Modifying ROM directly from PocketPC - Windows Mobile Development and Hacking General

I want to modify ROM directly from the PocketPC, not through ActiveSync. Something similar to pdocwrite.exe and pdocread.exe, but to use from program, script or something from PocketPC.

Related

Extract Files from ROM???

Does anyone know if there is a way to extract files from ROM? Since we can add files via MKROM is there a way to either extract files from the ROM or the .nbf or .nb1 files?
yes, just use the dumprom utility but remember you wont be able to pack them all back in for the compress.dll is not being utlized yet.
You can get dumprom for win32 here http://www.xs4all.nl/~itsme/projects/xda/dumprom.html
Dont forget dumprom can extract files from 4.x roms with the '-4' commandline option.
What I would like to do, if possible, is to extract the files that makeup IE in the 4.00.10 version and then load them into an SPHi700 running the 2002 ROM. Then change the registry keys and see if it will work. It appears that there are only two files required though there might be more. If it needs API calls and entry points in the OS that are not there in 2002 then it wouldn't work. Otherwise I would have an upgraded IE in the 2002 SPHi700.
Any idea if I can do this and if it will work?
Hi Barjohn. Thanks for the info regarding the "g" and I have found a rom of .05 that it works with.
As far as taking IE from .10 to ppc2002 I don't think it will work. The architecture appears to be different, as well as the registry structure. Something like Win98 to WinXP.
Just my .02 but that is what I have been reading online.

how to get application from Windows Mobile 5.0's ROM

is there someone how to get application from Windows Mobile 5.0's ROM ,such as battery monitor.
Hi
did you already read about grab_it and dumprom? The first will make a dump of the rom and the second tool will extract all files from the dump.
What will you do with the file?
If you like to disable a rom executable, just copy another executable on top of it (use the same name). The rom file is then behind and will not be launched. So you can disable, for example, ActiveSync comming up, if you write a small exe and place it as repllog.exe in the windows dir.
regards
Josef

Hook winsock API calls in WM5

My goal is to get the TCP data from a TCP application on the pocket pc
like data from internet explorer or active sync. I want to write a proxy
that forwards all TCP data to the application server (Web server,...).
So I have tried to replace the ws2.dll with a wrapper dll that forwards all
winsock API calls to the original ws2.dll. But when I replace the ws2.dll file
with my own and make a softreset the device hangs in boot screen and
I must do a hardreset. Could not get this to work on WM5 but it works great
on WM2003 devices.
So I have tried another thing. Have heard about API hooking and want to
try this with winsock API functions (connect, WSAConnect, send, recv,...).
After several days of investigation in some forums I have found many
informations about API hooking and API sets win WM5. But when I look
deeper there is no server process for winsock API calls. So I cannot
change the method adresses.
Another idea was to hook LoadLibrary() API function and when ws2.dll is
loaded from an application I will load my own dll and forward all calls to
the original ws2.dll. But LoadLibrary() has also no server process.
Has anybody another idea how to do this?
Thanks for any information on this.
Houser
Hi Houser!
I think the reason your original method failed on WM5 is because all system DLLs must be signed or the system will not load them.
There are several threads on this forum (sorry, can't remember precise link right now) that explain how to create\use certificates, and sign files, so just search for that.
Good luck.
Thanks levenum for your reply.
I also have thought about signing the dll but I have disabled certificate
check on the WM5 device with the Cert_SPCS.CAB file and now
my system loads every dll without asking the user.
I have written some test applications that explicite load my ws2.dll with
a different name (ws2xx.dll) and then in my ws2xx.dll I load
the org ws2.dll from \windows dir and all worked fine. I can use
any winsock function and can make TCP connects and so on.
So I think signing is not the problem, only when I do not use
the Cert_SPCS.CAB file to disable it?
Or are system file always checked at boot phase?
That would then explain the problem maybe.
Regards
Houser
I am pretty sure system files are treated separately. I once used a device with no cert ROM, which ran all programs and loaded DLLs without asking for certificate, but refused to do so for system files (MUIs).
I think you should give certificates a chance before moving on to more complicated solutions.
So I should try to sign my wrapper dll with a certificate.
So I will try to sign with the Visual Studio 2005 developer
certificate. And then I must install this certificate on my device
so that the system trusted the dll file with this certificate?
Houser
Another thing: What do you mean with MUIs?
That's correct.
There are provisioning CABs in the 2005 SDK. You just run them on your device and they insert all the test certificates.
SDK also shows how to provision devices through RAPI, but most WM5 ROMs block that option.
Also you should use the 'privileged' execution certificate to make sure you have maximum access to the system.
MUIs are duplicate system DLLs that contain resources for other languages. For example: coredll.dll.0409.mui will contain English resources for coredll.dll (409 is hex for English code page). They are used to switch interface languages both on PC windows and mobile. (Metalanguage User Interface).
P.S.
If you want, there are XML templates for provisioning CABs in the SDK, and makecert.exe that let you create your own certificate and put it on the device.
Another thing: What do you mean with MUIs?
So I have tried this:
1) Installed the SdkCerts.cab certificates on the device (copied the file on
the ppc and tap in explorer on it) A success message was displayed from
the setup process.
2) In VS2005 I have set in the project settings the cert signing to "Sample
Privileged Root for windows mobile SDK" certificate and rebuild my dll.
In the dll file properties I can see the certificate.
3) Have copied my ws2.dll file to \windows and replaced the org ws2.dll file
there, my dll loads a copy of the org ws2.dll (ws2copy.dll) that is also
in the \windows dir
4) Then the big moment: Soft reset and..... hanging again in boot screen
The installed certificates did not appear in the pocket pc certificate manager.
Do you know if they should appear there or not?
Maybe the SDK certificates are not imported correctly?
Thanks for you help!
Houser
I'm sorry my solution didn't help.
The test certificates do not show in the list (don't know why).
The way I see it there are two possibilities:
1. I was wrong about the certificates. (Though I think you may still need them)
2. There might be a problem with the copy DLL you try to load (ws2copy.dll). Is it from a good dump? Have you tried loading it from a test app? Is it signed? I think it needs to be signed to.
Sorry I can't give you advice on an alternate way. Insufficient knowledge...
It is very frustrating, I do not knwo how many
hard resets I have made in the last few weeks. :?
I have written a test app that loads my winsock dll file and
then my dll loads the copy ws2.dll file. The copy ws2.dll file
is from a platform builder 5.0 build.
These tests with my test app all worked fine, I can make TCP connects
and do all the winsock stuff like I load the org ws2.dll file directly.
I have even disabled certificate check on the device and tested
with unsigned dll and it works too.
The copy dll from PB 5.0 is not signed. may be this could
be a problem when my dll is loaded in boot time.
Do you know a way to sign the copy PB dll with the SDK certificate?
Thanks man!
Houser
Signing files (DLL, EXE, CAB) is very easy. In the SDK, there is a file called signcode.exe. It will give you a step by step wizard to sign the file. The only additional thing you will need is the certificate files themselves which should also be in the SDK.
Got it to work with signing the copy dll file and
now after soft reset my device does NOT hang. :lol:
Many thanks for your support levenum!
That is very good but now I have figured out that
I cannot make a localhost connect on a local tcp port
on the device. That has something to do with WM5
because it was working under Wm2003. Strange..very
strange.
Houser

Running a .exe

Hi peeps,
Is there an app or a trick where I can run an .exe file on my UK Vario without having to hook up to my pc?
TIA
What exe? How are you getting the file on to your phone?
V
When I'm out and fancy downloading something I generally download direct to my device and as a rule everything a in exe format so need a PC to run the app, game etc.
Not a particular exe just in general
Thanks
I think he meant that how can he extract the stuff he wants from a SETUP.EXE of a PPC software.
If it is an EXE, you can run (still need a PC) it on a PC, check the temp folder and get the CAB file. Copy and run this on your PPC.
Many thanks for the info, not quite what I mean.
For example I'm at work and browsing some ppc freeware I find this file pocketpictureinstall.exe and download it direct to my device.
Thats it I dont have my home pc to hand just my Vario and unless I run ActiveSync which I can't at work there is no way it will run on my device.
Is there any software out there that would allow me to provide the .cab files local on the device or just run the app?
Thanks again.
No not really. There are possible apps you could compile for the PPC to assist, but you'd have to be a coder. If not, then the easy answer is typically no - but many websites offer the choice to download the installer in cab format.. Look around.
V

Install apps to Universal (WM6) using Linux host?

Hi Folks.
Many programs for PocketPC are wrapped in MS-Windows .msi installers.
I will never understand why, I don't see any benefits coming with it and you always need a USB connection (not seldomly involving administrative privileges to get the device registered in Windows), active sync and so on, just to install some lousy program
I don't like MS Windows (the desktop versions) and therefore I don't have it and I don't use it. I have access to Windows computers at work, but not enough system rights on the machines to get a usb connection.
Is there a way to
either:
install programs on the Universal using alternative helper applications (GNU/Multisync etc.), preferably open source and running natively on linux machines?
or even better:
extract the .cab archive from an .msi or .exe installer file so it can be directly copied to the PDA and executed there?
I've played with Multisync a little, but it only seems to support contact synchronization, no software installation...
Well if you have a windows pc you can start the installation process,
then when it tells you to install the program on the universal,
don't click on install, but use total commander or a similar program
to search for *.cab files. You will find the cab somewhere.
Copy it to your sd card or wherever because after the installation completes
the cab will be deleted.
Another way would be to install Virtual box on your Linux machine and
install Windows on that. Then you can have the virtual machine use your
usb port.
You'd have to search on google to find information on how to do that.
I'm in the same situation: no windows machine to run installers from.
I've had some luck using cabextract ( http://www.cabextract.org.uk/ )
When that fails (quite often it does) I've usually been able to get the .CABs by running the installer under Wine.*
To do this, I had to install activesync under Wine. It's a while since I did this, but apparently I downloaded the file activesync_4.2.setup.exe from microsoft.com and ran that with Wine.
When you run an installer for a WM app, it won't actually install onto your device (that would be too easy!) and in fact I don't even bother connecting my uni to my linux box during this stage. The aim is simply to get the .CAB files extracted.
The app installer usually craps out at the stage when it would transfer the files to my uni, but it's already extracted the .CABs. I generally find these in
Code:
/my/wine/drive_c/Program\ Files/ActiveSync/
or
Code:
/my/wine/drive_c/Program\ Files/Name_of_Application/
or sometimes in
Code:
/my/wine/drive_c/windows/temp/
Hope this info is some use to you!
*Full disclosure: actually, I use the version of wine that comes with Google's picasa 2.2, wrapped in a little script to set up the environment variables. That script, which I call picasawine goes as follows:
Code:
#!/bin/bash
mydir=/opt/picasa
export PATH=$mydir/../wine/bin:$mydir:$PATH
export LD_LIBRARY_PATH=$mydir/../wine/lib:$mydir/../lib:$LD_LIBRARY_PATH
export WINEDLLPATH=$mydir/../wine/lib/wine
export WINELOADER=$mydir/../wine/bin/wine
export WINESERVER=$mydir/../wine/bin/wineserver
export WINEPREFIX=$HOME/.picasa
exec /opt/picasa/wine/bin/wine [email protected]
so I run as (eg)
Code:
picasawine SETUP.EXE

Categories

Resources