To remove Lock plug-in of Today

How do the mission?  Just 2 steps.

1. To remove the lock registry under [HKLMSoftwareMicrosoftTodayItemsDevice Lock], it depend each Language version. here is for World Wide English.

2. Warm reset of Device.

Why do it? When your device want to certificate LTK. Before must run Hopper to test your device & OS image.  Cause Hopper is simulation random input if want full/correct verify should remove lock item before running Hopper.

Download code & execute files, (C# + .NetCF v1, support WWE/French/Japanese/Tradition Chinese)


UIntPtr KeyRoot = UIntPtr.Zero;
bool DoIt = false;
// for Pocket PC 2003 SE Emulator testing, to remove messaging item
//string delKey = "SOFTWARE\Microsoft\Today\Items\"Messaging"";

string RootKey = "SOFTWARE\Microsoft\Today\Items\";
string[] subkey = new string[] {
    "Device Lock", // 0409, World Wide English
    "Verrouiller tél.", // 040C, French
    "x30C7x30D0x30A4x30B9x306Ex30EDx30C3x30AF", // 0411, Japanese
    "裝置鎖定", // 0404, Tradition Chinese

    // here can add new item support others language

};

StringBuilder delKey;

foreach(string str in subkey)
{
    delKey = new StringBuilder(String.Format("{0}"{1}"", RootKey, str));
    string temp = delKey.ToString();
    if (NIF.ERROR_SUCCESS == NIF.DeleteKey(NIF.HKLM, temp))
    {
        DoIt = true;
        break;
    }
    NIF.RegCloseKey(NIF.HKLM);
}
NIF.RegFlushKey(NIF.HKLM);

……………………..

public class NIF
{
    private static Int32 FILE_DEVICE_HAL = 0x00000101;
    private static Int32 FILE_ANY_ACCESS = 0x0;
    private static Int32 METHOD_BUFFERED = 0x0;
    private static Int32 IOCTL_HAL_REBOOT = ((FILE_DEVICE_HAL) << 16) | ((FILE_ANY_ACCESS) << 14)
    | ((15) << 2) | (METHOD_BUFFERED);
    public const int ERROR_SUCCESS = 0;

    public static UIntPtr HKCR = new UIntPtr(0x80000000);
    public static UIntPtr HKCU = new UIntPtr(0x80000001);
    public static UIntPtr HKLM = new UIntPtr(0x80000002);
    public static UIntPtr HKU = new UIntPtr(0x80000003);
    /// <summary>
    /// Warm Reset device
    /// </summary>
    /// <returns></returns>
    public static bool WarmReset()
    {
        byte[] OutputBuffer = new byte[256];
        Int32 OutputBufferSize, BytesReturned;
        OutputBufferSize = OutputBuffer.Length;
        BytesReturned = 0;

        return KernelIoControl(IOCTL_HAL_REBOOT, IntPtr.Zero,
            0, OutputBuffer, OutputBufferSize, ref BytesReturned);
    }

    /// <summary>
    /// This function releases the handle of the specified key. A remote
    /// application interface (RAPI) version of this function exists, and
    /// it is called CeRegCloseKey.
    /// </summary>
    /// <param name="hkey">[in] Handle to the open key to close.</param>
    /// <returns>ERROR_SUCCESS indicates success. A nonzero error code
    /// defined in Winerror.h indicates failure. To get a generic description
    /// of the error, call FormatMessage with the FORMAT_MESSAGE_FROM_SYSTEM
    /// flag set. The message resource is optional; therefore, if you call
    /// FormatMessage it could fail.</returns>
    [DllImport("coredll.dll", SetLastError = true)]
    public static extern int RegCloseKey
    (
        UIntPtr hkey
    );

    /// <summary>
    /// Deletes a registry key.
    /// </summary>
    /// <param name="keyName">Name of key</param>
    /// <returns>ERROR_SUCCESS if successful</returns>
    public static int DeleteKey(UIntPtr hkey, string keyName)
    {
        return RegDeleteKey(hkey, keyName);
    }

    /// <summary>
    /// This function deletes a named subkey from the specified registry key.
    /// A remote application interface (RAPI) version of this function exists,
    /// and it is called CeRegDeleteKey.
    /// </summary>
    /// <param name="hkey">[in] Handle to a currently open key or one of:
    /// HKCR, HKCU, HKLM.</param>
    /// <param name="subkeyName">[in] Pointer to a null-terminated string
    /// specifying the name of the key to delete. This parameter cannot
    /// be NULL.</param>
    /// <returns>ERROR_SUCCESS indicates success. A nonzero error code defined
    /// in Winerror.h indicates failure. To get a generic description of the
    /// error, call FormatMessage with the FORMAT_MESSAGE_FROM_SYSTEM flag set.
    /// The message resource is optional; therefore, if you call FormatMessage
    /// it could fail.</returns>
    [DllImport("coredll.dll", SetLastError = true)]
    public static extern int RegDeleteKey
    (
        UIntPtr hkey,
        string subkeyName
    );

    /// <summary>
    /// Writes all the attributes of the specified open registry key into the registry.
    /// </summary>
    /// <param name="hkey">[in] Handle to a currently open key or one of:
    /// HKCR, HKCU, HKLM.</param>
    /// <returns>ERROR_SUCCESS indicates success. A nonzero error code defined
    /// in Winerror.h indicates failure. To get a generic description of the
    /// error, call FormatMessage with the FORMAT_MESSAGE_FROM_SYSTEM flag set.
    /// The message resource is optional; therefore, if you call FormatMessage
    /// it could fail.</returns>
    [DllImport("coredll.dll", SetLastError = true)]
    public static extern int RegFlushKey
    (
        UIntPtr hkey
    );

    [DllImport("coredll.dll")]
    private static extern bool KernelIoControl(Int32 IoControlCode, IntPtr
      InputBuffer, Int32 InputBufferSize, byte[] OutputBuffer, Int32
      OutputBufferSize, ref Int32 BytesReturned);
}

 

Ref.

MSDN – Creating a P/Invoke Library

廣告

發表迴響

在下方填入你的資料或按右方圖示以社群網站登入:

WordPress.com Logo

您的留言將使用 WordPress.com 帳號。 登出 / 變更 )

Twitter picture

您的留言將使用 Twitter 帳號。 登出 / 變更 )

Facebook照片

您的留言將使用 Facebook 帳號。 登出 / 變更 )

Google+ photo

您的留言將使用 Google+ 帳號。 登出 / 變更 )

連結到 %s

%d 位部落客按了讚: