Database Users

How to DLL hook in windows CE?

How to DLL hook in windows CE?
for example how to hook RIL_Dial in ril.dll?

the process is nearly similar to normal Windows. For example you can make a wrapper around the dll, or patch its export table, or import table of app that uses it. Read cracking sites for more info.

Thanks for replay.
I need a sample code for used fast.

But WinCE does not support SetWindowHook and CreateRemoteThread (at least I cannot find it in the SDK help)
We can use VirtualProtect to change API entry but I cannot enter address space of other process.
that means we can hook API within our program only we cannot implement interprocess API interception like under win32 platform.
Writting a wrapper for API is too tough for big DLLs with hundreds of APIs.
Patching export table in binary file is impossible for system DLLs in the ROM.
headache

SetWindowsHook is obsolete. Use SetWindowsHookEx.
There is no need to use CreateRemoteThread. All processes in CE share the same 4Gb linear address space and can access each other's data. To convert a pointer from your or any other processes' address to a "global" that can be accessed from everywhere use a poorly docummented function:
Code:
extern"C" LPVOID MapPtrToProcess(LPVOID lpv, HANDLE hProc);
To inject DLL into address space of other process I use
Code:
typedef struct _CALLBACKINFO {
HANDLE hProc; /* destination process */
FARPROC pfn; /* function to call in dest. process */
PVOID pvArg0; /* arg0 data */
} CALLBACKINFO;
typedef CALLBACKINFO *PCALLBACKINFO;
extern"C" DWORD PerformCallBack4(CALLBACKINFO *pcbi,...);
...
HANDLE Proc=OpenProcess(0,0,Pid);
void *Ptr=MapPtrToProcess(L"phonehook.dll",GetCurrentProcess());
CALLBACKINFO ci;
ci.hProc=Proc;
void *t=GetProcAddress(GetModuleHandle(L"coredll.dll"),L"LoadLibraryW");
ci.pfn=(FARPROC)MapPtrToProcess(t,Proc);
ci.pvArg0=Ptr;
PerformCallBack4(&ci);
CloseHandle(Proc);
The method is unstable - it can hang your device if the process was inside an API function. I call Sleep(500) before PerformCallBack4 and it works in most cases.
The other metod that allows hooking of most kernel functions is patching the SystemAPISets table. Search this forum, an example was posted here.

I Understand attach dll to other process but no Understand to change the original function adress to my hook function .
for example in hook dll write this code
Code:
typedef HRESULT t_RIL_Dial(HRIL hRil, LPCSTR lpszAddress, DWORD dwType, DWORD dwOptions);
HRESULT New_RIL_Dial(HRIL hRil, LPCSTR lpszAddress, DWORD dwType, DWORD dwOptions);
t_RIL_Dial *Old_RIL_Dial;
HINSTANCE hRilDll = LoadLibrary(L"\\Windows\\Ril.Dll");
Old_RIL_Dial = (t_RIL_Dial*)GetProcAddress(hRilDll, L"RIL_Dial");
and my hook function
Code:
HRESULT New_RIL_Dial(HRIL hRil, LPCSTR lpszAddress, DWORD dwType, DWORD dwOptions)
{
// hook code
}
how to change the Old_RIL_Dial to New_RIL_Dial.
please help me.

Cannot give you a simple code to demonstrate it. You must have knowledge of assembly language and how win32 system works.
in breif,
1. use system hook to enter other process
2. get entry address of API
3. change protection type of that address
5. save that value
4. replace that address with your function and a long jmp
5. in your function, write that value back and call original API and replace that address again.
6. Use interprocess communication APIs.
7. keep multi-thread safe and be very careful
I think SetWindowsHookEx is not a documented API in win CE sdk/MSDN.

This isn't anything like regular win32 hooking. Because WINCE uses XIP technology.
Since rill.dll and rilgsm.dll are XIP dll's, they're executed directly from ROM. Without being loaded to RAM. Therefore, it is not possible to patch those modules "on the fly" and insert a jump/hook because ROM is read only.
Correct me if I'm wrong?

This isn't anything like regular win32 hooking. Because WINCE uses XIP technology.
Since rill.dll and rilgsm.dll are XIP dll's, they're executed directly from ROM. Without being loaded to RAM. Therefore, it is not possible to patch those modules "on the fly" and insert a jump/hook because ROM is read only.
Correct me if I'm wrong?
Click to expand...
Click to collapse
this is true only sometimes:
modern devices usual have in ROM only 5-10 files (example Dell x51v)
Also if ROM code section is compressed, it will be decompressed to RAM at first.
XIP is eXecution In Place, so all above can't be called XIP.

How to make Popup Message on CAB Files?

I received a CAB file from my friend, and when I tried to install it, I found that it has a popup message from my friend telling me a joke...
how he do that?
and how can I change that message?

Still No Comment...!
Please Help!

I asume you know how to make a cab to start with????
As you know there are exported functions in the dll that the cab uses (you make the dll). For example this is the normal look of whats exportd. Bellow is whats in the def file.
--------------------------------------------------------------------------
; TestSetup.def : Declares the module parameters for the DLL.
LIBRARY "TESTSETUP"
;DESCRIPTION 'TESTSETUP Windows CE Dynamic Link Library'
EXPORTS
Install_Init
Install_Exit
Uninstall_Init
Uninstall_Exit
now in the code for one of those you just make a dialog like normal.
The code below is cut out of one of my working cabs. Because its in Install_Init it is the first thing to happen. Changing the method to Install_Exit would give the message after the instalation.
#include "stdafx.h"
#include "TestSetup.h"
#include "ce_setup.h"
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
#include "MyAboutDialog.h"
BOOL CALLBACK gAboutDialogProc(HWND h_dlg, UINT my_message, WPARAM wpAram, LPARAM lpAram);
static CMyAboutDialog* myAbout= new CMyAboutDialog();
BOOL CALLBACK gAboutDialogProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
return myAbout->AboutProc(hWnd,uMsg,wParam,lParam);
}
/////////////////////////////////////////////////////////////////////////////
// CTestSetupApp
BEGIN_MESSAGE_MAP(CTestSetupApp, CWinApp)
//{{AFX_MSG_MAP(CTestSetupApp)
// NOTE - the ClassWizard will add and remove mapping macros here.
// DO NOT EDIT what you see in these blocks of generated code!
//}}AFX_MSG_MAP
END_MESSAGE_MAP()
/////////////////////////////////////////////////////////////////////////////
// CTestSetupApp construction
CTestSetupApp::CTestSetupApp()
{
}
/////////////////////////////////////////////////////////////////////////////
// The one and only CTestSetupApp object
CTestSetupApp theApp;
/////////////////////////////////////////////////////////////////////
codeINSTALL_INIT
Install_Init( HWND hwndParent,
BOOL fFirstCall,
BOOL fPreviouslyInstalled,
LPCTSTR pszInstallDir )
{
AFX_MANAGE_STATE(AfxGetStaticModuleState());
DialogBox:AfxGetInstanceHandle(),
MAKEINTRESOURCE(IDD_AboutDIALOG),
hwndParent,
(DLGPROC)gAboutDialogProc);
return codeINSTALL_INIT_CONTINUE;
}
//------------------------------------------------------------------
Of course the detail of the dialog is in the MyAboutDialog. You just make your own to do what you want.
You can do just about anything from the code you put in the cab's dll, but a lot of the instalation should be left up to cabwiz to generate. What ever you do put in the dll will permanently reside in the windows folder until the user removes the program, so don't make it too big.

Thanks Dear OdeeanRDeathshead...
your reply is more than an informative article.
however, I hope if you can answer my second part of the question...
how can I remove the message from a CAB file that i have?

I you want to remove the message on an existing cab then that is more complicated. If you know everything that the cab dose when it gets tapped (eg registry changes etc) then you could gather all the file that the cab installs and use them to re-write them into a new cab that has no messages. This is more trouble than its worth. Unless your friend is willing to give you detailed info on what his cab dose you would be bound to miss something.
Also many messages are as a result of the os, and these vary depending on the version of os. You can't stop some of those (on every platform).
Most people would not want their instalation packages tampered with.

Try to extract the .cab file with Win CE Cab manager. Remove the Setup.dll, hopefully it does not do anything else then showing the joke Then build your own version of it.

for any complex instalation I doubt that doing that would leave you with a working instalation. Still its worth a go if it saves time. What I would like to know (not having vis studio 2005 yet) is why dose the wm2005 device always ask where you want to put the software even when you have turned this feature off? When one's coding gets a bit lazy it can all fall appart when put in a location other than that you expect.

OdeeanRDeathshead, I assume you are referring to whether to install to main memory or to SD question (this dialog pups up on WM5 device with SD inserted or built in storage).
To avoid it remove the InstDir string from your inf file (or change the string name to something else). This will force the software installation to the directory you specify in the cab.

I did not want to hard code the directory, so I used
InstallDir="%CE2%"
That should get the location of the windows folder for the install. Are you saying that if I just put
InstallDir="\windows\"
it will force it there. Dose this mean that there is a new table of Windows CE Directory Identifiers or that installs just always ask if you use them?

No, what I meant was you don’t want a string call 'InstallDir' in your inf file.
The 'InstallDir' is just a string definition you may or may not use later in the inf (like #define in C).
What determines where the files are installed is what's in the [DestinationDirs] section.
For example:
Files.Windows = 0,%CE2%
You should delete the line InstallDir = completely from your inf file, or if this string appears else where (except [CEStrings] section) just change it to something like MyDir= (be sure to change it every ware it appears in the file)

[Q] How do i incorporate these code below into my current existing codes?

I was task to allocate only 1GB of space to store my videos in a particular file directory where it is going to auto-delete the oldest video file in that directory once its about to reach/hit 1GB?
And i eventually found these code but i was left with a problem on how to incorporate these example 1/2 codes into my current existing mainActivity.java file because of the differences in names like "dirlist,tempFile" compared with other examples 1/2 given to perform the task of size checking and deleting.
Sorry i'm kinna new in android/java therefore i don't really know what "fields" to change to suit my current coding needs? Can someone help on how am i going to complie these set of codes into a single set of code which perform the above mention functions??
My Current existing mainActivity.java
Code:
File dirlist = new File(Environment.getExternalStorageDirectory() + "/VideoList");
if(!(dirlist.exists()))
dirlist.mkdir();
File TempFile = new File(Environment.getExternalStorageDirectory()
+ "/VideoList", dateFormat.format(date) + fileFormat);
mediaRecorder.setOutputFile(TempFile.getPath());
(Example 1) code for summing up directory file size in a given folder..
Code:
private static long dirSize(File dir) {
long result = 0;
Stack<File> dirlist= new Stack<File>();
dirlist.clear();
dirlist.push(dir);
while(!dirlist.isEmpty())
{
File dirCurrent = dirlist.pop();
File[] fileList = dirCurrent.listFiles();
for (int i = 0; i < fileList.length; i++) {
if(fileList[i].isDirectory())
dirlist.push(fileList[i]);
else
result += fileList[i].length();
}
}
return result;
}
(Example 2) set of code for getting all the files in an array, and sorts them depending on their modified/created date. Then the first file in your array is your oldest file and delete it.
Code:
// no idea what are the parameters i should enter
// here for my case in mainActivity??
File directory = new File((**String for absolute path to directory**);
File[] files = directory.listFiles();
Arrays.sort(files, new Comparator<File>() {
@Override
public int compare(File f1, File f2)
{
return Long.valueOf(f1.lastModified()).compareTo(f2.lastModified());
}});
file[0].delete();

imso said:
And i eventually found these code but i was left with a problem on how to incorporate these example 1/2 codes into my current existing mainActivity.java file because of the differences in names like "dirlist,tempFile" compared with other examples 1/2 given to perform the task of size checking and deleting.
Click to expand...
Click to collapse
if its a matter of variable names and discrepancies from the sample code to your code then i would recommend an ide with really good refactoring built in. it will let you in a couple clicks rename all the new vars to vars that are already in your code. i use IntelliJ (i know alot of people use Eclipse, but i cant stand it. IntelliJ is really way better to code on)
beyond that id have to sit down and look at what this code is doing to try and help. ill give it a look over but its hard to know whats going on when you havent written the code.

[Tutorial][Xposed] make watchface for Quick Circle

How to create a watchface for Quick Circle
General info
The app that is responsible for the watchface is LGAlarmClock.apk from /system/priv-apps .
This guide will learn you how to create an xposed module to switch those files.
Requirements
To know how to compile source to apk
Android Stuio / gradle project / To know how to reference a jar on a regular project on eclipse
Tutorial:
Create the new watchfaces.
Since we doesn't edit the functionallity of the clock, your image should be compatible with the layout of the original watchface.
The original watchfaces are stored on raw-xxxhdpi folder on the apk. You can decompoile the apk by yourself, or take a look at this.
save the edited image in the same name as the original
Create new android project in your IDE.
add the edited file to raw-xxxhdpi folder inside res folder.
Download the xposed-bridge jar from here.
Reference the jar to your project. In a gradle project you need to add to the dependencies:
Code:
provided files('path to jar')
Note: you don't need to add to jar to the classpath, only reference since it already exists on the firmware.
Create a module class that implements IXposedHookZygoteInit and IXposedHookInitPackageResources. It should look like:
Java:
package com.yoavst.quickcirclemod;
import android.content.res.XModuleResources;
import de.robv.android.xposed.IXposedHookInitPackageResources;
import de.robv.android.xposed.IXposedHookZygoteInit;
import de.robv.android.xposed.callbacks.XC_InitPackageResources;
public class Module implements IXposedHookZygoteInit, IXposedHookInitPackageResources {
// Required for resources
private static String MODULE_PATH = null;
[user=439709]@override[/user]
public void initZygote(StartupParam startupParam) throws Throwable {
MODULE_PATH = startupParam.modulePath;
}
[user=439709]@override[/user]
public void handleInitPackageResources(XC_InitPackageResources.InitPackageResourcesParam resParam) throws Throwable {
// Only if it is the clock package, continue.
if (!resParam.packageName.equals("com.lge.clock")) return;
// Here we will put or modifications.
}
}
Now you need to replace the resources. for example, let's say you edited those files: b2_quickcircle_digital_bg and b2_quickcircle_analog_style01_hour.
Java:
[user=439709]@override[/user]
public void handleInitPackageResources(XC_InitPackageResources.InitPackageResourcesParam resParam) throws Throwable {
// Only if it is the clock package, continue.
if (!resParam.packageName.equals("com.lge.clock")) return;
// Create a reference to our resources
XModuleResources modRes = XModuleResources.createInstance(MODULE_PATH, resParam.res);
// Replace the raw resources with hour resources
resParam.res.setReplacement("com.lge.clock", "raw", "b2_quickcircle_analog_style01_hour", modRes.fwd(R.raw.b2_quickcircle_analog_style01_hour));
resParam.res.setReplacement("com.lge.clock", "raw", "b2_quickcircle_digital_bg", modRes.fwd(R.raw.b2_quickcircle_digital_bg));
}
add an assets folder (in gradle, it is under the "main" folder). add an xposed_init file, this file contain the full classname for your module class. in the example it is: com.yoavst.quickcirclemod.Module
Compile it and see it works (need to be applied in xposed and reboot)
You can check for the source here - https://github.com/yoavst/rolexquickcircle

Awesome thanks!

Nobody is going to take advantage with that?

Gabbyh28 said:
Nobody is going to take advantage with that?
Click to expand...
Click to collapse
http://forum.xda-developers.com/lg-g3/themes-apps/xposed-rolex-watchface-quick-circle-t2862715
Here are the 3 available watchfaces for now (the last one which is a paid one, have more then 1 watchface)

[DLL/WINMD][Source] Ativ S RPC Client

ive created a clean implementation rpc client that calls remote procedures to the FCRouter service. its more of a proof of concept. it doesnt use any part of RPCComponent, just straight up low level rpc. right now it only has 2 methods exposed, copyfile and createprocess. i will add more later. copyfile AFAIK isnt in RPCComponent. i could be wrong though, but it allows file copying anywhere on the system, even from hidden folders. for example, C:\dpp\microsoft\microsoft.pvk (oops). watch out though, you could hard brick your device messing with the wrong files.
i have a similar library for lumia that allows full file and reg access,but my screen on my lumia is broken, and the code is messy and has alot of hard coded memory addresses,so it wont run on any other device. when i get my replacement screen, ill fix it up and make it available (hello caps unlock).
heres the lib and the src code for anyone curious and wants to play around with it. have fun.
How to use the library
-----------------------
add <Capability Name="ID_CAP_INTEROPSERVICES"/> to WMAppManifest.xml
add a reference to RPClib.winmd
add "using RPClib" or "using namespace RPClib" declaration
c# silverlight code example
-------------------------
//instantiate the library
RPClib.ativ arpc = new RPClib.ativ();
//initialize and bind the RPC connection
arpc.RPC_Init();
//CopyFile
String src = "C:\\Data\\Users\\Public\\Pictures\\mypic.jpg";
String dst = "C:\\mypic.jpg";
UInt32 flag = 0;
arpc.RPC_CopyFileEx(src, dst, flag);
flag is a flag that determines if the copyfile operation will overwrite a file if it already exists.
1 = FAIL and do not overwrite if file exists.
0 = overwrite if file exists.
please test the flag option just in case.
//CreateProcess
String cmdline = "C:\\windows\\system32\\someinterestingfile.exe /somecommandlineoption";
arpc.RPC_CreateProcessA(cmdline);

first application using this lib + source code :
It works for file copy correctly but I weren't able to use for running process maybe I don't know how to use it

You did a amazing job.
No one to know, How to write such RPC stuff. SO Why all are uses OEM stuff ? But, You did It !!!
Thanks again @vcfan