New nPOPuk Release + OpenSSL / CE Testers Needed!

Please check this one.
https://www.dropbox.com/sh/xoz4rlk4gited63/AADAA0hx8N5_V7A2I0Vzlx13a?dl=0

Did hard reset to fix ws2.dll in /Windows (so fresh install)

Tried with and without ws2.dll in same directory

Unchanged behavior

Hi all, I got a message from torch and investigated "ARMv4_005".

It doesn't launch on SHARP Brain showing nothing. No surprise as I faced this so many times when I tried to run a new app on this machine. Then, I tested it with TroNic Run in MioPocket and it reported that coredll.dll lacks functions 126, 127, and 143 (yes, CE 6.0 lacks DLL error message box lmao). Then, I opened Dependencies and analyzed coredll.dll which I got by building a full CE 6.0 in Platform Builder. It seems these ordinal numbers each corresponds to CryptAcquireContextW, CryptReleaseContext, and CryptGenRandom, respectively. Therefore, we can guess that SHARP Brain fails to run ARMv4_005 as (at least) these functions are missing from coredll.dll.

(Side note: PEInfo reports that required OS version for nPOPuk.exe is set to 4.20, but libssl-1_1.dll is set to 5.00. It taking forever to analyze libcrypto-1_1.dll.)

Edit: The analysis done, libcrypto-1_1.dll is also set the required OS version to 5.00.

Edited by watamario15 2022-12-17 12:15 PM

OK, as I expected, "ARMv4_005" worked with hacking libcrypto-1_1.dll into loading the aforementioned coredll.dll I got by building a full CE 6.0 in Platform Builder, instead of the system one. I suspect the missing functions in the system coredll.dll (or you can say the new version of OpenSSL requires more Win32 API functions than before) is the cause of this issue.

Of course, this is just SHARP Brain's case. Other devices might have another issues as always.

(FYI: I can't test SSL/TLS as SHARP Brain is built without networking support. An electric dictionary doesn't need it anyway.)

Edited by watamario15 2022-12-17 3:49 PM






Attachments
----------------
ARMv4_005_Brain.png (16KB - 0 downloads)

CryptReleaseContext and CryptGenRandom have been in CE since CE 2.10 and the interfaces are the same. So it must be a case of the Brain having not been compiled using CE MAXALL and Platform Builder must be dropping the library's from its CEMIN build. They most likely platform generated it without CE security components.

You're right, but with Brainux (Linux for SHARP Brain) you can get online. So maybe there is a way in Windows CE which hasn't been enabled?
https://note.com/ryonakano/n/n16355156db1c (Japanese site)

https://brainux.org/ (Brainux Site)

Edited by stingraze 2022-12-18 12:57 AM

Thank you for really helpful investigation.

It is implied that CryptAcquireContextW, and CryptReleaseContext, CryptGenRandom are commonly not available prior WinCE 3.0 by source code comment in OpenSSL0.9.8zh.
--
(crypto/rand/rand.win.c)
# if defined(OPENSSL_SYS_WINCE)
# if defined(_WIN32_WCE) && _WIN32_WCE>=300
/*
* Even though MSDN says _WIN32_WCE>=210, it doesn't seem to be available
* in commonly available implementations prior 300...
*/
{
BYTE buf[64];
/* poll the CryptoAPI PRNG */
/* The CryptoAPI returns sizeof(buf) bytes of randomness */
if (CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL,
--

However, assuming torch is usign WinCE 4.2 device (NEC MobilePro 900), those implementation can be in its coredll.dll?

To confirm that, you can put attached coredll.dll in the same directory with nPOPuk.exe and execute it. I guess it will run. The coredll.dll will be removed once the test is done.
https://www.dropbox.com/sh/9xmy7e32ldn44ap/AAB4k6dl6Vs7xsKqYx5gFmwja?dl=0

I can check whether there are those implementations in your system installed coredll.dll if you share it.

Edited by soju 2022-12-18 3:39 AM

It sounds about right. But with "Cannot find nPOPuk or one of its components. Make sure path and file name are correct and that all required libraries are available." error, I guess it is more or less DLL/function dependency issue. You can analyze it in the same way as I did by running nPOPuk.exe from TroNik Run, which is "MioAutoRun -> Programs -> TroNik -> Run.exe" of MioPocket. Ads are really annoying on this uploader.jp site but you can use adblocker or such. Or you can just grab TroNik tools attached on this post.



Nah the CE 6.0 on Brain is built without USB host driver. This is "omitted" rather than "disabled", so there is no way to enable it, or at least there's no single person achieved it in about 15 years including some talented hackers. Brainux is a completely different OS to CE as it launches by disabling the MMU and therefore killing CE to jump to U-Boot. Brainux can do networking and USB host as they included USB host driver in it.



Nah this shouldn't fix the issue. coredll.dll is a core DLL in Windows CE as the name suggests, therefore this DLL is always loaded and used by some other processes. Windows CE looks for an DLL in memory first before looking for the folder where the EXE file exists and /windows folder, and uses the in memory one if there is, even for a completely unrelated new process. And "always loaded" implies Windows CE never loads your custom one and you can't even replace it. So you must hack the executable to load the desired coredll.dll in this way.

Edited by watamario15 2022-12-18 2:24 AM




Attachments
----------------
TroNik.zip (277KB - 6 downloads)

Thanks watamario15, I agree you are right. I'll tackle this problem.

Yeah, unless somebody uses the Platform Builder and can target the SHARP Brain and build it with USB host.

It's not that easy... Embedded systems don't have a strict standard like IBM PC/AT. So even if you managed to get a BSP for i.MX283, you must implement non-standard drivers for keyboard, LCD display, and more. You can read what Brain Hackers did to port Linux to SHARP Brain here (latest, login walled) or here (two years ago, but not login walled). That's really crazy.

Oh, all users of a Windows CE 5.0 or later (Arm) device can analyse what is preventing nPOPuk from launching on your device by opening it from TroNik Run, which is attached on the post I'm replying to. It will show error messages containing the missing DLLs and API functions (might be ordinal numbers but still), and reporting them here should help to identify how to fix the issue.

Edit: It seems that the reply doesn't show up. I meant this post.

Edited by watamario15 2022-12-18 9:48 AM

I never said that it's easy. We at HPC:Factor have tried Platform Builder if you care to check the past threads. (It is a very difficult task... )

-stingraze

Wouldn't be the first time MSDN was wrong, but it might be platform specific. A full H/PC should be MAXALL, but older devices may have been ROM constrained. The MP900 was certainly MAXALL.

Yeah in that case I more suspect the issue to be lacking some DLLs. Since TroNik Run also reports missing DLLs, I believe this technique still works.