Running Sim Toolkit Apps - Windows Mobile Development and Hacking General

Hi,
Does anyone know if there is a way to get a list of the STK Apps installed on the SIM and execute them on user's request. I'am not looking for an app to do that, I'm interestend in implementing this functionality in my application. So I am basically asking is if there is any way to do that using the APIs provided by the SDK.
SimReadRecord could be an option, provided somebody knew which address to look for and how data is formated. Anyone has any ideas?
Thanks in advance.
Nikos.

no, you won't have it with SimReadRecord (as the toolkit menu is generated "on the fly" as the card notify the phone). There is a way to retrieve it through the RIL, but I don't have understood it fully, yet, but it's probably related to an internal command (such as RILSendMsg). If you have a way to "spy" the exchanged RIL messages, it may help you :wink:
it's easier to execute them, with the appropriate envelope command. See the RIL SIM commands and your favorite 11.14 standard :wink:

Do u know if I can succesfully use RIL_SendSimToolkitEnvelopeCmd() to send envelope commands?
I read and implemented function to build a ENVELOPE CMD SMS-PP (11.14) DOWNLOAD, but when I execute RIL_SendSimToolkitEnvelopeCmd() I get
Ril_* error RIL_RESULT_ERROR = 0x00000003 ...
Can you help me?
What about directly accessing ril.dll ?
Thank

Related

[Help needed]: cprog.exe and OS stripping

Please help me out a little, I am rather new at XDA development.
I'm developing an embedded application for GPS/GSM vehicle tracking, so there is this app which autoanswers GSM data calls, and provides access for software on the operator pc, so it can read the vehicle's position when needed. I have a problem with cprog.exe and the OS in general - it's getting in the way. I need to do the following:
a) Put a logo in the bootloader, so when it boots it needs to show a picture and some text
b) Somehow disable cprog.exe gsm phone app, detach it from the green button etc... but I still need the GSM to be operative and come up (I disabled the pin on the sim card). I don't want any announcements of any kind, just that it register to network and can recieve data calls.
c) To remove the ugly start button and the upper status line, so that nothing else can be run besides my program. I have put the program in startup but am wondering is there a more suitable way to run it... I don't need the today screen or any other **** OS provides, just the GSM data functionality and the application running. How do I strip down the OS and loose all the unnecessary features?
Thanks for your kind help in advance,
Mirko
p.s. Oh yes, the device is a T-Mobile MDA ARM SA1110/206, PW10A2, ROM 3.16.48, Radio 3.19.00, Protocol ver 32S54
a) see romtools on how to do that.
b) if you call RegisterHotKey with key 0x73, right after killing cprog, cprog will stay dead.
c) call SHFullScreen with HIDESTARTICON
XDA developer Itsme said:
a) see romtools on how to do that.
b) if you call RegisterHotKey with key 0x73, right after killing cprog, cprog will stay dead.
c) call SHFullScreen with HIDESTARTICON
Click to expand...
Click to collapse
Thanks for great advices! Did you mean to register 0x72 (that should be the answer key) and then kill cprog? I've tried doing this but it returns 0xb7 as error (and the header file states "wrong flags" as the meaning of 0xb7). 0x73 is supposed to be the hangup button, should I register him right after killing cprog?
Few more questions, and thanks again for helping me.
a) how do I disable smsreciever.exe, SMSDaemon.exe and what do other exe processes do ? (Ussd.exe, aFlashMan.exe, cFlashMan.exe, etc..)
b) I would like exclusiveness for my app, on unix systems I would call it instead /bin/init right from the kernel and it would run alone on the system. Is it possible to do something like that here, that the kernel executes my program directly, and when program perhaps crashes, control isn't returned to the system but device needs to be rebooted. This application is the only thing that is allowed to be ran in XDA, any suggestions would be highly appreciated! Oh yes, how do I put it in rom? Simply with mkrom?
c) What is the best way to implement a copy protection on XDA in Your opinion? Is there perhaps source code of bootloader available? I know M$ recently published WinCE 3.0 source, but I assume XDA still hides it's secrets?
d) I've specified my hardware platform in previous post, is it's PDA rom part allowed to be upgraded with special edition 1.2 ROM ? Can I use ROMKitchen to cook my own ROM?
e) Is it possible for app to read/write device's own flash? To put information inside.
Sorry for going all the way to e) but I have nobody else to ask..
Thank you,
Mirko
Please help - I am trying to kill cprog.exe, but cannot find the romtools page, it says the page cannot be found? Has it been moved/deleted??
Is there anywhere else I can get the necesary prog to kill of cprog.exe??
Thanks
icarusbop said:
Please help - I am trying to kill cprog.exe, but cannot find the romtools page, it says the page cannot be found? Has it been moved/deleted??
Is there anywhere else I can get the necesary prog to kill of cprog.exe??
Thanks
Click to expand...
Click to collapse
Come on. How hard have you tried getting this file(s) Ißm sure you didn't do anything more than clicking on the link.....
But here comes the working link.....
http://www.xs4all.nl/~itsme/projects/xda/romtools.html
Stefan
Ho hum: Actually i did a search as well and did end up at the page you sent me, but I was expecting a help file when I started searching; not a page of text, so I assumed it was the wrong page.
I now have the tools however, thanks for your help.
This is what I'm trying to do: I have been told if you kill cprog.exe the phone no longer works, and it does not load when you press the green button. I have tried this...
I killed cprog.exe with the rom tools, but pressing the green button still loads the phone. Is there something Else I need to do to stop this???
Thanks
itsme said:
b) if you call RegisterHotKey with key 0x73, right after killing cprog, cprog will stay dead.
Click to expand...
Click to collapse
Pushing the green button activates cprog.exe again, I think.
So call RegisterHotKey with key 0x73 to prevent that.
Why do feel like I am being think here??? Sorry to mither but...
Am, I right in thinking the registerhotkey is a C function?? I cannot find it in the romtools list. So I assume I need C++ ( and some knowledge) to execute registerhotkey??
Could some good man make me a simple app that kills Cprog.exe? (I dont have the tools and pc to build it this time)
No need to call registerhotkey 0x73.
/* Terminate cprog */
void kill_cprog()
{
HANDLE Proc, ProcTree;
PROCESSENTRY32 pe;
BOOL ret_val;
/* Get processes tree */
ProcTree = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
pe.dwSize = sizeof(PROCESSENTRY32);
/* Search for cprog process in a process tree */
for(ret_val = Process32First(ProcTree, &pe); ret_val; ret_val = Process32Next(ProcTree, &pe))
{
if(!wcsicmp(TEXT("cprog.exe"),pe.szExeFile))
{
/* Terminate cprog */
Proc = OpenProcess(0, 0, pe.th32ProcessID);
TerminateProcess(Proc, 0);
CloseHandle(Proc);
break;
}
}
CloseToolhelp32Snapshot(ProcTree);
}
other way:
just copy something to \windows\cprog.exe and reset
IIIu30uD said:
other way:
just copy something to \windows\cprog.exe and reset
Click to expand...
Click to collapse
Does overwriting this file cause anything to stop working, other than the phone GUI?
a) how do I disable smsreciever.exe, SMSDaemon.exe and what do other exe processes do ? (Ussd.exe, aFlashMan.exe, cFlashMan.exe, etc..)
Click to expand...
Click to collapse
Unless you dont know, what all these apps do, I dont recommend to disable them. To disable them, replace the exe files with one of your choice. Maybe with just a dummy win32 app that does nothing.
b) I would like exclusiveness for my app, on unix systems I would call it instead /bin/init right from the kernel and it would run alone on the system. Is it possible to do something like that here, that the kernel executes my program directly, and when program perhaps crashes, control isn't returned to the system but device needs to be rebooted. This application is the only thing that is allowed to be ran in XDA, any suggestions would be highly appreciated! Oh yes, how do I put it in rom? Simply with mkrom?
Click to expand...
Click to collapse
Run your app after the initial shell. Take a look at the registry, there will be HKLM\init, which defines which apps/drivers have to load in which order. Search for shell.exe and shell32.exe. To launch your app before the shell, enter new keys for Launchxx and Dependxx, with xx before shell32.exe. Be aware, that some helper apps need to be started. To lock the device, your app should not call SignalStarted(). Further, some API functions are only available, if shell32 is started.
c) What is the best way to implement a copy protection on XDA in Your opinion? Is there perhaps source code of bootloader available? I know M$ recently published WinCE 3.0 source, but I assume XDA still hides it's secrets?
Click to expand...
Click to collapse
Although I am not a specialist for this, you normally need M$ Platform builder to create a ROM images for a device. AFAIK there is no way to have a boot loader of your own, you always have to build the whole rom image.
d) I've specified my hardware platform in previous post, is it's PDA rom part allowed to be upgraded with special edition 1.2 ROM ? Can I use ROMKitchen to cook my own ROM?
Click to expand...
Click to collapse
:?:
e) Is it possible for app to read/write device's own flash? To put information inside.
Click to expand...
Click to collapse
:?:

Read and write SIM records

I am trying to access and Modify SIM content from the Operating System. I am working with a dual line twin card and want to change between one line and other by code.
I am using SIM Manager functions (SimGetRecordInfo, SimReadRecord and SimWriteRecord).
Does anybody know where I can find the structure which contains the two imsi data? I think it is not on the EF_IMSI (6F07), isn't it?
I have been able to read the EF_SPN (6F46), which contains the words Work or Home.
I have been able to read the EF_IMSI (6F07), which contains in Hexadecimal the current IMSI.
I have not been able to read the EF_MSISDN (6F40). Does any body know how can I do it?
I have also tried to write on these records (so that the current line will be changed) but I have got a "Security Failure". Have I got permission to modify this kind of records?
Thanks in advance

[Q][SOLVED] Locking on 3G/2G (or: accessing com.android.internal from application)

Hello everyone,
I'm writing an android application that needs to swap between 2G/3G networks.
I wasn't able to find any suitable function in the SDK documentation.
I tried "digging" into the android code to see how other activities (such as Settings.ACTION_WIRELESS_SETTINGS, the Phone Information technician code [*#*#4636#*#*]) implement it and came across com.android.internal.telephony.Phone which is in charge of the switching.
I guess the device has to be rooted to perform this (and of course, my application needs root privileges), however, I can't change the android code on the device.
So, my question is: How do I access com.android.internal.telephony.Phone from my application without changing the android code?
Many thanks,
Omri.
Anyone has an idea?
Thank you
CDMA or GSM?
And a lot of the telephony is private.
Sent from my iPhone with the bigger GeeBees.
I have good news: I got it working and I wanted to share on how.
I had a few problems on the way, but I faced them all.
First of all, being able to access com.android.internal.* from the SDK (with ADT) wasn't that comfortable before I ran into this guide, which lets you include all the hidden & internal APIs in your android.jar library and override the access rules limiting you not to access them in ADT.
After that was done, I thought I'm done, but I was wrong.
To switch from 2G to 3G you need to invoke setPreferredNetworkType() method on the Phone object (com.android.internal.telephony).
To get the Phone object, you'll need to invoke the getDefaultPhone() method on PhoneFactory (com.android.internal.telephony).
But, of course, nothing will be simple, this method only runs when your manifest inclues android:sharedUserId="android.uid.system" (aka, your process runs as system user).
Your process won't be able to run with the android.uid.system UID without your package being signed with the platform certificate.
To sign your package with the platform certificate, you need signapk.jar, platform certificate (platform.x509.pem) and platform key (platform.pk8).
Because I'm using CyanogenMod I was able to put my hands on the platform cert&key pair without recompiling android. (available here)
Once you have these, the rest is pretty simple:
Sign your APK with signapk.jar:
Code:
java -jar signapk.jar platform.x509.pem platform.pk8 Application.apk Application-signed.apk
Because this is a system package, you won't be able to install it with "adb install Application.apk", we'll have to use a different method.
Upload your APK to the /system/app folder (don't forget to mount /system for read-write before you do that):
Code:
adb push Application-signed.apk /system/app/Application.apk
The next thing to do is launch your activity:
Code:
adb shell am start -a android.intent.action.MAIN -n com.your.package/.YourActivity
That's it!
You got it working!
Good luck to whoever runs into this post
Cheers,
Omri.

[TOOL][PC/WIN][SMS]DatApp - A SMS Puller

DatApp​(looking for better names)​
This is an experimental tool to pull messages from an android device using ADB. I have tested it on an EVO 4G running an AOSP ROM. Not sure if it works on other skinned ROMs. The device must have USB Debugging enabled (to use ADB)
Version 1
Pulls SMS silently
No Window Present
Planned
Fancy Menu
Ability to pull call logs and contacts
More stuff that I don't know yet
Please post any bugs or which other devices this works on. Gracias.
Download Version 1 Here
I'd be more than happy to test once someone gives a thumbs up on if the file doesn't have a virus, malware etc
can't be too careful on the internet these days.....
miniura said:
I'd be more than happy to test once someone gives a thumbs up on if the file doesn't have a virus, malware etc
can't be too careful on the internet these days.....
Click to expand...
Click to collapse
Haha, I know what you mean. It happens...
You don't need a better name, you need a better description! What do you mean with "pull SMS" !? (Where does it go? Is it creating an external file? what????) What is it used for? Why use this instead of a SMS-backup app?
E:V:A said:
You don't need a better name, you need a better description! What do you mean with "pull SMS" !? (Where does it go? Is it creating an external file? what????) What is it used for? Why use this instead of a SMS-backup app?
Click to expand...
Click to collapse
Good Point. I'll go into detail on what it does.
1) DatApp.exe starts adb, and pulls mmssms.db from /data/data/com.android.providers.telephony/database/
2) The database full of messages is saved.
3)The program then uses SQLite3 to convert the database to a CSV in human readable format.
4) The decoded file is then saved under "decoded", with the computer name, as this started as a payload for USB flash drives.
5) The database is deleted.
I would be great if you could expand this tool to reload the SMS messages after wiping system/data or ROM update.
kevdog said:
I would be great if you could expand this tool to reload the SMS messages after wiping system/data or ROM update.
Click to expand...
Click to collapse
Hmm, not a bad idea. I'll try and implement this tomorrow.
Sent from my PC36100 using XDA App
"SMS Backup and Restore" anyone?
Please Please Re-up this tool!! Just what i was looking for! My buddy's HD2 with android just took a dive and the digitizer doesn't work, so i need to pull the messages via adb...
Or is there just a command i can run via adb to get em??
Many thanks!

AppcertDLLs do not work in GUI apps

Hi, I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or disallow the drag & drop process. I use easyhook (particularly [this] for hooking part. I created a gist for my code : [Gist]
In [this ]url it says: Doesn’t work reliably against GUI applications. Stick to console apps. No wonder it didn't work in microsoft edge, and chrome.
I also tried code parts in these urls:
[first]
[second]
Finally , I already [certificated ]my dll.
Is there any other way apart from appcertdlls? Thank you in advance.
Edit: I can't use appinitdlls, some users might have secure boot enabled.
Edit2: Seems like dlls in some tutorials is under system32 ([this], and [this]) , and I moved mine under system32 too, but it did
work.

Categories

Resources