How to add or change interrupt in WindowsMobile - Windows Mobile Development and Hacking General

Hi to ALL!
Is it possible to add or change exsisting hardware interrupts in WindowsMobile 2003/2005?
I mean this:
Code:
FFFF0000 LDR PC, =funс_ad_1
FFFF0004 LDR PC, =funс_ad_2
FFFF0008 LDR PC, =funс_ad_3
etc...
FFFF03E0 fund_aс_1
FFFF03E4 fund_aс_2
FFFF03E7 fund_aс_3
I want to add my own func_ad_X or change one of these addresses.
I tried to write in this part of memory in kernel mode (using SetKMode) but get an access violation.
Maybe I must use some kernel API functions (like HookInterrupt or something else) and reach a goal more correctly. Anybody knows?
So, help me please.
Thanks.

Related

HaRET don't bootup linux :(

Hello ,
I'm a newbie and have used the introductions on http://wiki.xda-developers.com/wiki/HimalayaLinuxBooting to boot linux on my himalaya. Unfortunatily the pops up dialog "Launch a script file. Default ..." when i tap on HaRET-0.3.2d.exe . I can't connect to port 9999, too.
Please Help me
Thanks
Hi snowdrop,
the dialog means that your prepared scriptfile hasn´t been found and executed. This could be because you misspelled the name. Keep in mind that all filenames have a 3-letter extension which is not visible in windows. I.e. if your FileExplorer says "startup.txt" the filename is "startup.txt.txt".
Or maybe you installed the startup script in a different directory than HaRET. IMHO it´s easiest to install all 4 files (haret, startup, kernel, initrd) in a separate dir unter \Storage where you don´t have to reinstall it after a reboot.
Don´t hesitate to ask further if this doesn´t anwer your question.
Matthias
Hallo noone,
thanks for your reply. I copied all neccessary file under "\Storage Card\". The filename is "setup.txt" (the filexplorer says startup without extention but i'm sure it is named startup.txt through my activesync under Windows). All files are under "\Storage Card\", (also the HaRET-0.3.2d.exe and startup.txt files). :roll:
Greets
Hi snowdrop,
I'm not really sure about that. It works for me all the time.
Maybe you can track down the problem with a network connection. You have to disable ActiveSync on your host PC and to start a connection with SynCE. This requires usbserial and ipaq as well as ppp loaded into the kernel. When you cradle the himalaya you should get a message from usbserial about the attached device (usually /dev/ttyUSB0).
After synce-serial-configure (root), dccm (user) and synce-serial-start (root) the Himalaya should display the connection sign in the bottom bar. Be careful: ActiveSync on the Himalaya may or may not try to start a GPRS session. This can become expensive sometimes
After establishing the PPP connection from PC to Himalaya you connect to port 9999 (refer to SynCE's documentation about the IP addresses). Then you can enter the commands of the startup.txt script line by line.
HTH
Matthias
Hello Matthias,
what is SynCE? I'm using Windows as host PC.
Are synce-serial-configure (root), dccm (user) and synce-serial-start Linux Tools??? :?:
Thanks
Ok,
i after some hard work (and hardware reset), i'm now able to see the penguin(with red eyes and red thermometer) . But then nothing will be done
Actually I thought, that there is also a graphical user interface for linux. Now my question:
Do you ONLY remote login into your linux and have JUST a console application? Or have you also GUI applications and a desktop under linux for himalaya at the time.
Thanks for your answers
it will of cause never run any linux applications not compiled for it
like windows CE will not run pc windows applications
if you can find a kernel compiled for it
you can use it otherwise you'll have to compile your own
the same goes for a version of x11 and any other applications you may wish to run
though in the world of linux sourcecode is much easier to come but and compile yourself then they are under windows
Hi,
can you give some usefull links about linux application on PDA?
I want too much to run linux under my himalaya .
havent really messed with it
here is another distro for xda not sure if he ever got finished with it
http://www.pigeond.net/photos/xda-linux/
havent kept up on it really
what you have to look for is pretty much
applications for the arm cpu
and you can also look for linux of ipaq and other pda's which use the arm cpu they would also run on the xda
but i havent really kept up todate about the whole project
so i dont know how long any of the project have gotten
and i dont know how many applications can be portet because of graphical limits in the desktop manager like glib
but i'm sure there must be others in this forum who mess around with these things
Maybe the guys at handhelds.org could give you some more info, got lots of help getting linux running on my ipaq 5550 (never quite got it working to my liking though)

Sinchronizing Magigian on Linux with Synce

I followed both steps (usb and bluetooth) with no success...
are there any brave persons that are able to sync this device on Linux?
http://synce.sourceforge.net/synce/howto.php (USB)
If yes, could you please tell me which kernel did u use and yours secret tips? :wink:
What's exactly the problem you encounter? I use Raki and synce on one debian machine, but just to connect, show the magicians screen on the pc's screen and copy files between them, not to sync any data (appointments, etc.).
Greetings,
BGK
Which guide did you follow to set it up?
The device is recorgnized by dmesg but i can't connect to it with pppd
Have you tried multisync? It should be the bridge between synce and evolution
I have also successfully used RAKI on KDE desktop (Debian Testing) to connect to the Magician. It transfers files back and forth, with the right iptables masquerading entry (done manually) I can use the Internet, but I cannot sync anything either
I forget exactly what I installed, but everything should b plug&play.
Kernel 2.6.10, Hotplug, Synce-KDE...kernel installed manually, the rest from the Debian dselect program. There are certain things you have to set up with the kernel config.
What distro are you using? Any other details?
Re Multisync; I really do want to get synch'ing going like ActiveSync. I installed it, tried various configs, but I do not get anything in the program... Can anyone else help?
uau, could you please post your software version?
did you pass some arguments to modprobe ipaq ?
uau, could you please post your software version?
did you pass some arguments to modprobe ipaq ?
If you made raki work you should install multisync and the evolution plugin..
it's already in http://www.multisync.org/files/multisync-cvs-snapshot.tar.gz
Hi metnik, sorry for the late reply.
My device is an O2 Mini (aka Magician), information at Settings => System => About, is
Windows Mobile 2003 Second Edition
Version 4.21.1088 (Build 14235.2.0.0)
I did not have to pass any arguments to ipaq module. It did everything auto; I guess it is because of the 2.6.10 kernel.
I have installed Multisync from Debian Testing, and it has SynCE and Ximan Evolution 2 plugins. I have created the synchronization pair with these, but NOTHING happens when I press the "Sync" button.
Raki, on the other hand, works nicely with the USB cable; even the KCeMirror works very nicely (window of the device on your desktop).
The only problem with Raki is the synchroniztion setup errors with "No Synchronizer found for (Contact)..."; i.e. I don't know how to get synchronization working with that either... It really would be nice to have a copy of my address book on my Linux partition somewhere. So far it is only on MS Outlook, which I don't use...:-(
Also, I have bluetooth transfers working between the Mini and my laptop, however, I havent figured out how to get bluetooth working with Raki. It would be rather nice.
Any clues?

Here is a file IO monitoring tool for WM5

I've wrote a tool that hooks CreateFileW function and writes its parameters and a name of a caller process to "\Storage Card\fileio.txt" file. Here is a sample output:
Code:
Hooked CreateFileW...
17FB4002: CreateFileW("\Windows\CePerf.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 2 ("\Windows\nk.exe")
17FB4002: CreateFileW("\CePerf.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 2 ("\Windows\nk.exe")
17FB4002: CreateFileW("\Release\CePerf.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 3 ("\Windows\nk.exe")
17FB4002: CreateFileW("\Windows\CePerf.dll.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 2 ("\Windows\nk.exe")
17FB4002: CreateFileW("\CePerf.dll.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 2 ("\Windows\nk.exe")
17FB4002: CreateFileW("\Release\CePerf.dll.dll",a0000000,1,0,3,0,0) -> FFFFFFFF, Err: 3 ("\Windows\nk.exe")
B6FA4402: CreateFileW("RIL1:",c0000000,0,0,3,0,0) -> F6769D16 ("\Windows\shell32.exe")
B6FA4402: CreateFileW("\windows\Default_stwater_240_320.gif",80000000,0,0,3,80,0) -> FFFFFFFF, Err: 2 ("\Windows\shell32.exe")
16DD2DCA: CreateFileW("\Windows\ActiveSync\CtrlLog.txt",40000000,3,0,4,0,0) -> 165DD2AE ("\Windows\repllog.exe")
16DD2DCA: CreateFileW("\Windows\Profiles\guest\Temporary Internet Files\Content.IE5\4TEF45QZ\SyncStat[1].dll",40000000,3,0,1,10000080,0) -> 7661E6E6 ("\Windows\repllog.exe")
16DD2DCA: CreateFileW("\Windows\ActiveSync\CtrlLog.txt",40000000,3,0,4,0,0) -> B65DD2F6 ("\Windows\repllog.exe")
575A36A6: CreateFileW("BAT2:",c0000000,0,0,3,0,0) -> 3660EBD2 ("\Windows\device.exe")
It would also create file "Log.txt" in the root directory with some diagnostics information.
The program works only under WM5, though it can be recompiled for older OSes. The idea is simple - hooking SystemAPISets table.
I can give the source code of the tool for someone who would finisth the project: add logging of CreateFileForMappingW, DeviceIOControl and registry functions.
Installation process:
copy TestApiSetHookDll.dll and TestApiSetHook.exe to \Windows directory on the device and run TestApiSetHook.exe. It would output a message "CreateFileW hooked" and logging would start. To stop logging reboot your device.
This program may conflict with the installed antivirus programs on PocketPC, so use it on your own risk.
mamaich - I'd be interested in looking at the code if you don't mind; I'm interested in hooking system functions, but I'd like to use this tool on WM200se as well.. Please PM if you don't mind sharing it..
V
Hi there,
I was looking for some ways to hook the DeviceIOControl function.
mamaich, would be great if you would like to share the source code.
Do you think it's possible to hook all RIL API using the same method?
Could you post the source code?
Thanks.
Bye
Sektor
Attached the source code
About hooking RIL. This method cannot be used, there are different ways to hook RIL functions.
Regarding DeviceIOControl. My other tool that hooks EnterCriticalSection function can be used to hook it, the trap address to hook is 0xF000E3D4
Thank's so much Mamaich. I've got nothing to use it for right now, but you've got my very sincerest thanks, as ever!
V
Hmm....
This + CeRegSpy == install logger = making proper uninstalls possible
/me crosses fingers
Thanks Mamaich.
Could you explain me the different ways to hook RIL functions, please?
Bye
Sektor
Sektor said:
Could you explain me the different ways to hook RIL functions, please?
Click to expand...
Click to collapse
You may try this - http://www.xs4all.nl/~itsme/projects/xda/rilhook.html
Or if you are hooking RIL for only one program, you can just patch its import table on the fly, or RIL.DLL export table. The process is almost identical for hooking DLL exports on a normal PC.
What changes are required in order to make it work under WM 2003SE for example?
this is obvious - internal WM structures in undoc.h should be changed
Mamaich - very interesting code, how would I go about hooking the file close events?
Have tried hooking method 0 of w32 API (20) but the handles look wrong.
Also tried mapping the File API, but the SysytemAPISet[7] doesn't seem to have any methods - but I know it must be loaded,
very confused...
I see this is using PerformCallback4. Apparently that function would be killed off in WM5, how come you can still use it ?
TheBlasphemer said:
I see this is using PerformCallback4. Apparently that function would be killed off in WM5, how come you can still use it ?
Click to expand...
Click to collapse
I think that this function fould be left forever, but it would be allowed to be called only from trusted apps. And even if it is removed - there are dozens of other methods that can inject your code into address space of other process or kernel.
2 mgargett
Regarding hooking CloseHandle. Maybe hooking 0xF0010000 would not be enough, but if you'll look into its disassembly:
Code:
CloseHandle
04 E0 2D E5 STR LR, [SP,#var_4]!
1C 30 9F E5 LDR R3, =unk_1FFFA54
00 30 93 E5 LDR R3, [R3]
00 00 53 E3 CMP R3, #0
0C 30 9F 05 LDREQ R3, =Int_CloseHandle
0F E0 A0 E1 MOV LR, PC
13 FF 2F E1 BX R3
04 E0 9D E4 LDR LR, [SP],#arg_4
1E FF 2F E1 BX LR
you'll see that unk_1FFFA54 may be set to an address of a function that would be called instead of CloseHandle. For example this method is used by LMemDebug.DLL.
Of cause unk_1FFFA54 would have different addresses on different devices, but this is not a problem.
Hi mamaich.
I've tried to change the code from testcritsect.rar to hook DeviceIoControl function.
However, because my wisdom in that area is not far away from 0, the program doesn't work as expected.
Code:
if(SystemAPISets[ApiSet]->cMethods<=Method)
{
puts("Invalid method number");
return 0;
}
The program ends in the if above. Don't know what I have wrong.
As you said above, I did that: #define FAULT_ADDR 0xF000E3D4 //DeviceIoControl
Are you sure this is the right number?
BTW, how did you get all this info?
I mean:
CreateFileW 0xF000AFDC
TakeCritSect 0xF000FF20
MessageBoxW 0xF000BB38
This is very interesting.
Would it be 'easy' to adapt it in order to catch registry modifications?
CERegSpy, doesn't work well for WM5.0. At least it doesn't work at all with my Qtek 9000.
Isn't there a WM5 update for CERegSpy available from the Author?
V
vijay555 said:
Isn't there a WM5 update for CERegSpy available from the Author?
V
Click to expand...
Click to collapse
At least not at its website http://www.forwardlab.com/ceregspy.htm
Still on release 1.0
Does someone knows about a newer version?
ZeBoxx does I think. But you have to write to the author for the new version.
V
Yep... I've got a WM5 version, but the evaluation download location doesn't work anymore - didn't keep a copy around, I'm afraid :/
So just write to the author, and you should be able to get the preliminary WM5 version. Alternatively, I think the app mentioned here *could* be coded about to keep an eye on the registry as well. But I'm no coder

Help coding a Flash7 wrapper for WM5/WM6

We need to update one of our old pocketpc programs to Windows Mobile. It's a pretty simple program, but I'm not a C#/VB programmer.
For a visitor center we give the visitors a PDA with a flash interface. The only thing the wrapper needs to do is:
Play a flash7 file Fullscreen (regardless of resolution on screen)
Disable all hardware keys (but send to flash) and flash right click if possible.
Receive quit & reset command from Flash
Flash Lite is not an option as we use flash communication server for all communication.
This was no problem for PPC2003, but the old program does not work in WM5/6. Since we have simplified our wrapper functionality I thought it would be simple to create a new flash wrapper. I can preinstall the flash7 plugin.
Option 1: I've managed to get a C# file running if I embed IE and let that open a html with a swf, but I still need to block all hardware keys and flash right click. I've tried several things, but nothing works. It also seems like using IE inbetween is a bad solution. Embedding the flash player directly by adding it as a reference like the VB example below.
Option 2: I VB if I add the flash.dll (extracted from cab file) as a reference and run the following code:
Code:
Dim FlashObj As New ShockwaveFlashObjects.ShockwaveFlash
FlashObj.Movie = "main.swf"
I don't get a error, but I also don't get a visible flash file...
Any ideas? I know several people need to play flash files on wm5/6 as Zinc and other commercial wrappers don't support it.
I would pay for a product like this

Modification of RILD Library

Hi,
I have two questions.
First: There is someone who modify the rild library and replace the modified for the one that is in the Android (emulator or real phone)? without build a new Android image. For example, I need to turn off the radio interface and is not possible through Java. The only way is using the Unix socket to rild, but this process accept only one connection and only from the Phone application. I tested the rild-debug socket but when I send a turn off command, all telephony services stop and I cant turn on again.
Second: Is some document that specified the commands received by the baseband? For example, on G1.
Best Regards

Categories

Resources