Showing posts with label Jailbreak Surface. Show all posts
Showing posts with label Jailbreak Surface. Show all posts

Download Windows RT Jailbreak Tool to Run Unsigned Apps

As we reported to you a few days ago, a group of software creators managed to bypass Windows RT’s restrictions and run unsigned desktop applications on the operating system, basically opening the door to a whole new world of jailbreaking tools.

Even though the whole process of jailbreaking Windows RT was pretty complicated, it was only a matter of time before someone came up with a dedicated solution supposed to perform this task all by itself.

Now XDA Developers user “netham45” has released a batch file that does the entire jailbreaking process automatically, so it modifies the Windows RT system kernel without user interaction.

Even though the software developer admits that some users might get a BSOD after launching the application, he says that everything should work just fine on all Windows RT tablets, including Microsoft’s Surface RT.

At this point, there are only a few software solutions available on a jailbroken Windows RT unit, including VNC Server and Client, Putty and Bochs, but many more apps are very likely to be added to the list as new users do the jailbreak.

Microsoft has already confirmed the jailbreak, saying that it “applauds the ingenuity” of the software developers behind the project, but also hinted that a future fix could block their attempts to modify the system kernel.

netham45 explained that Microsoft would have a very hard time trying to block their efforts. “They can patch it through Windows Update, but since we have the ability to reinstall from recovery partitions we can revert any Windows Updates they release,” he explained.

The jailbreak would only last until the Windows RT device is restarted and even though it may sound like a glitch, it’s actually a simple way to make sure that you won’t lose the warranty or get infected by some sort of virus compiled for the tablet-oriented operating system.

Hack Windows RT to Run any Desktop App

microsoft-surface
The security mechanism preventing unauthorised software running on ARM-powered Windows RT tablets - such as Microsoft's Surface slabtops - can be easily defeated.

The Redmond giant wanted only cryptographically signed executables, ideally those obtained from the official Windows application store, to run on its hardware. But, we're told, by twiddling a byte of memory in the Windows kernel, it is possible to disable the protection system and allow any code to run on the system.

Taking full control of the device, effectively jail-breaking the computer to run any desktop or touch-driven ARM-compatible software, is an exercise left to the user.

A security researcher calling him or herself C. L. Rokr claims to have found an oversight in the Windows kernel to allow this to happen. According to Rokr, all you have to do is fire up the Windows Debugger software with Administrator-level permissions, connect it to the tablet and manipulate the device's kernel memory.

Specifically, one needs to inject a blob of ARM code into a safe spot of RAM and have the Windows RT kernel divert the processor momentarily to run these instructions. This code locates and alters a moderately hidden variable in the kernel to disable the executable signature check. On PCs the variable contains '0' allowing any program to run, whereas it is '8' on Windows RT devices to enforce the signature check.

Trivially overwriting this byte can therefore change the level of protection on the system and circumvent Microsoft's cryptographic keys.

You can read more about the hack along with a how-to guide here.

Windows RT, which is a straight-up ARM port of Windows 8 for portable computers, was built to only run apps that are signed using a Microsoft-issued certificate.

The hack is unlikely to be something most non-techie users could pull off as it requires knowledge of WinDbg. And modifying the operating system could fall foul of the device's secure boot protection, which refuses to start the OS if it has been altered.

It's also not clear which apps can be run, although as pointed out in this programming forum the software must be compiled for, or otherwise be compatible with, ARM-powered systems. Programs already built for Intel and AMD processors need not apply, therefore.

Windows RT can be found on Microsoft's Surface tablet and fondleslabs from companies including Asus and Samsung. So far it appears sales of Windows RT devices are low and below Microsoft's expectations. Redmond has quickly turned from only selling Surface itself online and in its stores to recruiting retail partners.

One reason for the lack of interest could be lack of apps. Windows RT has been deliberately locked down because, we're told, Microsoft wants to maintain a standard of performance and security, and to ensure apps conform to the design of the interface and input via touch. This means the number of Windows RT apps is far behind the number of apps that exists for Intel machines running the exact same operating system.

Devices using Windows RT come with some built-in apps including Office Home and Student 2013 RT Preview Edition and Mail, Messaging and SkyDrive, but the official way to obtain more is via Microsoft's Windows Store, which supplies suitably signed executables.