[Q] Native COM debugging - Windows Phone 7 Development and Hacking

I have been experimenting with Native COM on WP7. I create a native COM project in Visual Studio 2008 and a managed project in Visual Studio 2010 which consumes the native COM DLL. Everything works great but debugging the native code is tricky. The managed debugger will not debug the native code. The native debugger in visual studio 2008 will not attach to the device. DEBUGMSG statements that I add in the native COM project do not show up in the debug output in the managed debugger.
Has anyone discovered any good tricks to assist with native COM debugging?

Unfortunally there is no way to connect debugger even to managed code.

I could live with there being no native debugging, if I could at least get some logging functionality. I guess I could log to a file in the native code and then read it out from the managed side, or I could set up a COM event and pass back strings to the managed side for debugging output. Seems like there might be an easier way?

If you've looked at the OEM code, (and I have), you'll know not even they have the ability to put the device into KITL mode and attach a debugger. Only the MSFT guys can.
The only way you're going to be able to do it is write to a log file in your \My Documents\ folder and read it back.

Thanks walshieau (your blog really helped me get started with this). I guess my other approach would be to debug the native code on a Windows CE device and then use the debugged native COM dll in WP7.

It's possible to cook in KITL on HD2 and connect the device to visual studio.
walshieau said:
If you've looked at the OEM code, (and I have), you'll know not even they have the ability to put the device into KITL mode and attach a debugger. Only the MSFT guys can.
The only way you're going to be able to do it is write to a log file in your \My Documents\ folder and read it back.
Click to expand...
Click to collapse

Laurentius26 said:
It's possible to cook in KITL on HD2 and connect the device to visual studio.
Click to expand...
Click to collapse
Yes it is possible to "cook-in" KITL for the HD2. But not for retail WP7 devices atm.
Back to the original question, I'd suggest downloading the WM 6.5 SDK and debugging it that way via the emulator.

Debugging on the Windows CE 6 emulator works great. I was able to make a simple console app that consumed my COM DLL and debug into the native code. I'm hoping that once the COM DLL is debugged, integrating it back into the WP7 app should be a breeze.

Related

Converting applications

How could I convert non pocket pc application
into pocket pc application? Is there any software
to do that? Is is very frustrating that those application
works on desktop pc but not on pocket pc. can
anyone help here. thanks.
You could try to write a i386 virtual machine for PocketPC, and install a Windows (98, 2k, XP) on that virtual machine.
Sorry, just kidding :lol: . No, actually you can't run a PC binary on a PPC. If you have the source code than you can compile it for PPC, if there aren't unsuported features inthe code (usually there are so you have to change the code). It's usually hard work to port an application that was written without thinking of porting it (does the Bridge pattern ring a bell? :wink: )

[Windows Phone Utility]Rapi Communications

Program to communicate between the PC <-> Device WP7.The application supporting the connection to the device.
It works on the principle of RAPI communications. He pulled out of the Zune Program
Info:
Description of the product: Windows Phone RAPI Communication Service EXE
Product Name: Zune
Product Version: 4.7.109
Usage:
Waiting....
Files in Attachmend
How to Use?Demo?
Is there any way to access phone without Zune drivers or Zune software installed using this application? Clicking on the EXE doesn't do anything.
thesecondsfade said:
Is there any way to access phone without Zune drivers or Zune software installed using this application? Clicking on the EXE doesn't do anything.
Click to expand...
Click to collapse
have any idea what the communication RAPI?
See this: RAPI in MS
Nokser said:
have any idea what the communication RAPI?
See this: RAPI in MS
Click to expand...
Click to collapse
But how does this package fit into that? This looks like perhaps a way to get native debugging working, but I don't see what to do with this.
You haven't provided any information about what it does--the program just quits regardless of zune state or WP-device connected state. What does it do? Through what means is someone to interact with it? I don't know too much about how RAPI worked on Windows Mobile, but there isn't any indication of how to use /this/ in the article you linked.
davux said:
But how does this package fit into that? This looks like perhaps a way to get native debugging working, but I don't see what to do with this.
You haven't provided any information about what it does--the program just quits regardless of zune state or WP-device connected state. What does it do? Through what means is someone to interact with it? I don't know too much about how RAPI worked on Windows Mobile, but there isn't any indication of how to use /this/ in the article you linked.
Click to expand...
Click to collapse
I give to more info... but not now my friend
[This is a reverse engineering effort in progress. Your mileage may vary and information below could be completely inaccurate. Proceed at your own risk.]
It's a Windows service. Copy it somewhere handy, and issue the command (editing the path as necessary). NOTE: The spaces are required.
Sadly, I don't recall retail phones having RAPI bits, so doubt this will be useful. I'll have another look at the filesystem though.
Update: Judging by the way this executable behaves, it's likely meant to replace WMZuneComm.exe.
Update 2: Because of the reliance on Zune libraries (e.g. ZuneSA.dll), this is for 32-bit Zune users.
Update 3: Listens on localhost, port 64694
These are old binaries from old Zune client software. Retail devices don't have RAPI bits (verified via samsung ffus), therefore this is useless. Silly original poster.
WithinRafael said:
[This is a reverse engineering effort in progress. Your mileage may vary and information below could be completely inaccurate. Proceed at your own risk.]
It's a Windows service. Copy it somewhere handy, and issue the command (editing the path as necessary). NOTE: The spaces are required.
Sadly, I don't recall retail phones having RAPI bits, so doubt this will be useful. I'll have another look at the filesystem though.
Update: Judging by the way this executable behaves, it's likely meant to replace WMZuneComm.exe.
Update 2: Because of the reliance on Zune libraries (e.g. ZuneSA.dll), this is for 32-bit Zune users.
Update 3: Listens on localhost, port 64694
These are old binaries from old Zune client software. Retail devices don't have RAPI bits (verified via samsung ffus), therefore this is useless. Silly original poster.
Click to expand...
Click to collapse
You do not have right to end because of ... Each distributed system WP7, has the shell RAPI applications and libraries.
You can't just dust off old Zune files from 2009 and magically connect this to a phone. Get real.

[Guide] Debugging with VS2010 on a custom Mango ROM... (Workaround on HTC devices)

As a smartphone fan I always wanted to be able to do whatever I wanted to do with my device, so a custom rom is one of the best choices for me. As a developer, I always wanted to be able to debug my applications on the device. With Mango, debugging and full interop unlock on a custom rom was not possible... till now!
The concept is quite simple: I create a fully locked (yes, it’s not a typo) ROM that fits my needs, I register it (and let the registration process do the magic trick and enable debugging for me) and after that I interop unlock and prevent the device from relocking.
The solution: In many cases we used the “engine” of the Connection Setup to deploy our provxml’s on the device, so why not now??? The Connection Setup (which is already deployed to our devices) uses the package “CSConn_DB” as a source (all those dbz files) to initialize MMS, APN, etc settings. The dbz’s are just password protected zip files with the extension changed.
So... I created two of those files (one for full unlock and one for lock), removed the Relock “time bomb” (969eb155-55ff-4884-9ecb-241c8a4b6e09.exe) I added them to my ROM, I deployed it to my phone and voila! One fully unlocked ROM with debugging capability!
The steps I followed:
1. Cooked and deployed a locked custom Schubert ROM (In this point, I need to thank Cotulla, DFT and everybody else who made custom WP7 roms possible).
2. I registered (as usual) the phone.
3. I opened connection setup and selected “Manual Selection”.
4. In the countries list I selected “Phone Customization” (What a nice country name don’t you think?)
5. I selected “Dev and Interop Unlock” from the available providers and tapped ok (the other one is for locking it back... in case I change my mind ).
That’s all! Now I have a full unlocked ROM and I can debug in the same time!
I have attached all the files I changed for my Schubert, but I think that for the other models the procedure remains the same.
So... Happy debugging (for me and anyone interested)!
EDIT: Password for dbz's on Schubert is 030D681B-1DFC-4bd0-A72A-A9B3CCCDA653
Good workaround, my friend, congrats!
how to get the passwd of the dbz?
ted973 said:
how to get the passwd of the dbz?
Click to expand...
Click to collapse
I just updated the post with the password...
kounadisk said:
As a smartphone fan I always wanted to be able to do whatever I wanted to do with my device, so a custom rom is one of the best choices for me. As a developer, I always wanted to be able to debug my applications on the device. With Mango, debugging and full interop unlock on a custom rom was not possible... till now!
The concept is quite simple: I create a fully locked (yes, it’s not a typo) ROM that fits my needs, I register it (and let the registration process do the magic trick and enable debugging for me) and after that I interop unlock and prevent the device from relocking.
The solution: In many cases we used the “engine” of the Connection Setup to deploy our provxml’s on the device, so why not now??? The Connection Setup (which is already deployed to our devices) uses the package “CSConn_DB” as a source (all those dbz files) to initialize MMS, APN, etc settings. The dbz’s are just password protected zip files with the extension changed.
Click to expand...
Click to collapse
Interesting idea But how do you want to debug? and what do you want to debug? C# code with source code can be debugged with VS2010, Native C++ and COM DLL can't be debugged, afaik?
rudelm said:
Interesting idea But how do you want to debug? and what do you want to debug? C# code with source code can be debugged with VS2010, Native C++ and COM DLL can't be debugged, afaik?
Click to expand...
Click to collapse
I mostly debug .net apps. Haven't tried unmanaged with this solution, but I'll give it a try!
Sent from my HD7 T9292 using Board Express
All those .DBZ files are only in \Windows\, right? Is there any way to point Connection Setup at a DBZ (or similar) stored elsewhere on the phone? This could potentially be used for interop-unlock on retail ROMs too. We can write to almost anywhere on the filesystem even with an interop-locked phone... except for the \Windows\ folder.
well, ... I don't understand what can I do with these files.
can u please write more 'n00b'-ish tutorial ?
kthx
if you dont understand odds are you dont need it
Sent from my GT-S5830 using XDA App
yeah.. gfy

[Q] Mod Windows RT to enable Remote Desktop

In the past, Windows has had editions for consumers that did not include Remote Desktop enabled. Usually there was a patch to enable it. Recently it has been proved how there is almost no difference between Windows 8 and Windows RT and that RT is just a port of Windows 8. So what about all the system files? They can be changed just like x86 Windows. So what about enabling Remote Desktop, so we don't need a ARM remote app that we need to unlock Windows for, and we can use what comes with Windows. In the past we modified the termsrv.dll file and changed some registry settings. I've included the Windows 8 and the Windows RT versions of termsrv.dll so that maybe some clever ones might try and crack a solution to enabling it on Windows RT.
sionicion said:
In the past, Windows has had editions for consumers that did not include Remote Desktop enabled. Usually there was a patch to enable it. Recently it has been proved how there is almost no difference between Windows 8 and Windows RT and that RT is just a port of Windows 8. So what about all the system files? They can be changed just like x86 Windows. So what about enabling Remote Desktop, so we don't need a ARM remote app that we need to unlock Windows for, and we can use what comes with Windows. In the past we modified the termsrv.dll file and changed some registry settings. I've included the Windows 8 and the Windows RT versions of termsrv.dll so that maybe some clever ones might try and crack a solution to enabling it on Windows RT.
Click to expand...
Click to collapse
termsrv is a system service and how can we use a modified termsrv.dll before we use the Jailbreak tool?maybe we can edit termsrv.dll in the memory.
We can't, I suspect. Even after jailbreaking, the lack of a signature on a system file may be a problem. It's worth a shot, though.
termsrv.dll -should- be a usermode library that would be editable after the jailbreak.
I am able to take ownership of the file and replace it. But it won't use the termsrv.dll from my windows 8… I'm almost positive it is because the dll is different depending on architecture. But it should be as easily replaceable as any system file on windows 8, am I right? I don't see why it wouldn't but I could be wrong.
Yeah, pretty much. You definitely won't be able to use the Win8 version (x86 machine code, ARM processor, not gonna fly...) but a modified version of the Windows RT version might work. Bear in mind that since modifying the DLL will invalidate the signature, this won't work if the signature validation is enforced (i.e. you'll have to jailbreak).
Should be possible using the Remote Debugging Tools or, even better, cdb. Put it in a .cmd file in autorun and voila
clrokr said:
Should be possible using the Remote Debugging Tools or, even better, cdb. Put it in a .cmd file in autorun and voila
Click to expand...
Click to collapse
Please!! Remote desktop would be awesome enabled on the Surface RT, if someone could work on it I know a lot of people would be very grateful!
I've already posted a method that should enable RDP here: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
mamaich said:
I've already posted a method that should enable RDP here: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse
Can you share how you managed to get the rt joined to a domain?
mamaich said:
I've already posted a method that should enable RDP here: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse
Wouldn't both methods work though? Your method works by enabling features from other editions by telling Windows that's what edition it is running. It disables it when the Software Protection service restores it to the original template according to the edition. By patching the DLL file, you could trigger Remote Desktop to work without it needing to check in with the kernel policies.
I mean unless you have a way to modify these policies without all the extra occuring, it would work. But Bitlocker and the Software Protection service getting involved...it just sounds like a lot of extra work for something much bigger in the end, and I know there must be an easier way to force Remote Desktop to work without listening to these policies because it has been done in the past.
mamaich said:
I've already posted a method that should enable RDP here: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse
I tried to enable one of the Remote Desktop vars last night, allowRemoteConnections I think it was called, but I didn't get anything from it.
mamaich said:
I've already posted a method that should enable RDP here: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse
Again, please if you were able to join an RT to the domain. Please let me know what you did. Would love to not get prompted to log in into PowerShell.
apatcas said:
Again, please if you were able to join an RT to the domain. Please let me know what you did. Would love to not get prompted to log in into PowerShell.
Click to expand...
Click to collapse
As I've already wrote - use this method: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211
1. Edit registry:
Code:
HKEY_LOCAL_MACHINE\SYSTEM\Setup
SetupType=1
CmdLine="cmd.exe"
and reboot. You will enter the setup mode. You would not see the mouse cursor in this mode, and you'll need a hardware keyboard.
2. Open this reg_binary value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductPolicy. Look for unicode string "WorkstationService-DomainJoinEnabled", it is near offset 0x4000. Look at this screenshot:
http://imageshack.us/photo/my-images/526/35796208.png/
Select the "00" byte that follows the zero byte after the 64 (64 00 == unicode "d" letter) as you see on the screenshot. Overwrite it with 01. Be careful not to insert a byte, you need to overwrite the existing byte!
3. Rename sppsvc.exe to anything else so that it would not run on boot and reset ProductPolicy ("ren sppsvc.exe sppsvc.bak")
4. Reboot. Now the option to join the domain would be available.
I have not tried to add workstation to domain myself - try that and post here. After adding to domain you may try to rename sppsvc.bak back to sppsvc.exe as otherwise you'll get the "unactivated" Windows RT. I think that this would only remove the add to domain UI, but the RT would be still domain-joined.
I've tried to edit the remote desktop settings keys - this unblocked the corresponding options in the computer settings, but I was unable to connect. Maybe this is due to absence of RDP code in terminal server service - I don't see anyone listening port 3398 though TermServer service is running.
mamaich said:
As I've already wrote - use this method: http://forum.xda-developers.com/showpost.php?p=36386089&postcount=211
1. Edit registry:
Code:
HKEY_LOCAL_MACHINE\SYSTEM\Setup
SetupType=1
CmdLine="cmd.exe"
and reboot. You will enter the setup mode. You would not see the mouse cursor in this mode, and you'll need a hardware keyboard.
2. Open this reg_binary value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductPolicy. Look for unicode string "WorkstationService-DomainJoinEnabled", it is near offset 0x4000. Look at this screenshot:
http://imageshack.us/photo/my-images/526/35796208.png/
Select the "00" byte that follows the zero byte after the 64 (64 00 == unicode "d" letter) as you see on the screenshot. Overwrite it with 01. Be careful not to insert a byte, you need to overwrite the existing byte!
3. Rename sppsvc.exe to anything else so that it would not run on boot and reset ProductPolicy ("ren sppsvc.exe sppsvc.bak")
4. Reboot. Now the option to join the domain would be available.
I have not tried to add workstation to domain myself - try that and post here. After adding to domain you may try to rename sppsvc.bak back to sppsvc.exe as otherwise you'll get the "unactivated" Windows RT. I think that this would only remove the add to domain UI, but the RT would be still domain-joined.
I've tried to edit the remote desktop settings keys - this unblocked the corresponding options in the computer settings, but I was unable to connect. Maybe this is due to absence of RDP code in terminal server service - I don't see anyone listening port 3398 though TermServer service is running.
Click to expand...
Click to collapse
Joined... Nice find.
apatcas said:
Joined... Nice find.
Click to expand...
Click to collapse
Have it remained domain-joined after restoring the original sppsvc.exe?
You have to return it back, otherwise you'll be annoyed with the activation reminders.
mamaich said:
Have it remained domain-joined after restoring the original sppsvc.exe?
You have to return it back, otherwise you'll be annoyed with the activation reminders.
Click to expand...
Click to collapse
We could possibly patch sppsvc to not check, then start the service up after jailbreaking it.
I'm honestly not sure if this would be considered piracy or not, though.
Edit: I used the program to set every value to 1 in setup mode (The latest jailbreak tool works in setup mode), and I didn't see any change for anything dealing with RDP.
Edit 2: Perhaps I shouldn't have set 'Disable' to 1. Regardless, I set it to 0 and the options popped up, but I can't get anything to go. As mamaich stated, I'm not seeing anything listening on port 3389. netstat -a -b on a desktop with it enabled says it's opened by CryptSvc, but I'm not seeing anything with CryptSvc that's not there on the tablet. That could just be netstat guessing which service running under svchost is actually running it, too.
netham45 said:
We could possibly patch sppsvc to not check, then start the service up after jailbreaking it.
I'm honestly not sure if this would be considered piracy or not, though.
Edit: I used the program to set every value to 1 in setup mode (The latest jailbreak tool works in setup mode), and I didn't see any change for anything dealing with RDP.
Edit 2: Perhaps I shouldn't have set 'Disable' to 1. Regardless, I set it to 0 and the options popped up, but I can't get anything to go. As mamaich stated, I'm not seeing anything listening on port 3389. netstat -a -b on a desktop with it enabled says it's opened by CryptSvc, but I'm not seeing anything with CryptSvc that's not there on the tablet. That could just be netstat guessing which service running under svchost is actually running it, too.
Click to expand...
Click to collapse
I think we must hack the dll file.But I find when I edit a byte in the dll,the service was not able to start.
apatcas said:
Joined... Nice find.
Click to expand...
Click to collapse
So is it true? that your device stays domain-joined after you restore sppsvc.exe?
@ Netham45, you could try to open up W81x86 termsrv.dll and go to these hex locations to find out what functions needed patching.
Hashes
File: W81x86\termsrv.dll
CRC-32: 202cd912
MD4: a879d39b8fbcd968b525af05a66aaf2c
MD5: 7a8e1158291cf4c8d8474a2091b9bf6d
SHA-1: e10028b074d24605e05b5e0bafd42f6a93ac01ad
1550F-15520
17428
A1B29
Then go into WinRT termsrv.dll, jump to those functions by name (because offsets will be different between x86 and RT) and Jmp or Nop as needed for WinRT. Afterwords it could be added via CDB / KD on-the-fly.

Architectural advice needed for Android to from PC communication

Hello there . I'm a bit in doubt as to what approach I should take when creating an application which should accomplish the following: use the USB connection between the device and the Windows-PC to display on the device's screen some information sent by an application residing on the PC. The phone should always operate in airplane mode but Android Debug Bridge works fine on it.
What I'd like to do is to write a Java Application (running on Windows) which reads from a text file and puts that information on the Android device's screen, but I don't know if there are any libraries I can use in a JDK application to achieve this.
Also, I'm not even sure if using ADB is the best option. Perhaps I could initiate communication via USB in a different way?
Please share with me your architectural advice. I would REALLY appreciate some examples or open source projects which achieve similar things. I'm a senior developer but I have very little experience with Java or Android (my background is C#/C++/ECMAScript).

Categories

Resources