from platformbuilder to generate a XIP block. You only have to write a little .bib file for it. This tool can handle modules and compression as well.
John
P.S. Source code for romimage.exe is available in PB 4.2 private build tree.

I hadn't found that tool yet when I wrote makexip, and then we couldn't have made the romkitchen with it, since romimage.exe runs only under windows.

Don't waste your time with this crap tool (romimage.exe). Some needed files are missing (e.g. bin2xip.exe).
How can I be sure to choose a good phys. addr.? There might be some memory mapped devices...
I have one additional difficult question:
Modules are relocated when embedded into XIP's. Even there seems to be a modification to the import table of the module (e.g. references to coredll.dll will be checked/updated?)
If I extract a module (e.g. a *.dll) from a XIP of an other phone do I have to re-relocate it / modify it's import section even if I place it in a FILES section?
Thanks
John

converting bin to xip is not that difficult. see http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html
do you mean the 'physfirst' field in the romheader? that is just the startaddress in the rom.
since the relocation information is not stored in rom, the only way to really
recover it, is to disassemble the file, and find the offsets to stuff that
needs to be reallocated.
so that is a lot of work. and dumprom only extracts nonrelocatable .exe and .dll modules.
if your extracted dll is fixed to a memory location that overlaps with an already existing dll, you will have a problem I think.
I am not even sure, if an extracted dll works at all, I only use them for reverse engineering.

Yes, I mean phys first field. But how can I be sure to choose a valid address for the new XIP block?. My idea is to use address space between existing XIP blocks. Or can I simply choose a very high address (e.g. 8F000000) and hope not to use a region where memory mapped devices are located?
Since I used (your?) dumprom to extract the *.dll files do you think they are "nonrelocated"?
John
I ask so much because I crashed my lovely smartphone a week ago. :-(
My new XIP seems to be invalid... so it doesn't boot anymore. Unfortunately I've killed the bootloader too...
When I try next time (I've ordered a new one) this must not happen!

I am sure they are nonrelocated, fixed to run from a specific memory location.
( just wrote another post about this )
maybe even the module loader does not allow non-xip modules to be loaded in xip reserved memory.

THANK YOU VERY MUCH
I've got it. My Smartphone now have a new XIP block with some files in it...
Only thing left is to rewrite some *.dll files (only resource dlls with no function exports) to extend the language of the MIO 8380.
Are you familiar with languages on smartphone? There are multiple .mui files (resource dlls containing all the dialogs and strings). I've exported all resources and (re)created the dll's as resource only. Unfortunately they don't work ... yet ...
Are there some other files for language extension? What about "wince.nls" or "mxip_lang.vol" ?
Thanks again for your great tools. I will setup a site containing detailed information about this hack soon.
John Smith

cool, I am always interested to see how things work out that I haven't actually tried myself yet.
is this how you create resource only dll's:
http://www.xs4all.nl/~itsme/projects/programming/icondll.html

Currently I'am a little bit confused. PB 4.2 docu says MUIs are resource only .dlls and sample in smartphone sdk adds a dllmain...
I will have to investigate this things a little bit more...
John

O.K.
I've tried anything. The only thing left is that the new resource dlls are not XIPed as modules...
The sample mui app works fine (regardless of resource only / normal dll).
John
P.S. I've successfully changed all other settings some things already appear in the new language. Only poutlook, homescreen and control panel will not change!

Now after some more testing (included a dllmain into the mui file which logs the loading/unloading to file) it seems that my mui.dll is never loaded by system (if I load it manually with LoadLibrary the log is written).
Here is my question:
I've looked a little bit deeper into the dumped mui.dll and found a pointer in security section (pe header) which points to nowhere (just after the [virtual] end [rva] of all of the e32/o32 sections).
Could it be, that I've missed something? Does dumprom fill in this values correctly?
One other interesting idea could be to exchange only the data section of the module (since I want to patch resource only .dlls). But since english is a very short term language all other files will be bigger...
John

>>> I've got it <<<
the new (mui-language) modules have to be REAL xip modules...
So I've build a custom.bib file and used RomImage from CE3.0 Platformbuilder. Even compression is possible now.
Note: romimage.exe does the same thing as makexip.pl
To share my results here is the content of the .bib file I've used:
Code:
MEMORY
; Name Address Size Type
MYXIP 81f00000 0013f000 RAMIMAGE
RAM 8c020000 00fe0000 RAM
CONFIG
COMPRESSION = ON
PROFILE = OFF
ROMFLAGS = 2
ROMSTART=81f00000
ROMSIZE=13f000
ROMWIDTH=32
DLLHIGHADDR=00b00000
MODULES
; Name Path Memory Type
; ------------------------- ------------------------------- ------ ----
outres.dll.0407.mui input\outres.dll.0407.mui MYXIP SHU
syncres.dll.0407.mui input\syncres.dll.0407.mui MYXIP SHU
tapres.dll.0407.mui input\tapres.dll.0407.mui MYXIP SHU
tshres.dll.0407.mui input\tshres.dll.0407.mui MYXIP SHU
wmplayer.exe.0407.mui input\wmplayer.exe.0407.mui MYXIP SHU
FILES
; Name Path Memory Type
; ------------------------- ------------------------------- ------ ----
Busy.0407.mid input\Busy.0407.mid MYXIP
mxip_lang_799.rgu input\mxip_lang_799.rgu MYXIP
ms_splash.gif input\ms_splash.gif MYXIP
carrier_splash.gif input\carrier_splash.gif MYXIP
- The MYXIP region in MEMORY section is a hole in the ROM I've found with calcgaps.pl.
- The RAM region is copied from the other sections (they all use the same)
- ROMSTART and ROMSIZE have to be the same values as defined in MYXIP
- DLLHIGHADDR has to be the !!!lowest!!! loading address found with dumprom (header: dlls=...-... ).
Example: If the lowest address found is "header: dlls=00b00000-00c90000 ..." then DLLHIGHADDR has to be 00b00000
Don't care about the warning the warning "Unable to do imports from ... to COREDLL.dll - will late bind". Thats because coredll is in another XIP.
John
P.S. Thanks a lot for all of your support.
DETAILED INFORMATION ABOUT THIS HACK CAN BE FOUND HERE:
http://smartphonerom.tripod.com (only download the "detailed information")

ALL rgu to hv conversions are wrong!!! WHY?

Has anyone else noticed that the HV to RGU and RGU to HV convertors Suck.
None of them work properly and they throw load of errors up.
Below is an example of what i am getting:
[HKEY_CLASSES_ROOT\CLSID\{BDE41C5F-EB7D-4c3d-8C9C-12D8F68B24D9}\InprocServer32]
"ThreadingModel"="Free" @="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}]
@="Active SSCE remote data access Object"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\ProgID]
@="SSCE.RemoteDataAccess.3.0"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\InprocServer32]
"ThreadingModel"="Free" @="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}]
@="SSCE Active Sync Engine Object"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\SSCE Active Sync Engine Object]
@=""
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\ProgID]
@="SSCE Active Sync Engine.3.0"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\InprocServer32]
"ThreadingModel"="Free" @="\\Windows\\sqlceca30.dll"
As everyone can see these are all wrong, when i try to process back from rgu to hv i get error messages, and the only way to get rid of the error messages is to do this:
[HKEY_CLASSES_ROOT\CLSID\{BDE41C5F-EB7D-4c3d-8C9C-12D8F68B24D9}\InprocServer32]
"ThreadingModel"="Free"[HKEY_CLASSES_ROOT\CLSID\{BDE41C5F-EB7D-4c3d-8C9C-12D8F68B24D9}\InprocServer32]
"ThreadingModel"="Free"
@="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}]
@="Active SSCE remote data access Object"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\ProgID]
@="SSCE.RemoteDataAccess.3.0"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\InprocServer32]
"ThreadingModel"="Free"
@="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}]
@="SSCE Active Sync Engine Object"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\SSCE Active Sync Engine Object]
@=""
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\ProgID]
@="SSCE Active Sync Engine.3.0"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\InprocServer32]
"ThreadingModel"="Free"
@="\\Windows\\sqlceca30.dll"
@="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}]
@="Active SSCE remote data access Object"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\ProgID]
@="SSCE.RemoteDataAccess.3.0"
[HKEY_CLASSES_ROOT\CLSID\{86132628-1DA5-489c-9EB9-49B39B9A5583}\InprocServer32]
"ThreadingModel"="Free"
@="\\Windows\\sqlceca30.dll"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}]
@="SSCE Active Sync Engine Object"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\SSCE Active Sync Engine Object]
@=""
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\ProgID]
@="SSCE Active Sync Engine.3.0"
[HKEY_CLASSES_ROOT\CLSID\{455c3e04-bfe9-4089-8622-f2464ec3fddb}\InprocServer32]
"ThreadingModel"="Free"
@="\\Windows\\sqlceca30.dll"
You have to manually site there pressing return all the way through BOTH registry rgu's
what is the problem with this. does anyone else get this?
I have been sat here for 3 hours trying to get all of the entries on separate lines.
there has to be a faster way of doing this?
are you seriously trying to tell my that JJ, Sleuth, Schaps etc etc all sit there for hours pressing return?
No i dont think so, so it is possible that someone can enlighted me as to what i am doing wrong
thanks
bennec83

Ive never experienced any errors with rgu to hv and voce versa conversions. I'm still using CORE's Kitchen!

Set 'Wordwrap' to 'off' when editing if using Notepad.

And make sure you set it to Unicode and not ANSI...
You have to check a few things.
1) REGEDIT4 at the top of the file
2) wordwrap is off
3) Save as Unicode
4) Leave a blank line at the last part.

bernardryan said:
And make sure you set it to Unicode and not ANSI...
You have to check a few things.
1) REGEDIT4 at the top of the file
2) wordwrap is off
3) Save as Unicode
4) Leave a blank line at the last part.
Click to expand...
Click to collapse
Right.
Never 'take for granted' every details.

make sure you have both .dll's present in the directory when you make the conversions (cereg400.dll & msvcr71.dll).
i had similar issues and found out I forgot to copy one of them althou everything "seemed" to work fine.
cheers,
dan

Somewhat related issue ... any help appreciated...
I'm trying to build a package for one of the apps I always use. I have been somewhat successful, but I see (when doing a WinDiff comparison on REG dumps before and after CAB installation), that there are several more Registry Entries created than can be gleaned from the CAB file. Several of these REG entries include a CLSID.
I used one of the online GUID generators to provide me with the GUIDs for the DSM and RGU files ... no problem.
But the CLSID entries already in my registry dumps obviously don't match this ID. So, do I:
1) make the CLSID entries in my RGU to match the ones in my REG dump?, or
2) make the CLSID entries in my RGU the same as the ones generated for my DSM and RGU files?, or
3) Change the GUID numbers on my DSM and RGU to match those of the REG dump?
Does it matter WHICH way I do it? Do my GUID numbers need to match the CLSID numbers at all?
Any help would be greatly appreciated.
Thanks a lot,
-pvs

Issue to add account in Play store for KOREAN Mobiles

Hi All,
If you are facing issue to add account in KOREAN Mobile then you need to do the following.
GO to RootExplorer---> etc ---> edit the HOSTS file in Text Editor
Now you can see the data in the text files as follows:
127.0.0.0 localhost
74.125.93.113 android.clients.google.com
Modify the data as follows:
127.0.0.0 localhost
#74.125.93.113 android.clients.google.com
You need to add the symbol # to the IP Address in prefix.
Thats it. You can access the Playstore by adding google account.
Be careful while adding this. Do not add any other things in this file. It may cause to lapse your mobile.
Regards,
Yeswanth

[SDK]View the released Android App crash log

By adding the crash report SDK in the project, developers can view the released APP crash log, which will help to locate problems and improve the quality of the products.
Features:
Little code implementation, does not affect your APP installation package size.
Choose 4G, 3G, WIFI these broad networks to report log, avoid network congestion.
Rich error information, help developers positioning the problem. For example: StackTrace, Memory, Storage, Thread and Process etc..
Usage:
Get SDK source code, and copy the "src/org/crashlog/crashreport" folder to your Project.
Initialize CrashReport in your subclass extended from Application, refer to "src/org/crashlog/sample/MyApplication.java".
Add below permissions to AndroidManifest.xml.
PHP:
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
If ProGuard enabled, need to add the following options in the "proguard-project.txt".
PHP:
-renamesourcefileattribute ProGuard
-keepattributes SourceFile,LineNumberTable
Get source:http://github.com/liu-yanjun/crash-log-report
Demo:http://www.crashlog.org

New Features on Crashlog.org:
Bugfixes
Decode obfuscated stack traces automatically.

[W10M] Microsoft Edge Custom User Agent String

Howdy, on a desktop W10 there's a registry key for customizing User Agent string within the Microsoft Edge:
Code:
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\CustomUserAgent
If one adds 2 values within:
Code:
CustomUA (String) - Full User Agent String
CustomUAActive (DWORD) - 1
Edge will use this one User Agent string inside its request header instead of the built-in one.
Is there any way to do the same with Windows 10 Mobile device without custom ROM? It seems like the content of this particular key is completely hidden - there's no way to access it and its children:
Code:
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\
Maybe there's someone who knows how to achieve it.

Make reg file and aplly using interoptool?

augustinionut said:
Make reg file and aplly using interoptool?
Click to expand...
Click to collapse
Haven't tried with an interop unlock, only restoring NDKTSvc - it doesn't work. I'll definitely check your idea out and let you know whether it works on a interop-unlocked device. Thanks for a suggestion.

Just make that file.

Import does work, unfortunately the UA doesn't. Edge still uses one of either mobile or desktop User Agents. It seems like it's hardcoded inside a DLL with only a bunch of UA tokens from registry. However there might be a custom header registry key somewhere, maybe this way it can be achieved.

Please post that file.

augustinionut said:
Please post that file.
Click to expand...
Click to collapse
It won't change anything, for it doesn't work with ARM version of Microsoft Edge - got a response from Technet.
What does work:
Global override
Edge override
Partial override
AD 1.
This method changes whole UA string for every single HTTP/HTTPS request and breaks some stuff like downloading apps from Store (requires multiple retries) etc. One has to override USER-AGENT header (but it's strongly not recommended) by creating a key:
Code:
HKEY_LOCAL_MACHINE\Security\Internet Explorer\Custom Headers\HTTP\USER-AGENT
And setting its default value to your custom UA string (reboot required), e.g.
Code:
Mozilla/5.0 (Linux; Android 6.0.1; SM-G920V Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
AD 2.
As I thought, 2 of predefined user agent strings reside within DLLs of Microsoft Edge. Changing them was a headache, because of obfuscation of the code. I'm not going to describe on how to do this, because it involves something more than just changing some values in order to make it work. The basic thing is that the strings pattern looks like this:
Code:
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; <ManufacturerDisplayName>; <Device>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<ParserVer> Mobile Safari/537.36 Edge/<EdgeVersionShort>
By changing these values to a hardcoded one without tokens you'll make your custom UA work.
AD 3.
Using previous knowledge of used tokens we can see that some of them may be taken directly from the registry (also looking at imported DLLs). Unfortunately, version tokens are based directly on the version of Edge's CP exe. What can be changed though is the ManufacturerDisplayName token and the Device token:
Code:
[HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo]
PhoneManufacturerDisplayName = "Your desired name, e.g. Xiaomi"
PhoneModelName = "Your desired name, e.g. Redmi Note 8"
After rebooting and checking your user agent using Edge you'll see it's changed to:
Code:
Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; Xiaomi; Redmi Note 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.1.2311.135 Mobile Safari/537.36 Edge/14.10106

So, still no file?