Database Users

cert questions

1) exe/dll's have to be all signed correct? I assume other files don't (bmp, xml, htm, etc)
2) are files in rom signed or are they assumed to be valid since they are in rom?
2a) if rom files are signed is this preserved on extract via viewimgfs?
3) Can you determine if a file is signed and which cert it was signed with?
4) I see cab's such as the recent Palm Messaging cab that don't appear to install a cert, yet the program runs fine once installed. How is this possible?

hannip said:
1) exe/dll's have to be all signed correct? I assume other files don't (bmp, xml, htm, etc)
Click to expand...
Click to collapse
.EXE, .DLL, .CPL and .CAB files must be signed.
hannip said:
2) are files in rom signed or are they assumed to be valid since they are in rom?
Click to expand...
Click to collapse
All cabs in Extended rom must be signed.
hannip said:
2a) if rom files are signed is this preserved on extract via viewimgfs?
Click to expand...
Click to collapse
Don't know... :O
hannip said:
3) Can you determine if a file is signed and which cert it was signed with?
Click to expand...
Click to collapse
Yes. If you look in the "Digital signatures" tab in the files properties you will see both who signed it and who it was signed for.
hannip said:
4) I see cab's such as the recent Palm Messaging cab that don't appear to install a cert, yet the program runs fine once installed. How is this possible?
Click to expand...
Click to collapse
On a Pocket PC running WM 5.0 a notification will appear that says that the cab comes from a untrusted source. If the user accepts this, the application will run as if it were signed.
Øystein

t0flus said:
On a Pocket PC running WM 5.0 a notification will appear that says that the cab comes from a untrusted source. If the user accepts this, the application will run as if it were signed.
Øystein
Click to expand...
Click to collapse
Thanks for the quick reply!
I'm real curious on the last point. So you are saying as long as a program is installed via a cab and the user accepted the warning that program will run without warning once installed. Correct? So is there some db that contains each file installed and whether they can be run without warning even though it's unsigned?
I must be missing something. I've created a cab file of the HTC StreamingMedia player and it runs fine as long as I have the policies set not warn. But when I change the policies back to normal I can't install the cab even though I've accepted the warning. The installation seems to be going ok, but then I get the following error.
"Installation was unsuccessful. The program or setting cannot be installed because it is not digitally signed with a trusted certificate."
Nice of it to tell me which file or setting it is bombing on. ugh
Ideas?

So the answer to 2a is yes and no. Files are extracted signed, but module-files are not.

hannip said:
So the answer to 2a is yes and no. Files are extracted signed, but module-files are not.
Click to expand...
Click to collapse
Probably they are signed with a cert you don't have on your phone??
If you have the cert, then try extracting them using TestWM5.exe or grab_it! and see if it makes any difference.

pof said:
Probably they are signed with a cert you don't have on your phone??
If you have the cert, then try extracting them using TestWM5.exe or grab_it! and see if it makes any difference.
Click to expand...
Click to collapse
All of the files in my cab are appropriately signed and the certificate is installed on my device. The cab just wont install. I even signed the cab and it still complains, but at least there is no warning at the start.
The files themselves are good. I have tested them on my device by installing them manually and importing the reg file. It's just a cab install issue of some sort.
Is there a way to turn on cab tracing?

One thing:
What device exactly is it?
I know on Smartphones (like the Tornado) even signed cabs are not allowed to install certificates unless the cab is signed by 'privileged' certificate.
The error you described is often caused by cab no being able to change registry setting or install certificates.

It's a PPC device (treo 700wx). The cab does not install a cert. The cert is already on the device. I've been able to install certs via cab before on this device however. The cab does make several reg changes. I'm thinking it's gotta be one of those settings.
Is there no trace or logging available for cab installs? This one is huge and would take some time to narrow down which setting it is having a problem with.

Unfortunately I don't know of any loggers for cab installation.
You should look for reg settings in HKEY_LOCAL_MACHINE and anything having to do with security, certifications, system settings (I know its a wide range, sorry). Those are usually restricted and can only be changed by privileged cabs.
I suppose the only solution is to comment them all and then return them one by one to see which is problematic.

you might want to check out:
http://msdn.microsoft.com/library/d...gpoliciesoncabfileinstallationprocessozup.asp
even though there is wce51 in the url, it's under softphone2003. Security on a single tier sp2003 is very simular to pocket pc 2005. I suspect most (or all) of it will applies.
I had tried to install a file in the top directory and it failed, but worked for another directory. Perhaps I made a mistake, but it made me wonder if somethings aren't allowed. (putting files in \, changing certain registry settings, etc)

hannip said:
It's a PPC device (treo 700wx). The cab does not install a cert. The cert is already on the device. I've been able to install certs via cab before on this device however. The cab does make several reg changes. I'm thinking it's gotta be one of those settings.
Click to expand...
Click to collapse
What kind of cert have you installed? Are you sure it is a application certificate and not a ROOT cert?
If you upload the cab file I can take a look at it...
Øystein

itsutils.dll

Hello,
Have anobody a signed itsutils.dll? or a programm that load this fu**ing .dll without a user prompt (Yes/No) on a Windows Mobile 5 Device.... I need this for a Software deployment.
Greetz

acme said:
Hello,
Have anobody a signed itsutils.dll? or a programm that load this fu**ing .dll without a user prompt (Yes/No) on a Windows Mobile 5 Device.... I need this for a Software deployment.
Greetz
Click to expand...
Click to collapse
Here is the solution:
Extract everything in a directory on your pc.
From the Command Prompt, go in the directory where you extracted the files and type: sign.bat [path of the dll or exe to be signed]
ex.:
c:\signcode>sign.bat c:\itsutils.dll
Cheers,
.Fred

Hello, It doesnt work
C:\...Downloads\SignCode>sign itsutils.dll
Warning: This file is signed, but not timestamped.
Succeeded
After this step i copy the modified .dll to \Windows (PDA) on my device. No i start the psynctime.exe on WinXP and my Device starts a user prompt for ItsUtils.dll (YES/NO). Thats the Problem

The 'not time stamped' is normal, but what you are trying to do won't work.
Here's the thing: The certificate in the attached cab is the test certificate from WM5 SDK. In order for device to recognize it you need to first provision the device (import the certificate). I can attach the cab that does it, but it isn't signed as well, so it will still ask for yes / no.
If you are looking to by pass certificates on a distribution version of your software you are out of luck.
For apps and cabs not to ask yes / no they have to be signed by an official Verisign certificate (costs money) or the device has to be set to no cert.
The second option is even more problematic for the average user, since it requires installing a reg editor on the device and changing some reg settings.

Ok, do you know an other way to stop this user prompt? Install method with automatic /yes or something like that.

Why don't you use the certified CAB that changes the registry values to allow Unsigined apps to be installed?
Check this post: http://forum.xda-developers.com/showthread.php?t=252356

dotfred said:
Here is the solution:
Extract everything in a directory on your pc.
From the Command Prompt, go in the directory where you extracted the files and type: sign.bat [path of the dll or exe to be signed]
ex.:
c:\signcode>sign.bat c:\itsutils.dll
Cheers,
.Fred
Click to expand...
Click to collapse
Hi!
If i want to sign my edited MUI file how can i do that?
Can you five me a syntax and what else need to be inside the folder?
ToddeSwe

Sign Dll digitally with certificate.

Hello I have a problem, I have tried to modify a dll file located in the window folder wich is controlling part of the phone skin on a Artemis. (phcanOverbmp.dll)
The problem is that the phone dosen't recognize the altered Dll file becuase the certificate changes when you alter the file.
How do I solve this?? I have tried to create my own certificate, but Aretemis dosen't except it. and I haven't been able to sign the Dll with anyone of the existing Root certificate already installed in the Artemis. How do you work around this problem??
Both create/install a certificate, and how to sign the Dll
I really need help, Thank you

i have the same problem
if anyone have some advice, just tell for us

You can not edit or change a signed DLL in any way. Once you do the signature is broken and the file becomes unusable, you can not resign it.
You have to remove the certificate first, then make your changes.
I saw a code for this somewhere but I don't remember the link.
Look around, there may be a utility to do this.
In your case resigning may not even be necessary.

levenum said:
You can not edit or change a signed DLL in any way. Once you do the signature is broken and the file becomes unusable, you can not resign it.
You have to remove the certificate first, then make your changes.
I saw a code for this somewhere but I don't remember the link.
Look around, there may be a utility to do this.
In your case resigning may not even be necessary.
Click to expand...
Click to collapse
in my case it is necessary, otherwise the phone will not recognize the dll and display the WM5 original skin. I know you can't resign the DLL with their certificate, but i know that you can add your own root certificat in the phone. And then you must sign the DLL with that certificate, (wich is our own certificate) so the phone recignizes it. Then it shall work. I just don't know how to do it.

Thats relatively easy. All you have to do is create a provisioning XML and put it in a CAB. The WM 5 SDK has a sample.
Here is a link to a sample as well.
By the way if this is considered a system file (I am not sure about that) it needs a trusted, not root certificate.

Extract NBH from RUU exe.

So thus far I have had no luck extracting an NBH of the Sprint Hero RUU installer. I have tried 7zip and NBH_Extract, and I'm beginning to think that Android is a little bit different. I will go ahead and provide a link to the RUU and see if anyone can get rocover an NBH out of it. If it is not possible, would it be possible to somehow repackage all of the contents from a temp directory into a signed NBH form. But I would assume once it leaves the the installer it wont be signed anymore.
ftp://xda:[email protected]_2.73.405.5_WWE_release_signed_NoDriver.exe
Thanks for any help on this one.

How to run Windows 10 PC Apps(APPX) that are already deployed?

Dear All
Can I run Windows 10 PC Apps that are already deployed in Program Files\WindowsApps\? I can't find any exe file. I wonder which one is executable file?

Yes you can run, Right-click the app you want and click Properties. Click the Compatibility tab. Check the Run this program in compatibility mode option.

Rexkh said:
Dear All
Can I run Windows 10 PC Apps that are already deployed in Program Files\WindowsApps\? I can't find any exe file. I wonder which one is executable file?
Click to expand...
Click to collapse
You can use DISM tool from Windows to do that, just Google a bit to know how!