Mobile2Market Privileged certificate Problem - 8525, TyTN, MDA Vario II, JasJam General

Hi all i did post this in the generic upgrading but as it's an issue with the M3100 i though i would try here.
Anyhow i have been trying to get a safemode app to run on a couple of Orange phones (M3100 & M600) and this was the reply i had from one of the developers
"An app properly signed with a M2M certificate will run on every Windows Mobile 5.0 device EXCEPT:
Devices shipped by Orange do not include the Mobile2Market Privileged certificate, but do include the Normal M2M certificate"
(http://msdn.microsoft.com/windowsmob...s/default.aspx)
So my question , Is it possible to extract the cert from another phone and Add them to my phone ?
and if so which ones do i look for and how would i do it ?
Thanks
dean

AFAIK, the only time the privileged cert is required is during device customization (extrom load). Is this something you need to do? The standard M2M cert allows you to set up services that auto-load etc...

Thanks for the reply
I had previously tried Ilauncher & SPB Safemode apps and could not get either to work on my M600 until i upgraded the rom to a generic one.
Now i have the same issue with the M3100
So now i have tried the safemode app from www.monocube.com
and that has the same problems.
The developer in the forums wrote
"The only thing I can think of is that Orange ROMs do not have the Microsoft M2M privileged certificates installed. SafeMode (and other safe mode apps) uses this certificate, because it calls privileged system functions.
I know Orange has a special developer program, in order to get an application signed for their models, however I didn't look into it so much. The only suggestion I have at the moment is to change the rom - but I will look into their developer program. "
Then confirmed it with
"It seems I was right:
"An app properly signed with a M2M certificate will run on every Windows Mobile 5.0 device EXCEPT:
Devices shipped by Orange do not include the Mobile2Market Privileged certificate, but do include the Normal M2M certificate"
(http://msdn.microsoft.com/windowsmobile/partners/mobile2market/smartphoneapps/default.aspx)
Unfortunately, it's a bit too expensive to get an application signed for Orange devices, because it also needs to be certifed for Windows Mobile ($600), and then pass their own tests."
This would add up to be correct as the M600 only worked when a generic rom was installed which obviously had the correct M2M cert included
I have downloaded different hermes roms and looked at the Cert cab files in the EXT roms but they made no difference after installing them into the orange rom.
The problem is i don't know if they need to be enabled in the rom or if they are just certs that can be ripped from another phone.
Any more info is apreciated
Dean

Just a bit more info i found other Certs from a couple of roms and again no joy
Just to tie this down to the orange certificate issue can anyone with a Hermes other than a M3100 (or a M3100 with another Rom) please confirm that a safemode app works.
Thanks

Yep, Safemode is one reason... Only priviledged apps can run then.
Orange must only supply their operator cert for priviledged mode execution.... I don't think installing an operator root can fix you. Only apps signed with that operator's certs will run when that is the case.
Your fix should be to install a M2M priviledged mode root cert. Not sure what you need to do that though.
I can confirm that SPB safe mode works on my TyTN.

Related

.NET CF Problems

Hi,
Ive got 5 CAB files which all go together to run a little program i have written, however, when installing them on my XDA IIS every one of them displays the message 'The program you installed may not display properly because it was designed for a previous version of windows Mobile software'. I think these errors may become a problem when i place it in the Extended Rom folder.
the files are as follows
- OpenNETCF.PPC3.ARM
- MyProgram_PPC.ARM.CAB
- sql.ppc3.arm.CAB
- sqlce.dev.ppc3.arm.CAB
- sqlce.ppc3.arm.CAB
Any suggestions would be great!
Thanks,
James
Hi LinQ
The problem is that the OpenNETCF and SQL CAB files were built for WM2003 and _NOT_ WM2003SE. This means that WM2003SE cannot verify that they will work correctly with features such as the screen rotation facility.
To stop your app from coming up with the same message, you need to download the WM2003SE SDK from MS (haven't got a link sorry... but google for it and you should find it) and then target your application at the new WM2003SE device option that you get.
Hope that helps

MachinaGod RAPI Unlocker - certificate disable on WM5 v0.1

Hi,
Just an util I got together in no time.
Rapi Enabler, certificate disabler.
Enable all the security on your Windows Mobile 5 phone.
Credits to the author of the ce remote tools.
Instructions:
1. Download the attached file (you have to be logged into xda-dev);
2. Extract it somewhere in your computer
3. Connect your phone via activesync
4. Run the EnableRapi.bat (on your computer)
5. Done.
Have fun,
Ricardo
How does it differ from this CAB file I pulled off the HTC Apache?
I use this in my Extended ROM so that I can run unsigned applications, CAB files, and CPF files during the initialization procedure after a hard reset.
Hi BTT,
This is based on that exact cab. The only difference in enabling RAPI calls also, and doing it without needing user interaction, only needing a activesync connection.
Is a little utility I use for integration into batch files.
Bye,
Ricardo
Certificate disabler..
Probably a dumb question, but is it a replacement fort certchk on 2003 devices? Still looking for such a program.
Thx
Thanks Machinegod, this worked well. I used it on an XDA exec will it work with all WM5 devices?
Hi Machinagod
Is there a way i can call your routine from code?
I have developed software for WM5 but cannot access the database with the standard MS settings. I would like to give my users the option to unlock the rapi calls and install automatically.
Thanks in advance
Steve
ronaldovic said:
Certificate disabler..
Probably a dumb question, but is it a replacement fort certchk on 2003 devices? Still looking for such a program.
Thx
Click to expand...
Click to collapse
to ronaldovic: I believe this utility is for disabling signed applications so you can install apps that have not been signed. I have used BTT cert cab in my extended rom since he posted it (Thanks BTT, It has been very usefull)
If you are looking for disable cert check so you can activesync with MS exchange without a a SSL . Certificate connection, Micro$oft still offers a download to disable the cert sync check..
see http://www.microsoft.com/downloads/...b8-8b3a-4f1d-8e94-530a67614df1&displaylang=en
Miracle Registry
i checked many registry of "Security policies" in different device, and also SDK.
http://asukal.seesaa.net/article/12583144.html
You can understand how change it for your neccesity.
this was for your refference.
and also i got made one registry file which has many "Certificate Sotre"
from different setting devicees and CABs and SDK Emu.
This registry make your device to enable working many kinds of dll and exe or any other files without digital signed(not for all)
multi user interface files also can effect without digital signatures.
(shellress still can not, but worked with Smartphone signature)
The security revel will be same or lower than SDK emu.
but not completely finish to edit it.
so possibility of some side-effect or unkown problem.
Hope understand this point and use it as test.
But once you use this registry, you got understand why i said it miracle.
just import this registry and make soft reset.
"syntac error" displayed when you import this, but works.i will cheking the reason of this error.
lets test it.
Re: MachinaGod RAPI Unlocker - certificate disable on WM5 v0
I try to use it on my new Jamin but nothing happen.... Prog still not work.
Pls I'm a newbe, Can you help me ?
Thanks a l ot
Hi MachinaGod,
Could you tell me please what exactly this RAPI unclocker is doing? Is it possible to undo it? RAPI locker or something? Is there any security threat after you execute tis program?
Thank you!
cingular
please tell me what tool can unlock (simlock) my cingular 8525, Thank you very much!
hmmmmmmmmytfghvghdgfgfdtrsdr
unlocking spv m1500
hello,
i tried the RAPI unlocker but it did not work,
could it be because my Pocket pc is running 2003 CE?
hi
someone can send me the file i can download him pls
and one qwuestion this unlock mi simlock???
htc 8125 need help please
machinagod said:
Hi,
Just an util I got together in no time.
Rapi Enabler, certificate disabler.
Enable all the security on your Windows Mobile 5 phone.
Credits to the author of the ce remote tools.
Instructions:
1. Download the attached file (you have to be logged into xda-dev);
2. Extract it somewhere in your computer
3. Connect your phone via activesync
4. Run the EnableRapi.bat (on your computer)
5. Done.
Have fun,
Ricardo
Click to expand...
Click to collapse
i have a htc 8125 and tried your method and it never gave me a code but when i put my sim card in it says sim lock and unlock? explain how to unlock this d$$m phone.It is a cingular phone but i dont have that service.it is version 2.25
[email protected]

Installing third party certificates on WM5 (MDA Vario)

Don't know if anybody is having the same problem as me.
We have an M$ Exchange server which I use for work. We've not bought verified certificates as we don't need to. WM5 doesn't allow me to install our wilcard certificate onto my MDA Vario. I've tried various methods posted in different forums:
Changing the registry HKLM\Security\Policies\Policies\00001017 from 128 to 144. I also changed 00001001 to 1 and 00001005 to 40 but i dont think that helped.
My certificate is still not recognised!
Anybody have a solution?
Will
willcheng,
If you got W2003 server and Exchange 2003 then you don't have to buy certificates you make your own.
Installing these in WM5 is easy, just copy them to your device and they will be installed after clicking on them.
Please let me know if you have w2003 and Exchange 2003 then I will let you know how to do it.
But if you have an M$ drive on your server I thing you are using Exchange 2000 or 2003 on witch you can add the M drive.
I'm using w2003 with Exchange 2003 and the certificate is working wonderful.
Cheers,
Drifter
You need to install the root certificate not the one that was issued to the Exchange server. What CA issued the certificate for your Exchange server? Install that certificate. If you are using MS Certificate Services you can just go http://<CA Server Name/certsrv and download the root certificate or the chain. You can then just copy them to your device and click on them and they should automaticaly import. If it is not installing then what type of certificate are you trying to install? If it is not X.509 you need to convert it to X.509. Also I had this problem installing on a locked Sprint Phone on WM 2003. I had to use this.
SPAddCert.exe

CAB file help - "Installation unsuccessful" on HTC

Hello all,
Attached is a simple CAB file that should have set the PIE user-agent stuff to be identifying the thing as IE6. I think there may be others around, I know I've seen it in a larger cab, so don't worry about this specific function. My question is regarding the fact that when I try to run it on my HTC Wizard (running WM5), I get "Installation of PIE_as_IE6.cab was unsuccessful".
I built the CAB off of the "CAB Template.cab" from http://forum.xda-developers.com/viewtopic.php?p=113615#113615 - just in case I'd run into that version issue with WM5.
Any thoughts out there on what's wrong with the CAB? Or is there a different reason it won't install?
Hi, what CSP are you using to change those settings and how are you deploying it to the device? Chances are access to that provider is restricted to a higher security role than what the cab file has permissions to do. RAPI still has access to most service providers by default but if you're downloading the cab over the air to the device it'll probably need to be signed with a suitable certificate before it's allowed to make setting changes. Mobile 5.0 security has been beefed up and its now a bit of a mission to do what was reasonable simple to do on 2003. All cpf files need to be signed if not deployed over RAPI as well, for even something trivial like adding a browser favourite.
editor is OCP Software's WinCe Cab Manager (version: 1.1)
deploy method is copy over USB cable by ActiveSync through Total Commander+WinCe Device access plugin. Execution of CAB is on the device itself through Total Commander CE or Explorer.
No CSP in use (err.. afaik).
You may be right that the part of the registry in question may simply be unavailable to access without special signing. I'll have to dig for those keywords a bit.
Yeah...the more I research Mobile 5.0 security the steeper it gets. It seems security permissions extend all the way to file IO access. Writing certain recognized system files (like theme files) without adequit permissions effectively renders those files as untrusted and they stop behaving in their expected manner. Its a pain.

[Q] Unlocked device using Regystry tweak - cannot debug in Visual Studio

Hi,
I've unlocked my "NoDo" updated LG C900B windows phone using the MFG application and the registry tweaks I found on the web.
While testing a simple application from Visual Studio the deployment works fine the application gets installed and it does what is supposed to but I cannot debug. I get the following error
---------------------------
Microsoft Visual Studio
---------------------------
The application could not be launched for debugging. Ensure that the target device screen is unlocked and that the application is installed.
---------------------------
OK
---------------------------
Does anyone have an idea that might help? I tried pretty much everything without luck so far. (I've reinstalled VS with the latest tools for WP7, I've wiped the phone restoring its factory defaults etc)
Thanks in advance!
The solution is you have to become an apphub (and if you're not a student, that means paying the fee too) and when you submit your 1st program, you will get verified and then be able to developer-unlock the phone.
Steven855 said:
The solution is you have to become an apphub (and if you're not a student, that means paying the fee too) and when you submit your 1st program, you will get verified and then be able to developer-unlock the phone.
Click to expand...
Click to collapse
What would be the difference between using the MS unlocker to set the registry key or use a regeditor?
As he said his device is already unlocked, is there more happening when using the MS unlock that isn't known atm?
/J

Categories

Resources