[SOLVED] Disassembling DLLs in WP7 firmware? - Windows Phone 7 Development and Hacking

Hi there, first post but I could use some assistance.
I took the stock emulator image that's included with the dev tools and ran (I believe, this was a bit ago) viewbin.exe, cvrtbin.exe, and dumprom.exe on the image (basically the same technique that's used to dump the Zune firmware), resulting in all the files.
In particular, I'm looking to reverse engineer the MTPZ protocol, so I looked at MtpHandshakePlugin.dll which seems to be just what I need based on the strings contained within. When I load it into IDA Disassembler, IDA correctly finds strings and the exports and imports and what not. The problem is, it can't seem to find any function declarations or code. The only code it auto-analyzed was the start function, which was two instructions, the second instruction being a jump into a memory location it couldn't find. Prior to analysis IDA informed me that MIPS (the architecture of the image) supported memory mapping and that I could manually map addresses.
So, I assume that this jump address is memory mapped and I have to figure out where to map that to, after which IDA should be able to find all the code. The problem is, how do I know where to map the address to?
Long-ish post, I know, but any help would be much appreciated!

Hi,
Your problem is that IDA is using the wrong machine type. The DLL's are X86 from the emulator not ARM. You need to switch the machine type in the PE header to X86.
I typically just do this by hex editing the byte sequence C0 01 to 4C 01 but you can use any PE editor for this.

Ah, you are absolutely right. The thought crossed my mind earlier but I quickly dismissed it. Everything seems to be analyzed perfectly.
Thanks a ton!

Related

Emulated Windows Mobile 6 ROM Dumping

Hi,
My first post here, hope to don't broke any Forum Rule.
I'm running an emulation of Windows Mobile 6 (SDK) taken from Microsoft,
and I've the necessity to study and extract system dlls (such as for PDB)
and looking for certain Undocumented Functions.
My question is, Is possible/necessary to make a dump of this Emulated WM6?
If yes can you please point my to the right links and threads?
Regards,
Giuseppe
Hi,
How can I extract DLLs and other resources from PPC_ITA_GSM_VR.BIN ?
I've tried with splitrom.pl but does not recognizes that format ( hash MD5 does not match)
I've also seen that there is another Suite of Tools ImageFsToolKit I've to use it? if yes can you point me how?
Hope in a Reply
Have a Nice Day,
Giuseppe
Check out this Emulator Kitchen thread
Many thanks for your precious help!
I've runned 1_UnpackEmuROM.cmd and the process worked correctly
\OEM
\SYS
\ROM
Now my question is, every dll have a directory that contains imageinfo.bin and various S00x files, which tool I've to use to assemblate it in the final DLL?
I've also seen a little bug into BuildOS.exe, the crash is caused by a not Catched Exception, precisely is caused from an unhandles System.IO.DirectoryNotFoundException all you have to do to avoid that is to implement a try/catch block for this exception
Regards,
Giuseppe
Download the attachment
Unpack that
Place the folder of the dll (or exe) in the unpacked one. Note: The folder, not just the files.
Run ReversRecMode.bat
Look into the folder
It worked!
Many thanks!

[UPDATED 18.4.2010] OpenGL ES 2.0 wrapper for .NET Compact Framework

I've released it at http://oglesv2cf.codeplex.com/.
If you want to see the latest in development go to the site shown above.
Updates:
18.4.2010 - rough support for textures
--------------------------------------------------------------------------------------------
I've started working on creating a .NET CF wrapper library for using the OpenGL ES 2.0 on Snapdragon based WM 6.5 devices. (I'm doing the development on HTC HD 2 device).
----------------- original post---------------------------------------------------------------
Hi,
I'm interested in trying out making something simple using OpenGL ES 2.0. I own HD and HD 2 devices and I know that HD at least supports OpenGL ES 1.1.
Has anyone experimented with OpenGL ES 2.0 on HD 2? Snapdragon should support 2.0 but is the libGLESv2.dll present somewhere in the system? I have tried looking for it but didn't spot it right away.
Especially I would be interested in writing a wrapper for OpenGL ES 2.0 to work with .NET CF. I've seen this is possible with ES 1.1.
The onboard gpu that the msm720XX has dosnt support openg Gl ES 2.0 only 1.0/1.1, you would have to ether develope using 1.0/1.1 or buy a device supporting open gl ES 2.0, the acer s200 could be your best bet or a LG expo if you like HW keyboards, or the hd2 if you have spare legs and arms to give.
If it wasn't clear in the OP I do have a HTC HD 2 device which does have Snapdragon with OpenGL ES 2.0 support.
I did some digging and found few posts about OpenGL ES 2.0 on HD 2 but did not find any concrete samples which I could use to test if the performance is good enough.
The dll should be in /windows.
I wanted to start this but without such a device (or a software renderer) it's difficult...
Have a look at OpenGL ES Core API Specification, Headers, and Documentation ! The gl2.h file can serve as base for the managed wrapper file.
As a start check out my OpenGL Test application (link in signature)where I've released the source code of an early version. There you'll find a managed wrapper for OpenGLES 1.1.
Maybe we can setup something together?
Investigating the files
I have continued my reseach (Got some beer as most of my work is beer driven).
I have done some research on the DLL files included in the HTC HD 2 device.
So far this is the list of lib*.dll files under Windows on my device:
- libGLES_CL
- libEGL
- libEGL_org
- lib2d-z430
- libGLES_CM
- libGLESv1_CM
- libGLESv2
- libgsl
- libgsluser
- libkos
- libOpenVG
- libos
- libpanel
- libq3dtools
- libegltools
- libqgl2tools
- libqgtools
- librenderboy
I know that libEGL, libGLES* are the files I should concentrate on. Especially libGLESv2 which is the OpenGL ES 2.0 implementation. I also see that there is a OpenVG implementation on the device.
I know that I can get the header files for the OpenGL ES and OpenVG from Khronos site but is there a tool to view the dll export table of a WM mobile dll file? I know tools that can do that for a desktop windows dll file but haven't tested them on WM dll files yet.
lib2d-z430 got my interest also as z430 is the graphics chip part of the snapdragon.
Yep, eventually I would like to share my findings and code but for now I'm doing this mainly on my own. Ofcourse any help is welcome.
I've run into issues while trying to copy few of those files to my desktop PC. I'm getting access denied of resco explorer when trying to copy libGLESv2 file to storage card on my device.
saeros said:
I have continued my reseach (Got some beer as most of my work is beer driven).
I have done some research on the DLL files included in the HTC HD 2 device.
So far this is the list of lib*.dll files under Windows on my device:
- libGLES_CL
- libEGL
- libEGL_org
- lib2d-z430
- libGLES_CM
- libGLESv1_CM
- libGLESv2
- libgsl
- libgsluser
- libkos
- libOpenVG
- libos
- libpanel
- libq3dtools
- libegltools
- libqgl2tools
- libqgtools
- librenderboy
I know that libEGL, libGLES* are the files I should concentrate on. Especially libGLESv2 which is the OpenGL ES 2.0 implementation. I also see that there is a OpenVG implementation on the device.
I know that I can get the header files for the OpenGL ES and OpenVG from Khronos site but is there a tool to view the dll export table of a WM mobile dll file? I know tools that can do that for a desktop windows dll file but haven't tested them on WM dll files yet.
lib2d-z430 got my interest also as z430 is the graphics chip part of the snapdragon.
Yep, eventually I would like to share my findings and code but for now I'm doing this mainly on my own. Ofcourse any help is welcome.
Click to expand...
Click to collapse
Maybe after disabling Manila/Sense (from the Settings - Today - Items tab) will allow you to copy the files?
As you probably have seen I've also an OpenVG demo included in the lastest Test OpenGL version for which I've created an OpenVG managed wrapper. Does this test run on HD2? What's the starting time? (on HD it takes some seconds to build the textures because textures, paths and strokes are not hardware accelerated, well that's what I get when querying the driver).
Are you still in need of the drivers? I can upload them now?
I'm also going to make a lib file for linking C++ programs with GLES 2.0, based on the gl2.h file, and possibly some of the exported functions of libGLESv2.dll.
Hi,
I posted lib versions of the required files a few weeks ago. Just search on posts with my user name. I've done some porting of futuremark 3d mobile es2.0 and the performance is not good. I'm hoping to do some more debug this week to see why this device is not running as I would expect.
Jim
l3v5y: if you have the drivers at hand it would be great if you can share them.
heliosdev: I tried you are new test app and the OpenVG option is grayed out.
Have you tried it with the driver pack? http://forum.xda-developers.com/showthread.php?t=592663
dattrax said:
Hi,
I posted lib versions of the required files a few weeks ago. Just search on posts with my user name. I've done some porting of futuremark 3d mobile es2.0 and the performance is not good. I'm hoping to do some more debug this week to see why this device is not running as I would expect.
Jim
Click to expand...
Click to collapse
EGL
Okay I got the egl from libEGL.dll working. Well at least it's initializing and terminating without errors.
One thing I noticed is that the version it is reporting is 1.3. It should be 1.4 or at least that is the latest version published on the API site.
I'll do some querying to get the rest of the information about the cabilities of the device.
Translator needed
Okay I did a simple query to get the egl version string from the egl.
The result is probably a string with chinese, japanese or some other asian language I don't understand.
eglQueryString results
EGL_VERSION : "⸱″湉整湲污瘠牥楳湯ㄠ㐮ㄮ"
EGL_VENDOR : "摁慶据摥䴠捩潲䐠癥捩獥‬湉c"
EGL_CLIENTAPIS: "灏湥䱇䕟⁓灏湥䝖"
EGL_EXTENSIONS: "来䍬敲瑡健畢晦牥牆浯汃敩瑮畂晦牥䔠䱇兟䅕䍌䵏彍桳牡摥楟慭敧䔠䱇䭟剈楟慭敧"
Reminds me of early days when MS used to translate their VB programming enviroment inside Office applications.
Hope that the glGetString results are in English.
the reason you cant copy them is because they are modules..
Ideally you need to dump a stock rom and examine either the modules, or recmod them to convert them to files.
you also need diaglsm file, I think.
Still not certain what the DAL files in the oemxip do..
Use this code to get the strings:
byte[] buffer = new byte[2048];
Marshal.Copy(gl.GetString(gl.GL_VENDOR), buffer, 0, buffer.Length);
string result = Encoding.UTF7.GetString(buffer, 0, buffer.Length);
Click to expand...
Click to collapse
saeros said:
l3v5y: if you have the drivers at hand it would be great if you can share them.
heliosdev: I tried you are new test app and the OpenVG option is grayed out.
Click to expand...
Click to collapse
Updated the test app with OpenVG support on newer devices (different name of the OpenVG dll). Please try again!
Once I get that far. Currently I have the EGL part working against the libEGL.dll file. I know you probably already have this done but as this is a learning project for me I started from scratch.
heliosdev said:
Use this code to get the strings:
Click to expand...
Click to collapse
But use it in your current code to have the asian characters 'translated'!
Could you explain it a bit better. What do you mean 'translated'? I don't think the result changes to anything with UTF7. I'm already reading the pointer string returned using unicode character set and getting back a valid result. The only problem with the result is that who ever implemented the libEGL on the device decided to use some other language than english as the content of the strings.
heliosdev said:
But use it in your current code to have the asian characters 'translated'!
Click to expand...
Click to collapse
I used to get such characters before using the above way to read the string.

How to protect .Net applications ?

Hi,
I know that there is a program called dotfuscator that simply obfuscates most of the code but I've been trying to use it without sucess.
My program has some external dependencies (like StedySoft.SenseSDK.dll) and everytime I try to obfuscate it it gives me an error :
Error encountered while loading module (C:\Users\projects\myproject\bin\Release\StedySoft.SenseSDK.dll). Não é possível ler para além do fim da sequência.
Build Error.
Click to expand...
Click to collapse
The second part of the error is in portuguese. Translating it to English it should say something like "Cannot read beyond the end of the sequence" (whatever that means).
How can I protect my application ?
Hi,
It looks like the supporting SenseSDK DLL is obfuscated with a tool (such as .NET Reactor) that breaks its ability to be processed in any way by other tools. This includes Dotfuscator - even if it is not an input assembly, you will not be able to obfuscate your application while referencing this DLL. You will notice that Reflector and even Microsoft's ildasm tool cannot read this file.
Since this is a library which is meant for others to reference, I would guess this breaking behavior is probably caused by a mistake in the DLL author's obfuscation settings. The only thing you can do is ask the DLL's author to either turn off the options that cause the obfuscator to make the output assembly non-verifiable, or to use a different obfuscation tool which produces verifiable output assemblies, such as Dotfuscator. Or you can forgo obfuscation of your application altogether.
Breaking the output assemblies in such a way is really quite pointless anyhow, since changing the byte at 0xF4 from 0x0F to 0x10 will allow the DLL to be loaded into Reflector successfully. From there, the IL code can be dumped to disk and recompiled into an unprotected DLL.
--Brandon Siegel
Thank you very much for your clear response. I'm going to try to contact the author.

Fixup (.reloc) section format in WinCE XIP

I feel completely lost.
Structure of FIXUP table in executable module extracted from XIP (I took cecompr.dll, but that does not matter) is something impossible to reverse engineer.
What I manage to find is that first word is "page RVA" (16 bit, can't find out why 16 bit is enough), then size (in bytes) of the following records.
But then I can't understand what is there, behind page rva and size. PE file description by Microsoft is not correct, I tried to use it, but it is not for WinCE and thus does not help at all.
Does anybody know how to parse .reloc section of WinCE module?
Maybe, there's some sources of greloc/mreloc/platformrebuilder around? I'll be grateful for any clues.

[USERMODE DRIVER] OPL3 FM Softsynth

Hi guys, I just registered here to let everyone know I'm currently working on a forked codebase of an (LGPL) OPL3 MIDI synth running entirely in software (uses the emulator core from DOSBox IIRC) and it turns out with a bit of a fiddle other than the compilation prerequisites, this works on the Surface tablet.
After procuring a Surface RT during the fire sales last month or so, I was curious as to whether or not it was possible to change MIDI devices on this thing. As it turns out, since Windows 8, Microsoft has evidently crippled MIDI playback device selection even more and this is also reflected in Windows RT. (ie: only means is to change the midi string in HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32 to point to the DLL you wish to load)
Anyway, you can find out more about progress and source code here (Note: content aimed at standard desktop):
Original thread (Alexey Khokolov's original code and further discussion)
www DOT vogons DOT org/viewtopic.php?f=9&t=36667
Forked driver source code:
bitbucket DOT org/djtubig-malicex/opl3-synth-driver
WinRT binary here (with default Fat Man / Windows OPL patches):
dl DOT dropboxusercontent DOT com/u/1287967/WinRTexe/opl3emu.dll
Installation instructions:
1. Save the .dll file somewhere, preferably %WINDIR%\system32
2. Open regedit and browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
3. Rename the existing "midi" key to say midi1 or midi2
4. Create a new key "midi", and have its contents contain the filename "opl3emu.dll" (alternatively the full path, may need quotes)
means of changing MIDI device is identical to windows 8 it seems however I have not tested existing utilities at this time
4a. If you do not wish to set it as a default, simply make a new key eg: "midi1" or "midi2" and have it contain "opl3emu.dll". Apps will still recognize its existence.
If you need a MIDI player, this C# code seems to work.
stackoverflow DOT com/questions/3884251/no-sound-heard-while-playing-a-midi-file-in-c-net
Alternatively, use GSPLAY with the DOSBox WinRT build. You can also explicitly specify MIDI device this way (refer to dosbox documentation).
Anyway, hope everyone enjoys making their Windows RT tablet play CANYON.MID in classic FM on their modern Microsoft tablet. :v

Categories

Resources