How to execute arbitrary code... - Windows Mobile Development and Hacking General

Dear all,
I want to publish here one very very simple method how you can execute arbitrary code in your applications.
This method can be used to protect your software with runtime decryption\encryption mechanisms.
For example, your license checking function can be stored in the exe-file somehow encrypted and you'll be able to decrypt it in runtime end execute.
Using this method you can even encrypt all your application and decrypt only necessary functions just before you want to execute them.
Of course you should understand that any security mechanisms sooner or later will be cracked, but our goal is not to create non-breakable security, but to make cracking process more expensive then buying a license.
So, the idea is simple: we can prepare some buffer in the application and in the runtime copy there code we want to execute.
Here is source code:
Code:
/*
After compilation it is necessary to change flags of .mysec
from 60000020 (Code Execute Read) на E0000020 (Code Execute Read Write)
Just open exe-file, search for 0x20 0x00 0x00 0x60 after text ".mysec"
and change it to 0x20 0x00 0x00 0xE0
*/
#include <windows.h>
// turn off optimiztions
#pragma optimize("", off)
// define our code segment
#pragma code_seg(".mysec")
// let's allocate some place in our new segment
__declspec(allocate(".mysec")) BYTE pBUF[100];
// put functions to the new segment (not necessary!)
int func1(int i)
{
return i*2;
}
int func2(void) // just fake function. we'll need it to find size of func1
{
return 5;
}
// turn on optimizations
#pragma optimize("", on)
// switch back to .text segment
#pragma code_seg()
// define pointer to function
typedef int (*pfn_t)(int i);
int _tmain(int argc, TCHAR* argv[])
{
func2(); // not so necessary, but linker might remove unused functions... :-\
// here we're copying code of func1 into the buffer :)
// in fact, here should be some procedure decrypting necessary
// code into our buffer, but to simplify the example, I'll
// just copy one of existing functions int the buffer
// and then execute it
memcpy(pBUF, &func1, (int)&func2 - (int)&func1);
int a = ((pfn_t)(void*)pBUF)(4); // execute
// show result
wchar_t pBuf[20] = {0};
wsprintf(pBuf, L"a = %d", a);
::MessageBoxW(0, pBuf, L"tst1", MB_OK);
return 0;
}
I'll also attach the compiled application for those who think it won't work.
Thank you!
Best regards,
efrost

Related

Get Device Information

Does anybody know how to get Device Information on XDA(Wallaby, Himalaya and Blue Angel) from within C++?
I would like to get the RomVersions(ROM,Radio etc.) and Dates.
And also Modell Number, IMEI.
Nearly the same as you can see under Start->Settings>System: Device Information.
I read somethimg about a "disk on chip" document, but it is linked under wiki, and it seems to me that everything und wiki(sourceodes, documents etc.) is dead.
Ok, i have some of these things.
I get the Model-Nr, Platform String, IMEI, and the OS Version.
With this Information i can say what XDA Device i´m running on.
But i don´t know how to get the ROM Informations.
Does anybody know where to find them? On XDA3 i found Versiosn in Registry, but they are not avaible on XDA1, and not all avaible on XDA2.
Maybe i have to Get the FileVersions and Dates...
Device Information
Hi I'm new in PDA and I'm looking for c++ code to reed information about device serial number or IMEI (for MDA 2 or MDA 3). Could You help me.
Thanks for any information
Tom.
To retrieve the IMEI:
//Function GetIMEI
CString GetIMEI()
{
CString strTemp;
WCHAR szString[MAX_PATH] = L"\0";
LINEGENERALINFO *LPLineGeneralInfo = NULL;
LPLineGeneralInfo = (LINEGENERALINFO*)malloc(sizeof (LINEGENERALINFO));
LPLineGeneralInfo->dwTotalSize = sizeof(LINEGENERALINFO);
LONG lTapiReturn;
DWORD NewSize;
DWORD dwNumDevs;
DWORD dwAPIVersion = TAPI_API_HIGH_VERSION;
LINEINITIALIZEEXPARAMS liep;
HLINEAPP hLineApp = 0;
HLINE hLine = 0;
DWORD dwExtVersion;
BOOL bRetVal = FALSE;
LPBYTE pLineGeneralInfoBytes = NULL;
DWORD dwTAPILineDeviceID;
const DWORD dwMediaMode = LINEMEDIAMODE_DATAMODEM | LINEMEDIAMODE_INTERACTIVEVOICE;
// Initialisiern
liep.dwTotalSize = sizeof(liep);
liep.dwOptions = LINEINITIALIZEEXOPTION_USEEVENT;
lineInitializeEx(&hLineApp, 0, 0, L"MDAC", &dwNumDevs, &dwAPIVersion, &liep);
// Device ID holen
dwTAPILineDeviceID = GetTSPLineDeviceID(hLineApp, dwNumDevs, TAPI_API_LOW_VERSION, TAPI_API_HIGH_VERSION, CELLTSP_LINENAME_STRING);
// Line öffnen
lineOpen(hLineApp, dwTAPILineDeviceID, &hLine, dwAPIVersion, 0, 0, LINECALLPRIVILEGE_OWNER, dwMediaMode, 0);
// ExTAPI Version aushandeln
lineNegotiateExtVersion(hLineApp, dwTAPILineDeviceID, dwAPIVersion, EXT_API_LOW_VERSION, EXT_API_HIGH_VERSION, &dwExtVersion);
lTapiReturn = lineGetGeneralInfo(hLine, LPLineGeneralInfo);
//If the LineGeneralInfo buffer was too small then make it bigger and ask again
if ((lTapiReturn == 0) && (LPLineGeneralInfo->dwNeededSize > LPLineGeneralInfo->dwTotalSize))
{
NewSize = LPLineGeneralInfo->dwNeededSize;
LPLineGeneralInfo = (LINEGENERALINFO*)realloc(LPLineGeneralInfo, LPLineGeneralInfo->dwNeededSize);
LPLineGeneralInfo->dwTotalSize = NewSize;
lTapiReturn = lineGetGeneralInfo(hLine, LPLineGeneralInfo);
}
if (lTapiReturn != 0)
{
//wcscpy(szString, TEXT("Error, unable to read phone\n\rinformation with the phone\n\rswitched off.\n\n\rPlease Exit program and try again."));
}
else
{
//Copy Result over to this functions reply
// wcscpy(szString , TEXT("Manufacturer and Model:\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwManufacturerOffset));
// wcscat(szString, TEXT("\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwModelOffset ));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Revision :\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwRevisionOffset));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Serial Number :\n\r "));
wcscpy(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwSerialNumberOffset));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Subscriber Number :\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwSubscriberNumberOffset));
// wcscat(szString, TEXT("\n\r"));
}
strTemp = szString;
//Free up resources used
if (hLineApp != NULL)
lineShutdown(hLineApp);
if (LPLineGeneralInfo != NULL)
free(LPLineGeneralInfo);
if(strTemp.GetLength() == 17)
{
return strTemp.Left(15);
}
return strTemp;
}
//FUNCTION GetTSPLineDeviceID
DWORD GetTSPLineDeviceID(const HLINEAPP hLineApp, const DWORD dwNumberDevices, const DWORD dwAPIVersionLow, const DWORD dwAPIVersionHigh, const TCHAR *const psTSPLineName)
{
DWORD dwReturn = 0xffffffff;
for(DWORD dwCurrentDevID = 0 ; dwCurrentDevID < dwNumberDevices ; dwCurrentDevID++)
{
DWORD dwAPIVersion;
LINEEXTENSIONID LineExtensionID;
if(0 == lineNegotiateAPIVersion(hLineApp, dwCurrentDevID,
dwAPIVersionLow, dwAPIVersionHigh,
&dwAPIVersion, &LineExtensionID))
{
LINEDEVCAPS LineDevCaps;
LineDevCaps.dwTotalSize = sizeof(LineDevCaps);
if(0 == lineGetDevCaps(hLineApp, dwCurrentDevID,
dwAPIVersion, 0, &LineDevCaps))
{
BYTE* pLineDevCapsBytes = new BYTE[LineDevCaps.dwNeededSize];
if(0 != pLineDevCapsBytes)
{
LINEDEVCAPS* pLineDevCaps = (LINEDEVCAPS*)pLineDevCapsBytes;
pLineDevCaps->dwTotalSize = LineDevCaps.dwNeededSize;
if(0 == lineGetDevCaps(hLineApp, dwCurrentDevID,
dwAPIVersion, 0, pLineDevCaps))
{
if(0 == _tcscmp((TCHAR*)((BYTE*)pLineDevCaps+pLineDevCaps->dwLineNameOffset),
psTSPLineName))
{
dwReturn = dwCurrentDevID;
}
}
delete[] pLineDevCapsBytes;
}
}
}
}
return dwReturn;
}
Thanks for your code but I cand compile it error like:
error C2065: 'TAPI_API_HIGH_VERSION' : undeclared identifier
error C2065: 'TAPI_API_LOW_VERSION' : undeclared identifier
error C2065: 'CELLTSP_LINENAME_STRING' : undeclared identifier
error C2065: 'EXT_API_LOW_VERSION' : undeclared identifier
error C2065: 'EXT_API_HIGH_VERSION' : undeclared identifier
what should I include ?
#define TAPI_API_LOW_VERSION 0x00020000
#define TAPI_API_HIGH_VERSION 0x00020000
#define EXT_API_LOW_VERSION 0x00010000
#define EXT_API_HIGH_VERSION 0x00010000
OK but what with this one:
error C2065: 'CELLTSP_LINENAME_STRING' : undeclared identifier
thanks
#include <tapi.h>
#include <tsp.h>
#include "extapi.h"
#define TAPI_API_LOW_VERSION 0x00020000
#define TAPI_API_HIGH_VERSION 0x00020000
#define EXT_API_LOW_VERSION 0x00010000
#define EXT_API_HIGH_VERSION 0x00010000
Now is OK
.. but I have one question whay it dsn't work without SIM card ? Is it possible to get IMEI or device serial number if there aren't sim inside ?
Yes, it does work without simcard. It runs on my MDA 1/2/3 without SIMCard.
Maybe you phone decivce is completely turned off...
Yes you right phone device was turned off now is goood
Thanks
hmmm - are you writing this app in eVC++ 3.0 or eVC++ 4.0 ?? I dont seem to get it working in eVC++ 4.0. I'm getting an external link error for lineGetGeneralInfo().
Could you be kind enough to send me the full app ??? or help me solve this ?? i'm trying to write my program as a MFC pocket pc 2003 exe and dialog based!!
thanks
problem solved , thanks for the source code
has anybody used this as a utility to craete an output fie containing the IMEI number? I have'nt got Visual Studio for pocket PC but would like to be able to do this
Patrick said:
Yes, it does work without simcard. It runs on my MDA 1/2/3 without SIMCard.
Maybe you phone decivce is completely turned off...
Click to expand...
Click to collapse
My phone device is completelty turned off.
Do you have any idea how to find IMEI number when the device is in this state ?
It's possible because system info in control panel could display the IMEI in this state.
Hi everybody!
I know this is a bit off topic but if you want to get a serial number instead of IMEI you can use the following code:
Code:
#define IOCTL_HAL_GET_DEVICEID CTL_CODE(FILE_DEVICE_HAL, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
extern "C" BOOL KernelIoControl(
DWORD dwIoControlCode,
LPVOID lpInBuf,
DWORD nInBufSize,
LPVOID lpOutBuf,
DWORD nOutBufSize,
LPDWORD lpBytesReturned);
BYTE outBuff[16];
*(DWORD*)outBuff = 16;
KernelIoControl(IOCTL_HAL_GET_DEVICEID, 0, 0, outBuff, 16, &outBytes);
Should work on all devices regardless of what is turned on.
Thanks.
With the DEVICEID information, IMEI could be found with phone device turned off on QTEK 9090
Code:
void GetIMEIFromQtek9090(char *serial)
{
BYTE outBuff[16];
DWORD outBytes;
*(DWORD*)outBuff = 16;
KernelIoControl(IOCTL_HAL_GET_DEVICEID, 0, 0, outBuff, 16, &outBytes);
sprintf(serial,"35%02X%02X%02X%02X%02X%02X%02X", outBuff[6], outBuff[5], outBuff[4], outBuff[3], outBuff[2], outBuff[1], outBuff[0]);
}
Thanks again.
Any luck obtaining the device ROM version? It's the only item in your list that I seem to be stuck on...
Can someone send me a compiled version of the code to get the IMEI etc?

From Services.exe to Devices.exe

I have a background service DLL running on Windows Mobile 2003 in Services.exe.
I now wish to port it to run in Devices.exe. I have so far been unable to get it to run. Instead when I run the ActivateDevice or ActivateDeviceEx it returns with error 1,2 or 120.
What is required by my DLL to be compatable with Devices.exe?
I have added what I assume are the correct registry settings under HKLM\\Devices\\Name so i can only assume it is something wrong with the DLL itself.
If anyone can assist me with this problem it would be greatly appreciated.
Cheers Gerard
Do I need to use the Developer Platform to create the driver or is Embedded fine?
You can use eVC to create drivers.
To make your driver recognized by OS you should add registry keys:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\_name_]
"Prefix"="BLA" - 3 CAPS letters, it is your driver prefix
"Index"=dword:00000001
"Dll"="yourdriver.Dll"
And your driver should export functions:
BLA_Close
BLA_Deinit
BLA_IOControl
BLA_Init
BLA_Open
BLA_PowerDown
BLA_PowerUp
BLA_Read
BLA_Seek
BLA_Write
Later you can use CreateFile(L"BLA1:",...) to communicate with your driver. Read MSDN for more.
I have those entries in the registry and my DLL exports those functions.
However, I can not get the DLL to start through ActivateDeviceEx or ActivateDevice. If I reset the device the device freezes and requires a hard reset.
My DLL works fine in Services.exe but must need some changes to operate in Device.exe. The problem being that I can't find any examples where a Device Driver was written in C++ (all .c) and also can't find any examples of a Service being converted to a Device driver.
Any suggestions greatly appreciated
You don't need to call ActivateDexice[Ex] if you have manually added these keys to registry. The reason that your device hangs is in your DLL's entry point or in one of the exported functions. Probably BLA_Init or one of the power functions. You should add diagnostics code that outputs a trace log to SD-card or built-in storage so that you can read this file after hard reset. Or the reason may be that your driver is loaded before the one of the needed drivers, for example SD-card. In this case you should play with the "order" key.
I've wrote several drivers in C++. But none of them used C++ exceptions, I don't know how devices.exe would behave if exception is thrown. And you should remember not to allocate huge arrays/variables on stack.
I've found a small tutorial on MSDN - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnembedded/html/spotwincerambl.asp
Posted: Wed Mar 09, 2005 18:19
--------------------------------------------------------------------------------
So if I already have the registry entries in do I start the DLL with CreateFile or something similar? I assumed that the DLL was hanging on device startup due to attempting to include an unloaded module but this still occurs when setting Order to 99.
At the moment for testing purposes I am just getting all my exported functions to write to a log file... however none are ever entered. What is the DLL's entry point? Init? PowerUp? An additional method? Have you an example that I could possibly have a look at?
Thanks for your help.
Gerard
The first entry point is DllMain. Then init function is called. Then open when your device is opened. If you have global classes with constructors - constructors are called before DllMain (I have not tested that), one of them may be the reason of crash.
The sample is in the link I gave in the prev. post. or here is a sample driver that is a wrapper around Serial_BTUR.dll
Code:
// Serial.cpp : Defines the entry point for the DLL application.
//
#include "stdafx.h"
#include "Serial.h"
#include <psapi.h>
#include <Mmsystem.h>
struct HCI_
{
char *Text;
int Code;
} Cmds[]=
{
"HCI_NOP",0x0000,
"HCI_Inquiry",0x0401,
"HCI_Inquiry_Cancel",0x0402,
"HCI_Periodic_Inquiry_Mode",0x0403,
"HCI_Exit_Periodic_Inquiry_Mode",0x0404,
"HCI_Create_Connection",0x0405,
"HCI_Disconnect",0x0406,
"HCI_Add_SCO_Connection",0x0407,
"HCI_Accept_Connection_Request",0x0409,
"HCI_Reject_Connection_Request",0x040a,
"HCI_Link_Key_Request_Reply",0x040b,
"HCI_Link_Key_Request_Negative_Reply",0x040c,
"HCI_PIN_Code_Request_Reply",0x040d,
"HCI_PIN_Code_Request_Negative_Reply",0x040e,
"HCI_Change_Connection_Packet_Type",0x040f,
"HCI_Authentication_Requested",0x0411,
"HCI_Set_Connection_Encryption",0x0413,
"HCI_Change_Connection_Link_Key",0x0415,
"HCI_Master_Link_Key",0x0417,
"HCI_Remote_Name_Request",0x0419,
"HCI_Read_Remote_Supported_Features",0x041b,
"HCI_Read_Remote_Version_Information",0x041d,
"HCI_Read_Clock_Offset",0x041f,
"HCI_Hold_Mode",0x0801,
"HCI_Sniff_Mode",0x0803,
"HCI_Exit_Sniff_Mode",0x0804,
"HCI_Park_Mode",0x0805,
"HCI_Exit_Park_Mode",0x0806,
"HCI_QoS_Setup",0x0807,
"HCI_Role_Discovery",0x0809,
"HCI_Switch_Role",0x080b,
"HCI_Read_Link_Policy_Settings",0x080c,
"HCI_Write_Link_Policy_Settings",0x080d,
"HCI_Set_Event_Mask",0x0c01,
"HCI_Reset",0x0c03,
"HCI_Set_Event_Filter",0x0c05,
"HCI_Flush",0x0c08,
"HCI_Read_PIN_Type",0x0c09,
"HCI_Write_PIN_Type",0x0c0a,
"HCI_Create_New_Unit_Key",0x0c0b,
"HCI_Read_Stored_Link_Key",0x0c0d,
"HCI_Write_Stored_Link_Key",0x0c11,
"HCI_Delete_Stored_Link_Key",0x0c12,
"HCI_Change_Local_Name",0x0c13,
"HCI_Read_Local_Name",0x0c14,
"HCI_Read_Connection_Accept_Timeout",0x0c15,
"HCI_Write_Connection_Accept_Timeout",0x0c16,
"HCI_Read_Page_Timeout",0x0c17,
"HCI_Write_Page_Timeout",0x0c18,
"HCI_Read_Scan_Enable",0x0c19,
"HCI_Write_Scan_Enable",0x0c1a,
"HCI_Read_PageScan_Activity",0x0c1b,
"HCI_Write_PageScan_Activity",0x0c1c,
"HCI_Read_InquiryScan_Activity",0x0c1d,
"HCI_Write_InquiryScan_Activity",0x0c1e,
"HCI_Read_Authentication_Enable",0x0c1f,
"HCI_Write_Authentication_Enable",0x0c20,
"HCI_Read_Encryption_Mode",0x0c21,
"HCI_Write_Encryption_Mode",0x0c22,
"HCI_Read_Class_Of_Device",0x0c23,
"HCI_Write_Class_Of_Device",0x0c24,
"HCI_Read_Voice_Setting",0x0c25,
"HCI_Write_Voice_Setting",0x0c26,
"HCI_Read_Automatic_Flush_Timeout",0x0c27,
"HCI_Write_Automatic_Flush_Timeout",0x0c28,
"HCI_Read_Num_Broadcast_Retransmissions",0x0c29,
"HCI_Write_Num_Broadcast_Retransmissions",0x0c2a,
"HCI_Read_Hold_Mode_Activity",0x0c2b,
"HCI_Write_Hold_Mode_Activity",0x0c2c,
"HCI_Read_Transmit_Power_Level",0x0c2d,
"HCI_Read_SCO_Flow_Control_Enable",0x0c2e,
"HCI_Write_SCO_Flow_Control_Enable",0x0c2f,
"HCI_Set_Host_Controller_To_Host_Flow_Control",0x0c31,
"HCI_Host_Buffer_Size",0x0c33,
"HCI_Host_Number_Of_Completed_Packets",0x0c35,
"HCI_Read_Link_Supervision_Timeout",0x0c36,
"HCI_Write_Link_Supervision_Timeout",0x0c37,
"HCI_Read_Number_Of_Supported_IAC",0x0c38,
"HCI_Read_Current_IAC_LAP",0x0c39,
"HCI_Write_Current_IAC_LAP",0x0c3a,
"HCI_Read_Page_Scan_Period_Mode",0x0c3b,
"HCI_Write_Page_Scan_Period_Mode",0x0c3c,
"HCI_Read_Page_Scan_Mode",0x0c3d,
"HCI_Write_Page_Scan_Mode",0x0c3e,
"HCI_Read_Local_Version_Information",0x1001,
"HCI_Read_Local_Supported_Features",0x1003,
"HCI_Read_Buffer_Size",0x1005,
"HCI_Read_Country_Code",0x1007,
"HCI_Read_BD_ADDR",0x1009,
"HCI_Read_Failed_Contact_Counter",0x1401,
"HCI_Reset_Failed_Contact_Counter",0x1402,
"HCI_Get_Link_Quality",0x1403,
"HCI_Read_RSSI",0x1405,
"HCI_Read_Loopback_Mode",0x1801,
"HCI_Write_Loopback_Mode",0x1802,
"HCI_Enable_Device_Under_Test_Mode",0x1803,
0,0
},Events[]=
{
"HCI_Inquiry_Complete_Event",0x01,
"HCI_Inquiry_Result_Event",0x02,
"HCI_Connection_Complete_Event",0x03,
"HCI_Connection_Request_Event",0x04,
"HCI_Disconnection_Complete_Event",0x05,
"HCI_Authentication_Complete_Event",0x06,
"HCI_Remote_Name_Request_Complete_Event",0x07,
"HCI_Encryption_Change_Event",0x08,
"HCI_Change_Connection_Link_Key_Complete_Event",0x09,
"HCI_Master_Link_Key_Complete_Event",0x0a,
"HCI_Read_Remote_Supported_Features_Complete_Event",0x0b,
"HCI_Read_Remote_Version_Information_Complete_Event",0x0c,
"HCI_QoS_Setup_Complete_Event",0x0d,
"HCI_Command_Complete_Event",0x0e,
"HCI_Command_Status_Event",0x0f,
"HCI_Hardware_Error_Event",0x10,
"HCI_Flush_Occured_Event",0x11,
"HCI_Role_Change_Event",0x12,
"HCI_Number_Of_Completed_Packets_Event",0x13,
"HCI_Mode_Change_Event",0x14,
"HCI_Return_Link_Keys_Event",0x15,
"HCI_PIN_Code_Request_Event",0x16,
"HCI_Link_Key_Request_Event",0x17,
"HCI_Link_Key_Notification_Event",0x18,
"HCI_Loopback_Command_Event",0x19,
"HCI_Data_Buffer_Overflow_Event",0x1a,
"HCI_Max_Slots_Change_Event",0x1b,
"HCI_Read_Clock_Offset_Complete_Event",0x1c,
"HCI_Connection_Packet_Type_Changed_Event",0x1d,
"HCI_QoS_Violation_Event",0x1e,
"HCI_Page_Scan_Mode_Change_Event",0x1f,
"HCI_Page_Scan_Repetition_Mode_Change_Event",0x20,
0,0
};
char *FindEvent(int id)
{
for(int i=0; Events[i].Text;i++)
{
if(Events[i].Code==id)
return Events[i].Text;
}
return "HCI_???";
}
char *FindMessage(int id)
{
for(int i=0; Cmds[i].Text;i++)
{
if(Cmds[i].Code==id)
return Cmds[i].Text;
}
return "HCI_???";
}
typedef BOOL t_COM_Deinit(DWORD dwOpenData);
typedef BOOL t_COM_IOControl(
DWORD dwOpenData,
DWORD dwCode,
PBYTE pBufIn,
DWORD dwLenIn,
PBYTE pBufOut,
DWORD dwLenOut,
PDWORD pdwActualOut
);
typedef HANDLE t_COM_Init(
ULONG Identifier
);
typedef HANDLE t_COM_Open(
HANDLE pContext,
DWORD AccessCode,
DWORD ShareMode
);
typedef BOOL t_COM_PowerDown(
HANDLE pContext
);
typedef BOOL t_COM_PowerUp(
HANDLE pContext
);
typedef ULONG t_COM_Read(
HANDLE pContext,
PUCHAR pTargetBuffer,
ULONG BufferLength
);
typedef ULONG t_COM_Write(
HANDLE COM_Write,
PUCHAR pSourceBytes,
ULONG NumberOfBytes
);
typedef BOOL t_COM_Close(
DWORD pContext
);
t_COM_Deinit *_COM_Deinit=0;
t_COM_IOControl *_COM_IOControl=0;
t_COM_Init *_COM_Init=0;
t_COM_Open *_COM_Open=0;
t_COM_PowerDown *_COM_PowerDown=0;
t_COM_PowerUp *_COM_PowerUp=0;
t_COM_Read *_COM_Read=0;
t_COM_Write *_COM_Write=0;
t_COM_Close *_COM_Close=0;
HANDLE hEvent=0;
char* Dump(const unsigned char *Buff, int count)
{
static char Out[65536];
char* p=Out;
if(count==0)
{
p+=sprintf(p,"\n");
return Out;
}
{
bool OnlyASCII=true;
for(int i=0; i<count; i++)
if((Buff[i]&255)<32||Buff[i]==127)
{
if((i==count-1 && Buff[i]==0)||Buff[i]==0x0d||Buff[i]==0x0a||Buff[i]==9)
continue;
OnlyASCII=false;
break;
}
if(OnlyASCII)
{
p+=sprintf(p,"--- Plain text\n");
for(int i=0; i<count; i++)
if(Buff[i]!='\r')
p+=sprintf(p,"%c",Buff[i]);
// if(Buff[count-1]!='\n')
// fprintf(Log,"\n");
p+=sprintf(p,"\n--- End of text\n\n");
return Out;
}
int Pos=0;
char OBuff[3*16+2+1];
char Str[17];
for(i=0; i<(count+15)/16; i++)
{
for(int j=0; j<16; j++,Pos++)
{
if(Pos<count)
{
sprintf(OBuff+3*j+(j>7),"%02X ",Buff[Pos]&255);
if((Buff[Pos]&255)<32||Buff[Pos]==127)
Str[j]='.';
else
Str[j]=Buff[Pos];
} else
{
sprintf(OBuff+3*j+(j>7)," ");
Str[j]=' ';
}
}
Str[16]=0;
OBuff[3*16+1]=0;
p+=sprintf(p,"%08X: %s \"%s\"\n",i*16,OBuff,Str);
}
}
p+=sprintf(p,"\n");
return Out;
}
bool IsLogging(void)
{
return true;
// return WaitForSingleObject(hEvent,0)==WAIT_OBJECT_0;
}
void LogData(PUCHAR Data, int NBytes)
{
if(!IsLogging())
return;
HANDLE h=CreateFile(L"\\logging.txt",GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,
0,OPEN_ALWAYS,0,0);
if(h==INVALID_HANDLE_VALUE)
return;
SetFilePointer(h,0,0,FILE_END);
DWORD W;
WriteFile(h,Data,NBytes,&W,0);
CloseHandle(h);
}
void LogStr(char*Str)
{
LogData((PUCHAR)Str, strlen(Str));
LogData((PUCHAR)"\n",1);
}
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
#undef SERIAL_API
#define SERIAL_API extern "C" __declspec(dllexport)
SERIAL_API BOOL COM_Close(
DWORD pContext
)
{
LogStr("COM_Close");
return _COM_Close(pContext);
}
SERIAL_API BOOL COM_Deinit(DWORD pContext)
{
LogStr("COM_Deinit");
return _COM_Deinit(pContext);
}
SERIAL_API BOOL COM_IOControl(
DWORD dwOpenData,
DWORD dwCode,
PBYTE pBufIn,
DWORD dwLenIn,
PBYTE pBufOut,
DWORD dwLenOut,
PDWORD pdwActualOut
)
{
char Buff[1024];
sprintf(Buff,"COM_IOControl: %04X ",dwCode);
LogStr(Buff);
LogStr(Dump(pBufIn,dwLenIn));
return _COM_IOControl(
dwOpenData,
dwCode,
pBufIn,
dwLenIn,
pBufOut,
dwLenOut,
pdwActualOut);
}
SERIAL_API HANDLE COM_Init(
wchar_t* Identifier
)
{
LogStr("COM_Init");
if(hEvent==0)
{
hEvent=CreateEvent(0,TRUE,FALSE,L"seRILal logging event");
HINSTANCE H=LoadLibrary(L"Serial_BTUR.dll");
if(H==0)
{
LogStr("Error loading DLL");
return 0;
}
_COM_Deinit=(t_COM_Deinit*)GetProcAddress(H,L"COM_Deinit");
if(_COM_Deinit==0)
LogStr("COM_Deinit==0");
_COM_IOControl=(t_COM_IOControl*)GetProcAddress(H,L"COM_IOControl");
if(_COM_IOControl==0)
LogStr("COM_IOControl==0");
_COM_Init=(t_COM_Init*)GetProcAddress(H,L"COM_Init");
if(_COM_Init==0)
LogStr("COM_Init==0");
_COM_Open=(t_COM_Open*)GetProcAddress(H,L"COM_Open");
if(_COM_Open==0)
LogStr("COM_Open==0");
_COM_PowerDown=(t_COM_PowerDown*)GetProcAddress(H,L"COM_PowerDown");
if(_COM_PowerDown==0)
LogStr("COM_PowerDown==0");
_COM_PowerUp=(t_COM_PowerUp*)GetProcAddress(H,L"COM_PowerUp");
if(_COM_PowerUp==0)
LogStr("COM_PowerUp==0");
_COM_Read=(t_COM_Read*)GetProcAddress(H,L"COM_Read");
if(_COM_Read==0)
LogStr("COM_Read==0");
_COM_Write=(t_COM_Write*)GetProcAddress(H,L"COM_Write");
if(_COM_Write==0)
LogStr("COM_Write==0");
_COM_Close=(t_COM_Close*)GetProcAddress(H,L"COM_Close");
if(_COM_Close==0)
LogStr("COM_Close==0");
LogStr("DLL loaded");
}
HANDLE H=_COM_Init((DWORD)Identifier);
return H;
}
SERIAL_API HANDLE COM_Open(
HANDLE pContext,
DWORD AccessCode,
DWORD ShareMode
)
{
LogStr("COM_Open");
return _COM_Open(
pContext,
AccessCode,
ShareMode);
}
SERIAL_API BOOL COM_PowerDown(
HANDLE pContext
)
{
LogStr("COM_PowerDown");
return _COM_PowerDown(pContext);
}
SERIAL_API BOOL COM_PowerUp(
HANDLE pContext
)
{
LogStr("COM_PowerUp");
return _COM_PowerUp(pContext);
}
int SCO_Handle=0;
SERIAL_API ULONG COM_Read(
HANDLE pContext,
PUCHAR pTargetBuffer,
ULONG BufferLength
)
{
int L=_COM_Read(
pContext,
pTargetBuffer,
BufferLength);
if(L)
{
LogStr("COM_Read");
if(L>2&&pTargetBuffer[0]==4)
{
char Buff[1024];
int m=pTargetBuffer[1];
sprintf(Buff,"%s - %02X",FindEvent(m),m);
LogStr(Buff);
if(pTargetBuffer[1]==3 && pTargetBuffer[3]==0 && pTargetBuffer[12]==0)
{
LogStr("SCO connection");
SCO_Handle=pTargetBuffer[4]+pTargetBuffer[5]*256;
}
}
LogStr(Dump(pTargetBuffer,L));
}
return L;
}
SERIAL_API ULONG COM_Write(
HANDLE pContext,
PUCHAR pSourceBytes,
int NumberOfBytes
)
{
LogStr("COM_Write");
if(SCO_Handle)
{
LogStr("sending SCO packet");
char Buffer[256];
Buffer[0]=SCO_Handle&255;
Buffer[1]=SCO_Handle/255;
Buffer[2]=240;
for(int i=0; i<240; i++)
Buffer[3+i]=(i&2)?127:0;
_COM_Write(
pContext,
(unsigned char*)"\x03",
1);
_COM_Write(
pContext,
(unsigned char*)Buffer,
240+3);
SCO_Handle=0;
}
if(NumberOfBytes>2)
{
char Buff[1024];
int m=pSourceBytes[1]*256+pSourceBytes[0];
sprintf(Buff,"%s - %04X",FindMessage(m),m);
LogStr(Buff);
}
LogStr(Dump(pSourceBytes,NumberOfBytes));
return _COM_Write(
pContext,
pSourceBytes,
NumberOfBytes);
}
SERIAL_API ULONG COM_Seek()
{
return -1;
}
Thanks for your help. The reason I am porting my Dll from Services.exe to Device.exe is because I need it to run continuosly and when running in Services.exe when the device suspends of course no CPU time. That is, I was hoping to implement the Dll as a driver and catch the PowerDown message and prevent it from happening.
I noticed that in the MSDN example the PowerDown method is void but in yours it returns Bool. To prevent the power down do I convert the method to return a false bool value? Can this functionality be done?
Regards Gerard
GerardRaciti said:
I noticed that in the MSDN example the PowerDown method is void but in yours it returns Bool.
Click to expand...
Click to collapse
Don't always trust MSDN regarding Windows CE. I've taken these prototypes from some of MS own drivers.
You can prevent device from sleeping from your program using this method:
http://msdn.microsoft.com/library/d.../html/ppc_programming_pocket_pc_2002_lfyy.asp
That was the method I used originally to tackle this problem but it consumed too much power leaving the screen in that dimmed state.
I had the understanding that if I implemented my Dll in a device driver the screen could go blank but the device would only go into "sleep" mode where drivers would still receive CPU time as long as they responded to the PowerDown function.
Do you know if this is possible or am I wasting my time?
I don't know. I never worked with power levels. But probably this is possible in driver with functions SetPowerRequirement and DevicePowerNotify. But this would work only if device supports D1 (low on) power mode. Otherwise I think you would not notice any difference with keeping the device always on and shutting down LCD+backlight.
Thanks again for your help.
I have managed to port my service into a device driver but am having trouble handling Power Management issues. It seems as though it is in my Dll attempting to prevent a device suspension which is crashing the device. If I dont attempt to prevent suspend mode or set power requirements the Dll is quite stable. If anyone has any experience with Device driver power management or can point me in the right direction it would be much appreciated.
Regards Gerard
you may try to ask in microsoft newsgroups like microsoft.public.windowsce.app.development or microsoft.public.windowsce.platbuilder or similar

eVc++ DLL used on .NET? Error

Hello,
I have written a DLL on eVC++. And now I want to use this DLL in a .NET program. But by "Add Reference" I got an error, that says:
This is not a .NET assembly.
So my question is, is it possible to using a eVC++ DLL on .NET?
If yes, what should I do, and if not, is there another way to do with this problem?
Thanks all
from http://www.csharphelp.com/archives/archive52.html
Code:
Call Unmanaged Code. Part 1 - Simple DLLImport
By Vyacheslav Biktagirov
Managed world is beautiful, I have all classes I want in FrameWork.. But what if I want call some unmanaged code? For instance, I have DLL written in C++, and want use it from C#.
Let's look some code. Our DLL exports some function, in CDecl convention, that sums two integers:
extern "C" __declspec(dllexport) __cdecl int sum(int a,int b);
And, of course, we want reuse this code in C#. We must recall, that it is no "direct" way to call unmanaged code, but we must inform the compiler, what we want to call, how, and where is needed code located.
[DllImport("TestDll.dll", EntryPoint="sum",
ExactSpelling=false,CallingConvention=CallingConvention.Cdecl)]
static extern int sum(int a,int b);
and now we can call it like normal C# function.
x=5;
y=7;
z=sum(x,y); // x will receive 12
Here is full C# client code - tested for Beta2.
using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using System.Runtime.InteropServices;
namespace WindowsApplication6
{
///
/// Summary description for Form1.
///
public class Form1 : System.Windows.Forms.Form
{
private System.Windows.Forms.Button button1;
private System.Windows.Forms.TextBox textBox1;
private System.Windows.Forms.Label label1;
private System.Windows.Forms.TextBox textBox2;
private System.Windows.Forms.Label label2;
private System.Windows.Forms.TextBox textBox3;
///
/// Required designer variable.
///
private System.ComponentModel.Container components = null;
public Form1()
{
//
// Required for Windows Form Designer support
//
InitializeComponent();
//
// TODO: Add any constructor code after InitializeComponent call
//
}
///
/// Clean up any resources being used.
///
protected override void Dispose( bool disposing )
{
if( disposing )
{
if (components != null)
{
components.Dispose();
}
}
base.Dispose( disposing );
}
#region Windows Form Designer generated code
///
/// Required method for Designer support - do not modify
/// the contents of this method with the code editor.
///
private void InitializeComponent()
{
this.button1 = new System.Windows.Forms.Button();
this.textBox1 = new System.Windows.Forms.TextBox();
this.label1 = new System.Windows.Forms.Label();
this.textBox2 = new System.Windows.Forms.TextBox();
this.label2 = new System.Windows.Forms.Label();
this.textBox3 = new System.Windows.Forms.TextBox();
this.SuspendLayout();
//
// button1
//
this.button1.Location = new System.Drawing.Point(64, 192);
this.button1.Name = "button1";
this.button1.Size = new System.Drawing.Size(144, 64);
this.button1.TabIndex = 0;
this.button1.Text = "call sum";
this.button1.Click += new System.EventHandler(this.button1_Click);
//
// textBox1
//
this.textBox1.Location = new System.Drawing.Point(40, 120);
this.textBox1.Name = "textBox1";
this.textBox1.Size = new System.Drawing.Size(72, 22);
this.textBox1.TabIndex = 1;
this.textBox1.Text = "2";
//
// label1
//
this.label1.Location = new System.Drawing.Point(128, 128);
this.label1.Name = "label1";
this.label1.Size = new System.Drawing.Size(16, 16);
this.label1.TabIndex = 2;
this.label1.Text = "+";
//
// textBox2
//
this.textBox2.Location = new System.Drawing.Point(152, 120);
this.textBox2.Name = "textBox2";
this.textBox2.Size = new System.Drawing.Size(56, 22);
this.textBox2.TabIndex = 3;
this.textBox2.Text = "3";
//
// label2
//
this.label2.Location = new System.Drawing.Point(224, 120);
this.label2.Name = "label2";
this.label2.Size = new System.Drawing.Size(24, 23);
this.label2.TabIndex = 4;
this.label2.Text = "=";
//
// textBox3
//
this.textBox3.Location = new System.Drawing.Point(248, 120);
this.textBox3.Name = "textBox3";
this.textBox3.Size = new System.Drawing.Size(112, 22);
this.textBox3.TabIndex = 5;
this.textBox3.Text = "5";
//
// Form1
//
this.AutoScaleBaseSize = new System.Drawing.Size(6, 15);
this.ClientSize = new System.Drawing.Size(576, 322);
this.Controls.AddRange(new System.Windows.Forms.Control[] {this.textBox3,this.label2,this.textBox2,this.label1,this.textBox1,this.button1});
this.Name = "Form1";
this.Text = "Form1";
this.ResumeLayout(false);
}
#endregion
///
/// The main entry point for the application.
///
[STAThread]
static void Main()
{
Application.Run(new Form1());
}
#region My Code
#region Dll Imports
[DllImport("TestDll.dll", EntryPoint="sum",
ExactSpelling=false,CallingConvention=CallingConvention.Cdecl)]
static extern int sum(int a,int b);
#endregion
#region Button Click Events
private void button1_Click(object sender, System.EventArgs e)
{
textBox3.Text=(int.Parse(textBox1.Text)+int.Parse(textBox2.Text)).ToString();
}
#endregion
#endregion
}
}
It sounds very simple, becouse "int" is isomorphic type, says, int in C# and ind C++ is identical. What we can do, when we want operate non-isomorhic types, like String? Recall, that .NET string is some Class, while C++ string is char*,or wchar_t*,or BSTR, .. String may be embedded in a structure, or pointed by pointer, or even something more exotic. Let's call some string function.
[DllImport("Advapi32.dll", EntryPoint="GetUserName", ExactSpelling=false,
SetLastError=true)]
static extern bool GetUserName(
[MarshalAs(UnmanagedType.LPArray)] byte[] lpBuffer,
[MarshalAs(UnmanagedType.LPArray)] Int32[] nSize );
This function receives two parameters: char* and int*. Becouse we must allocate char* buffer and receive string by pointer, we can't use UnmanagedType.LPStr attribute, so we pass ANSI string as byte array. int* is more simple-it's 1-element Int32 array. Let's call it:
private void button2_Click(object sender, System.EventArgs e)
{
byte[] str=new byte[20];
Int32[] len=new Int32[1];
len[0]=20;
GetUserName(str,len);
MessageBox.Show(System.Text.Encoding.ASCII.GetString(str));
}
We allocate 20 bytes for receiving ANSI string,one element in Int32 array, set 20 as max string length and call it. For receiving string from byte array I used Text.Encoding.ASCII class.

RAPI problem writing registry key value

I am presently writing a RegEdit program to run on my PC and allow editing of the registry on the connected PPC. I have got to the point where I can read the entire registry and I am now implementing function to update the registry i.e. insert new key, delete key, add new Key Values etc...
The problem I have at the moment is trying to add a new value to an existing key. The function I have written so far to do this is as follows, but the call to CeRegSetValueEx(...) returns an error code 5!
Code:
//-----------------------------------------------------------------------------------
// Adds a new key value into the registry.
// // TO DO - add the data
int CRegEditDoc::AddNewKeyValue(HTREEITEM hParent, HKEY hRoot, LPTSTR lpszKey, LPTSTR lpszValueName, DWORD dwType)
{
USES_CONVERSION;
int nItem, rc;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValueName = T2W(lpszValueName);
try
{
if (lstrlen (lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
CString strValue = "my data";
LPWSTR lpwszData = T2W(strValue);
DWORD length = dim(lpwszData);
nItem = m_pRightView->GetListCtrl().GetItemCount();
if (m_rapi.CeRegSetValueEx(hKey, lpwszValueName, 0, dwType, (LPBYTE)lpwszData, length*2) != ERROR_SUCCESS) // last 2 lpData, szie in bytes of data.
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
return 0;
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::AddNewKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
I would appreciate a little advise on the matter, as this is the first time I have used the RAPI.
Thanks.
Hi VZ800!
The error you're getting is 'access denied'. In WM5 many RAPI functions (including writing to registry) are blocked for security reasons. Your only choice is to use a dll with CeRapiInvoke functions, but it needs to be deployed through a special cab.
You can read about this on msdn.
By the way, the app you're writing already exists, and it has the same problem.
Good luck!
Thanks for the advice. Since my post I have found that my code works for the HKEY_LOCAL_MACHINE, "/Software".
I will investigate the issue you have pointed me to.
Actually, your code should work for the entire HKEY_CLASSES_ROOT as well. MS decided to block only certain 'sensitive' parts of the registry so they can not be corrupted from the outside by malicious software.
If you noticed, MS's own remote registry editor works through DLLs (a ton of them).
Any way, I skimped on words in my first post, since I was writing it on a bus, and while I love my Jamin, writing long text on it is not very enjoyable.
Let me elaborate on CeRapiInvoke:
It's a function you call on the PC side that receives a DLL name and a function name (in that DLL) as parameters and calls that function on the device. It also lets you transfer buffers of data to and from the called function.
It's a great way to communicate with a PPC device without using sockets. You can write the device side DLL to do what ever you wont (like access protected registry) and report back to the PC.
The only drawback is in WM5 this DLL has to be registered and have a 'system' file attribute set. That's why you have to deploy it by cab.
Like I said before it's all in the MSDN.
Hope this helps.
Thanks. I have read the articles (and printed them) about RAPI Restricted Mode Security etc... http://msdn.microsoft.com/library/d...5/html/wce51conRAPIRestrictedModeSecurity.asp and will write a DLL to go on the PPC which will be installed via CAB etc...
I updated the function to add a new value anyway. Rather than calling the RAPI functions for the registry CeRapi... I will call my own functions in my authorised DLL.
Code:
//-----------------------------------------------------------------------------------
// Adds a new key value into the registry.
//
int CRegEditDoc::AddNewKeyValue(HTREEITEM hParent, HKEY hRoot, LPTSTR lpszKey,
LPTSTR lpszValName, DWORD dwDType, LPBYTE lpData)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValName = T2W(lpszValName);
DWORD dwDSize = sizeof(lpData);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
// Check if valuename already exists. Should never happen, but just in case.
if (m_rapi.CeRegQueryValueEx(hKey, lpwszValName, 0, &dwDType, NULL, &dwDSize) == ERROR_SUCCESS)
{
AfxMessageBox(_T("Value of this name already exists!"));
return 0;
}
if (m_rapi.CeRegSetValueEx(hKey, lpwszValName, 0, dwDType, lpData, dwDSize) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to create new value for this key!\nPlease check access rights."));
return 0;
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::AddNewKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
A question on using the CeRapiInvoke function. Obviously my function that I will be invoking in my DLL will need to conform to the following footprint:
Code:
LPCWSTR, LPCWSTR, DWORD, BYTE*, DWORD*, BYTE**, IRAPIStream**, DWORD
What I would like to know is this: If I want my function to be a wrapper to say the
Code:
CeRegQueryValueEx(HKEY, LPWSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD)
function, how do I parse the function args? Please suggest how I would pack them into a BYTE* for the pInput parameter.
Actually, you got it a bit wrong:
Code:
FuncName(DWORD cbInput, BYTE *pInput, DWORD *pcbOutput, BYTE **ppOutput, IRAPIStream *ppIRAPIStream);
The prototype you specified is for the PC side (the first two strings are DLL name and function name);
I use the following parsing method:
Code:
BYTE* curInputPos = pInput;
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
memcpy((BYTE*)&dwIndex, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
memcpy((BYTE*)&Reserved, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
It works fine both ways.
Just don't forget to use LocalAlloc for inBuffer and LocalFree for outBuffer.
Thanks. I'll let you know how I get on.
So if I were to parse an HKEY and an LPTSTR accross I would do the following to put the data into a BYTE array:
Code:
DWORD dwIn, dwOut;
LPBYTE pInput;
PDWORD pOut;
dwIn = sizeof(HKEY) + (strlen(lpszKey)*sizeof(TCHAR));
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
memcpy(pInput, (BYTE*)&hKey, sizeof(HKEY));
pInput += sizeof(HKEY);
memcpy(pInput, (BYTE*)&lpszKey, strlen(lpszKey)*sizeof(TCHAR));
// move pointer back to begining.
pInput -= sizeof(HKEY);
Basically, yes but with two reservations:
1) I recommend using a different pointer for the current position in buffer, to avoid errors.
2) you need to put the string length in the byte array before the string, otherwise you won't know it's length on the device side. Alternatively, you have to add 1 to the length so the 0 byte at the end gets packed and you can use strlen on the device.
Also keep in mined that unless you define the PC side project to work with UNICODE libraries, THCHAR will be defined as char, while on the device it's always WCHAR.
I really apreciate your help. I still can't get my DLL function to work I keep getting error 1064!
This is my code for the DLL named REditSvr.dll:
Code:
#include <windows.h>
#ifdef __cplusplus
extern "C"
{
#endif
__declspec (dllexport) INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved);
#ifdef __cplusplus
}
#endif
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
return TRUE;
}
INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved)
{
INT rc = 0;
BYTE* curInputPos = pInput;
HKEY hKey;
DWORD dwLength;
// Copy args out of input buffer.
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
memcpy((BYTE*)&dwLength, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
// Allocate enough memory for local wchar.
LPWSTR lpszValueName = (WCHAR*)malloc(dwLength);
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(dwLength));
curInputPos += sizeof(dwLength);
// Do the registry delete.
rc = RegDeleteValue(hKey, lpszValueName);
// Allocate memory for the return buffer.
BYTE* pOutput = (BYTE*)LocalAlloc(LPTR, sizeof(long));
memcpy(pOutput, (BYTE*)rc, sizeof(long));
*ppOutput = pOutput;
*pcbOutput = sizeof(long);
// Free input buffer.
LocalFree(pInput);
// Free WCHAR
free(lpszValueName);
return GetLastError();
}
and this is the code in my PC application which invokes the above function (or I would hope it did):
Code:
//-----------------------------------------------------------------------------------
// Deletes the key value from the registry.
//
int CRegEditDoc::DeleteKeyValue(HKEY hRoot, LPCTSTR lpszKey, LPCTSTR lpszValName)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValName = T2W(lpszValName);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
/* if (m_rapi.CeRegDeleteValue(hKey, lpwszValName) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to delete value for this key!\nPlease check access rights."));
return 0;
}
*/
// Testing remote registry value deletion.
DWORD dwIn, dwOut;
LPBYTE pInput, pCurInputPos;
PDWORD pOut;
DWORD dwLength = wcslen(lpwszValName)*sizeof(WCHAR);
dwIn = sizeof(HKEY) + dwLength;
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
pCurInputPos = pInput;
memcpy(pCurInputPos, (BYTE*)&hKey, sizeof(HKEY));
pCurInputPos += sizeof(HKEY);
// Store the length of the string
memcpy(pCurInputPos, (BYTE*)&dwLength, sizeof(DWORD));
pCurInputPos += sizeof(DWORD);
memcpy(pCurInputPos, (BYTE*)&lpwszValName, dwLength);
HRESULT hr = m_rapi.CeRapiInvoke(L"REditSvr", L"RegEditDeleteValue", dwIn,
pInput, &dwOut, (PBYTE*)&pOut, NULL, 0);
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
LocalFree(pOut);
if (hKey != hRoot)
{
m_rapi.CeRegCloseKey(hKey);
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::DeleteKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
The DLL has been deployed to the PPC \Windows folder by eVC4. My PPC runs WM5 (is this the problem, although I have written programs with eVC4 ok for it).
I would again appreciate your help/advice on why this isn't working. At present I have unlocked my PPC and I am able to edit any part of the registry etc...
Hi VZ800!
I noticed a couple of errors in your code (which you may have corrected yourself by now) but the biggest problem, I think is that you don't register the dll.
Here is the part you missed from MSDN:
(full link: http://msdn.microsoft.com/library/d...en-us/mobilesdk5/html/mob5lrfcerapiinvoke.asp)
To satisfy the requirements of the Remote Access Security Policy
1. Create a provisioning XML document that adds the new node "RAPI" to the metabase. This node must include the absolute path to the *.DLL file. For more information, see Metabase Settings. The following code example shows the contents of a typical provisioning XML file.
<wap-provisioningdoc>
<characteristic type="Metabase">
<characteristic type="RAPI\Program Files\Green Sky\recaller.dll\*">
<parm name="rw-access" value="3"/>
<parm name="access-role" value="152"/>
</characteristic>
</characteristic>
</wap-provisioningdoc>
2. Pass the file name of the provisioning XML document to the CAB wizard using the /postxml command line option. The CAB wizard will append the XML to the _setup.xml file it places in the CAB. For more information on creating CAB files, see CAB Wizard.
3. Set the System attribute on the *.DLL file.
Only the Manager security role provides the required permissions for modifying the metabase. The ideal way to get this security role is to have your application signed with a privileged certificate.
Note Since Pocket PC implements a one-tier security model, the CAB install process will automatically have the Manager security role.
Click to expand...
Click to collapse
Here's my advice:
Create a simple function that doesn't receive parameters, but pops up a message on the device. When you see that calling it works, try adding the rest of the code.
Hi
As I understand the DLL does not require code to self- register. Anyway, I can call the DLL function and did as you suggested and put a MessageBox in the function. This displayed fine. My code for the DLL is as follows now:
Code:
#include <windows.h>
#ifdef __cplusplus
extern "C"
{
#endif
__declspec (dllexport) INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved);
#ifdef __cplusplus
}
#endif
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
return TRUE;
}
INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved)
{
DWORD rc = 0;
BYTE* curInputPos = pInput;
LPCWSTR lpszValueName;
HKEY hKey;
int len;
// Copy args out of input buffer.
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
// Size of value name string.
memcpy((BYTE*)&len, curInputPos, sizeof(int));
curInputPos += sizeof(int);
// Value name string.
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(len));
curInputPos += sizeof(len);
// Do the registry delete.
rc = RegDeleteValue(hKey, lpszValueName);
// Allocate memory for the return buffer.
*ppOutput = (BYTE*)LocalAlloc(LPTR, rc);
memcpy(*ppOutput, (BYTE*)&rc, sizeof(DWORD));
*pcbOutput = sizeof(DWORD);
// Free input buffer.
if (pInput)
LocalFree(pInput);
return GetLastError();
}
and this is the code from which I am calling it:
Code:
//-----------------------------------------------------------------------------------
// Deletes the key value from the registry.
//
int CRegEditDoc::DeleteKeyValue(HKEY hRoot, LPCTSTR lpszKey, LPCTSTR lpszValName)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPCWSTR lpwszValName = T2W(lpszValName);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
/* if (m_rapi.CeRegDeleteValue(hKey, lpwszValName) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to delete value for this key!\nPlease check access rights."));
return 0;
}
*/
// Testing remote registry value deletion.
DWORD dwIn, dwOut;
LPBYTE pInput, pCurInputPos;
PDWORD pOut, rc;
int len = wcslen(lpwszValName)*sizeof(WCHAR);
dwIn = sizeof(HKEY) + len;
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
pCurInputPos = pInput;
// Store the hKey value in the output buffer.
memcpy(pCurInputPos, (BYTE*)&hKey, sizeof(HKEY));
pCurInputPos += sizeof(HKEY);
// Store the length of the string in the output buffer.
memcpy(pCurInputPos, (BYTE*)&len, sizeof(int));
pCurInputPos += sizeof(int);
// Store the value name string in the output buffer.
memcpy(pCurInputPos, (BYTE*)&lpwszValName, len);
HRESULT hr = m_rapi.CeRapiInvoke(L"REditSvr", L"RegEditDeleteValue", dwIn,
pInput, &dwOut, (PBYTE*)&pOut, NULL, 0);
// HRESULT hr = RapiFuncTest(dwIn, pInput, &dwOut, (PBYTE*)&pOut, NULL);
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
if (dwOut)
{
memcpy((BYTE*)&rc, pOut, sizeof(DWORD));
}
if (pOut)
{
LocalFree(pOut);
}
if (hKey != hRoot)
{
m_rapi.CeRegCloseKey(hKey);
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::DeleteKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
As you can see in the DeleteKeyValue(...) function I called a test-function just to check that I was retrieving the data out of the pInput buffer ok, which I am.
I signed the DLL with the SDKSamplePrivDeveloper.pfx, added the /postxml via the /postxml switch in the cabwiz and successfully created a CAB file which installs the DLL into the \Windows folder on the PPC. The .inf file is as follows:
Code:
[CEStrings]
InstallDir=%CE2%
AppName="REditSvr"
[Strings]
CompanyName="AHartley"
[Version]
Signature="$Chicago$"
CESignature="$Windows CE$"
Provider=%CompanyName%
[SourceDisksNames.Arm]
1=,"arm files",,C:\eMDevelopment\PPCRegEdit\REditSvr\REL
[SourceDisksFiles.Arm]
REditSvr.dll=1
[Files.ARM]
REditSvr.dll
[DestinationDirs]
Files.Arm=,%InstallDir%
[DefaultInstall.Arm]
CopyFiles=Files.Arm
My PC side code invokes the DLL function return 0 as error code. But the error code returned in the ppOutput buffer is 0x00000057 Dec 87. Which equates to the error message "The parameter is incorrect."! Which must be a param of the RegDeleteValue(...) function, as if I comment this out I don't get any error return values!!
Any odeas?
This is all academic now as I won't be finishing the PPCRegEdit program coz of the Remote Registry Editor tool available in the eVC4 IDE, which I hadn't noticed before, duh. But I would like to know why the function isn't working as required.
You were writing this as a tool? :shock:
If you just asked, people would have told you about the existing reg edit and CeRegEdit witch works through RAPI directly.
Still, it is a nice exercise in coding which I done my self once (for other purposes)
Any way, your error is simple:
Code:
// Value name string.
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(len));
curInputPos += sizeof(len);
You are parsing it incorrectly.
This is how it should look:
Code:
// Value name string.
memcpy((BYTE*)lpszValueName, curInputPos, len);
curInputPos += len;
and on the PC side:
Code:
memcpy(pCurInputPos, (BYTE*)&lpwszValName, len);
should be:
Code:
memcpy(pCurInputPos, (BYTE*)lpwszValName, len);
once again, no offence but if you just read your code more carefully and use debug prints to check parameters, you won't need anyone's help.
Good luck in future projects.
(whoops, made an error my self while correcting another)
Yes, it is just an exercise.
Thanks for all your help. Sorry for the silly errors, I will try and take more care in future.

[Library] Cmd library: Execute Your Java Codes With Root Access Privileges

Synopsis:
Have you ever wanted as root apps developer to use your favourite Java codes instead of bash/shell commands?
Have you grown tired of Runtime.getRuntime.exec("su") and ProcessBuilder("su").start()?
I did and still do, that's why I've been searching for a solution for my problem until I found out in AOSP source code that some of *.java files run with root access, tracking the way they execute them with root access led me to make this simple library.
Description:
Cmd library -short for Command- is an open source (licensed under Apache licence V2) that allows you to execute java commands with root access privileges by passing package name, full class name and whether your app is a system app or not in just two lines of codes.
For instance, suppose you want to flash a *.img recovery image, the first thing comes to your mind is this code:
Code:
busybox dd if=/path/to/recovery.img of=/path/to/recoveryPartition
lets say /sdcard/recovery.img is the file path and /dev/block/mmcblk0p12 is the partition (Samsung GALAXY Ace Plus GT-S7500)
Here is how to implement it:
Code:
...
Proccess proc = Runtime.getRuntime().exec("su");
OutputStream stream = proc.getOutputStream();
stream.write("busybox dd if=/sdcard/recovery.img of=/dev/block/mmcblk0p12".getBytes());
stream.flush();
...
Pretty simple isn't it, now suppose you don't know anything about bash codes, what will you do?
Let me answer this question:
1) Learn some bash.
2) Use Cmd library with java codes.
Here is the same implementaion with Cmd library:
Code:
...
JavaRoot root = JavaRoot.newInstance(getPackageName(), RootCommands.class.getName(), false);
root.execute("/sdcard/recovery.img", "/dev/block/mmcblk0p12")
...
And in RootCommands.java file (should not be an inner class):
Code:
package com.bassel.example;
import com.bassel.cmd.Command;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
public class Main extends Command
{
private byte[] buffer;
private File recovery, partition;
private FileInputStream in;
private FileOutputStream out;
//static main method implementation is a must
@Override
public static void main(String[] args)
{
//required to start
new Main().run(args);
}
//the begging just like onCreate
@Override
public void onRun()
{
if(argsCount() < 2) showUsage();
System.out.println(String.format("Flashing %s to %s", getArg(0), getArg(1)));
recovery = new File(nextArg());
partition = new File(nextArg());
buffer = new byte[1024 * 1024];
try
{
in = new FileInputStream(recovery);
out = new FileOutputStream(partition);
while(in.read(buffer) > 0)
{
out.write(buffer);
out.flush();
}
in.close();
out.close();
System.out.println("Flashed successfully!");
}
catch (Exception e)
{e.printStackTrace(System.err);}
}
//called upon calling showUsage()
@Override
public void onShowUsage()
{
System.err.println("Two args are needed!");
}
//called once an exception is caught
@Override
public void onExceptionCaught(Exception exception)
{
exception.printStackTrace(System.err);
}
}
Quite lengthy but sometimes we prefer using Java codes to bash ones, don't we?
Here is another example for listing /data files:
Code:
package com.bassel. example;
import java.io.File;
//Without extending Command.class
public class Main
{
@Override
public static void main(String[] args)
{
String[] files = new File("/data").list();
for(String file : files)
{
System.out.println(file);
}
}
}
Usage in depth:
Check root access:
Cmd.root();
No root:
Cmd.SH.ex(String command, String... args);
Cmd.SH.ex(String[] commands);
Cmd.SH.ex(List commands);
With root access:
Cmd.SU.ex(String command, String... args);
Cmd.SU.ex(String[] commands);
Cmd.SU.ex(List commands);
JavaRoot java = JavaRoot.newInstance(String packageName, String className, boolean isSystemApp);
java.execute(String... args);
java.executeInBackground(String... args);
All previous methods aside of the last one:
java.executeInBackground(String... args);
return an instance of type Output that has the following methods:
Code:
boolean success() //returns true if process exit value = 0 else false
String getString() //returns output in String format
String[] getArray() //returns output in String Array format
List getList() //returns output in String List format
int getExitValue() //returns process exit value
String toString() //returns process status and output in String format
Converting:
String string = ...;
String[] array = ...;
List list = ...;
String s1 = Convert.array2string(array);
String s2 = Convert.list2string(list);
String[] a1 = Convert.list2array(list);
String[] a2 = Convert.string2array(string);
List l1 = Convert.array2list(array);
List l2 = Convert.string2list(string);
Library GitHub link:
Cmd (licensed under Apache License, Version 2.0)
Examples:
Window Manipulator

Categories

Resources