WinCE 4.2 on Industrial Device

Hello Everyone!

I'm new to the forum here so I figured I'd give a little backstory on why I joined.

I work in the Automation Industry and use what is called a Field Communicator for Calibration of various types of devices. This device runs a very slimmed down Windows CE 4.2. on a SH3 Processor.

The device uses an XML file that contains the file sizes of all CAB files for it's programs and registry entries which is protected by a checksum. If the files don't pass the checksum test, the device will not allow them to be installed to the flash memory.

I've been able to determine how the checksum is generated and can now edit the CAB file and insert files / point the registry entries of one of the launchers to an EXE stored on the SD Card. (Pointed to \SDIN\TEST.exe)

When I extract one of the programs that are normally installed to the 32MB flash memory to the SD Card and rename it TEST.exe it runs! Yay, Finally getting somewhere! Any other WinCE apps I've tried have failed (Probably due to missing dependencies / DLL files)

I don't believe windows explorer or anything is installed on this device as it's a very small WinCE 4.2 load. Also I believe the WINCE Bin, DLL ect files are contained as a resource within a different EXE, SysUpdate42.exe which I am unlikely to be able to edit.

I'm pretty new to WinCE and mobile devices in general.

Anyone have any tips or direction on what programs I need to:
1. Develop a "Hello World" Type application compiled for WinCE4.2 SH3 Processor to test on the device (Doesn't Seem like I can do it in visual studio 2013)
2. Extract the WinCE bin file from the device.
3. Verify what EXE files and DLLs are loaded on the device
4. Extract registry entries

This Device does not have WIFI, serial connection, USB, Full Keyboard, Ect.

Pretty Much just SD Card Access.

Cheers!

Hi and welcome.


The fastest way to dev fr 4.2 is using eVC 4 SP4 + the Windows CE 4.2 standard SDK https://www.hpcfactor.com/developer/

You can use VS too, you need the standard SDK installed to target it.

4.2 and SH3?? I've seen support for SH4 in CE .net, but not SH3.

I wonder if there's still an autorun script already in the system's registry despite the sub-barebones file structure. Then you could run Total Commander as an autorun.exe file on the SD card to manipulate both the registry and file system.

Yep. 4.2 With an SH3 Processor. These devices have been around since about 2001 and originally ran Windows CE 2.x. The hardware and software has reached End of Life support and will no longer be supported as of October 2020.

From what I can tell, it's a pretty bare-bone version of Wince 4.2. I'm not sure if aygsys.dll is even on the thing, and since the reflash of the unit uses an exe file that seems to have the resources internal to it, it'll be difficult to change the ROM, especially dealing with the small amount of space on the flash disk. I've been trying to get total commander to install, but by redirecting the "Snap-On" Registry entry directly to the CAB file it just errors out.

Well, I've established code execution with a basic Hello World Application! Microsoft Embedded Visual C++ worked, I am able to run the test application via the registry redirect performed in the Cab File.. Woot Woot.

Looks like I'm going to have to spend some time learning to run Embedded C++. I just dabble in programming, and everything I've built has always been in visual basic, soooooo C++ is a new beast for me.

My next step is trying to install the CAB file for totalcommander SH3 Build using my test app to invoke wceload.exe with the path to the CAB.

To invoke wceload.exe with parameters from a button on my test application do i need to import any DLLs in my application?

I'm trying to use

 
void CTESTDlg::OnButton1()  

{ 

	Process.Start("\\windows\\wceload.exe", "'\\SDIN\\tcmdpocketsh3.cab'"); 

	 

} 

However when I try to clean and compile the application I get the below error.

C:\Program Files\Microsoft eMbedded C++ 4.0\Common\EVC\MyProjects\Test\TESTDlg.cpp(61) : error C2146: syntax error : missing ';' before identifier 'Start'
C:\Program Files\Microsoft eMbedded C++ 4.0\Common\EVC\MyProjects\Test\TESTDlg.cpp(61) : error C2065: 'Start' : undeclared identifier

Thanks for helping this Noob out!

Cheers

If you want a book on the subject, Douglas Boling's is the go-to /

So Process.Start is a C# function, to start a process under C++ WinCe you use

BOOL CreateProcess(  
LPCWSTR lpszImageName,  

LPCWSTR lpszCmdLine,  

LPSECURITY_ATTRIBUTES lpsaProcess,  

LPSECURITY_ATTRIBUTES lpsaThread,  

BOOL fInheritHandles,  

DWORD fdwCreate,  

LPVOID lpvEnvironment,  

LPWSTR lpszCurDir,  

LPSTARTUPINFOW lpsiStartInfo,  

LPPROCESS_INFORMATION lppiProcInfo);

Thanks for the help!

I'm using the below function, I've tried various iterations of it trying to fully qualify the File path I've tried passing it to the first argument as well as the second. I'm just trying ot get this to execute a program "\\SDIN\\VLMobile.exe"

If I don't qualify the String with _T("path") I get an error cannot convert parameter 2 from 'char [13]' to 'const unsigned short

void CTESTDlg::OnButton1()  
{ 

	STARTUPINFO info; 

    PROCESS_INFORMATION processInfo; 

    ZeroMemory(&info, sizeof(info)); 

    info.cb = sizeof(info); 

    ZeroMemory(&processInfo, sizeof(processInfo)); 

 

	if(!CreateProcess(NULL,// No module name (use command line). 

		_T("VLMobile.exe"), // Command line. 

		NULL, // Process handle not inheritable. 

		NULL, // Thread handle not inheritable. 

		TRUE, // Set handle inheritance to FALSE. 

		0, // No creation flags. 

		NULL, // Use parent's environment block. 

		NULL, 

		&info, 

		&processInfo)); 

	  { 

        printf("CreateProcess failed (%d).\n", GetLastError()); 

    } 

 

}

_t converts the literal into Unicode.

What is the error you are getting? The command line does need a fully qualified path.

I get Error 87 pretty much no matter what I do.

I've confirmed the Path to my test.exe file (Which is being ran from the main application loader via my CAB file registry edit loaded to the device) by adding an additional button to get the running modules name (and therefore its path) it returns /SDIN/test.exe

I've tried feeding _T("/SDIN/test2.exe") Into Parameter 2 with 1 NULL, Parameter 1 With 2 NULL and Both Parameter 1 and 2
I've tried the same sequence using L"/SDIN/test2.exe" as well.

 
void CTESTDlg::OnButton1()  

 

{ 

 

 

	STARTUPINFO info; 

    PROCESS_INFORMATION processInfo; 

    ZeroMemory(&info, sizeof(info)); 

    info.cb = sizeof(info); 

    ZeroMemory(&processInfo, sizeof(processInfo)); 

 

 

	if(!CreateProcess(NULL,// No module name (use command line). 

		_T("/SDIN/Test2.exe"), // Command line. 

		NULL, // Process handle not inheritable. 

		NULL, // Thread handle not inheritable. 

		TRUE, // Set handle inheritance to FALSE. 

		0, // No creation flags. 

		NULL, // Use parent's environment block. 

		NULL, 

		&info, 

		&processInfo)); 

	  { 

       printf("CreateProcess failed (%d).\n", GetLastError()); 

    } 

 

} 

 

 

 

 

void CTESTDlg::OnButton2()  

{ 

 

 TCHAR path[100]; 

 DWORD length; 

 

 length = GetModuleFileName(NULL, path, 1000); 

 printf("Length is %d \t Path is %ls\n", length, path); 

 getchar(); 

	 

} 

I cannot easily find documentation for Windows CE API on MSDN, but I found this:
https://docs.microsoft.com/en-us/previous-versions/ms939168(v%3Dmsdn.10)
and it says that first parameter is necessary.

Also, you can look up desktop Windows documentation, it is kind of compatible.

The module name (lpszImageName) is the path to the .exe, the command line (lpszCmdLine) are the parameters. The module is required.

Furthermore Windows CE, and Windows, uses the path separator character of \. You need to change this:
L"/SDIN/Test2.exe"
to this:
L"\\SDIN\\Test2.exe

and also what the admin said, you need to use it as the first parameter of the CreateProcess function instead of the second.

I Gave up on CreateProcess.

I tried every combination including the advice above to know avail.

My First attempt using ShellExecute worked flawlessly!

I am now on my way to see if I can call WCEload.exe to install the totalcommander SH3 Cab file

Working code was as follows

 
SHELLEXECUTEINFO ShExecInfo = {0}; 

ShExecInfo.cbSize = sizeof(SHELLEXECUTEINFO); 

ShExecInfo.fMask = SEE_MASK_NOCLOSEPROCESS; 

ShExecInfo.hwnd = NULL; 

ShExecInfo.lpVerb = NULL; 

ShExecInfo.lpFile = _T("\\SDIN\\test2.exe");       

ShExecInfo.lpParameters = _T("");    

ShExecInfo.lpDirectory = NULL; 

ShExecInfo.nShow = SW_SHOW; 

ShExecInfo.hInstApp = NULL;  

ShellExecuteEx(&ShExecInfo); 

WaitForSingleObject(ShExecInfo.hProcess,INFINITE); 

Well, enough messing around for today.

The Cab file seems to install but it's hard to tell. It's deleted from the Flash Drive when I load it using \\windows\\wceload.exe and then the cab file path as the parameter in ShellExecuteEx. However I cannot run the program where it should have been installed by trying to perform a ShellExectute on \\FXD1\cecmd.exe Which should be reference to the default program files directory.

I'm going to try ShellExecute on some applications that I know are installed to that directory tomorrow to make sure that it is the correct path and that the standard applications will load from there, so I know it's not just something going wrong in my loader program.

I did try to extract the WinCe Total commander EXE from the cab file using WinCE Cab Manager and running it directly from the SD Card. The hourglass just sits there and spins and spins......

Quite interesting trying to investigate the file system of a device blindly without any real working tools...... I might have to really delve into learning more C++ so I can test and write my own for this device lol.

Thanks again for the suggestions on here!

Well. My path is correct, as I can load other executables that are already installed to that location just fine. VLMobile.exe runs with the \\FFXD1\\VLMobile.exe path.
Cecmd.exe however is not found. Even after changing the shell execute verb to “open” and the lpfile to the cab file on the SD card. It’s just very strange that the cab file is deleted from the SD card after the command indicating that everything went through as it should.

Guess nothing is easy with this unit