Windows RT Jailbreak Tool Released 101
An anonymous reader writes "Earlier this week, reports surfaced that the Windows RT operating system had been jailbroken to allow for the execution of unsigned ARM desktop applications. Microsoft quickly issued a statement saying it does not consider the findings to be part of a security vulnerability, and applauded the hacker for his ingenuity. Now, a Windows RT jailbreak tool has been released."
Re:windows rt (Score:5, Insightful)
what'sthat?
A new and innovative way to lock hardware to only the applications that you want your users to run.
*sips coffee*
Oh, and apparently it failed to live up to the owners expectations to be locked down.
Re:windows rt (Score:4, Insightful)
Re:windows rt (Score:5, Insightful)
And then you end up in the situation jailbreakers are with iOS 6. There is still no jailbreak for the platform. And when one is released, Apple will patch it.
Playing silly cat and mouse games with vendors that do this is effort and time wasted. If you see value in using devices you purchase as you see fit, then buy from vendors that don't deliberately interfere with you and make those devices and the software for them better.
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
Exactly why I bought an SGS 2 so I can put Android 4.1 and Debian 7 on it.
Re: (Score:2, Interesting)
The only reason I continue to use an iPhone is because it is jailbreakable. I'm still using 5.1.1, though, and won't upgrade to 6 until there is an untethered JB.
I see it as the best of both worlds. I do like Apple's walled garden because of the polish, quantity, and diversity of the app offerings, but I want to be able to knock a hole in that wall every now and then when I want to do something they don't want me to do (wifi tethering, custom lock screens, custom notification badges, etc).
I think that's a
Re:windows rt (Score:4, Insightful)
But its not. You're patronizing a hostile vendor.
Then perhaps the right answer is, instead of giving money to a company that is hostile to you, that you should look around for a vendor who provides what you want. Android's done a good job at crippling that market however.
No. iOS 6 proves that this argument is and always has been shit. Apple doesn't give a flying fuck about jailbreakers and will fight them until they've got nothing and thus far Apple is winning.
You'll eventually jump ship.
Re: (Score:2)
Maybe so, but in the meantime, I like my iPhone. When my contract is up next year, if jailbreaking is over, I'll jump ship.
Re: (Score:1)
But its not. You're patronizing a hostile vendor.
I'm also an iPhone user. I don't see Apple as a hostile vendor; they're a vendor of more failsafe products
Then perhaps the right answer is, instead of giving money to a company that is hostile to you, that you should look around for a vendor who provides what you want. Android's done a good job at crippling that market however.
No. iOS 6 proves that this argument is and always has been shit. Apple doesn't give a flying fuck about jailbreakers and will fight them until they've got nothing and thus far Apple is winning.
You'll eventually jump ship.
Re: (Score:1)
Re: (Score:2)
It's time wasted unless you do it for entertainment purposes. Some people enjoy crosswords, some prefer cracking and jailbreaking.
It's not a half bad way to learn about software and systems in great depth and detail.
Re: (Score:1)
...No matter how hard you try, if one human, or group of humans, comes up with a protection scheme, another will figure out a way through or around it...
Not really. A properly implemented secure bootloader is pretty much impossible to circumvent. It is enforced, in part, by immutable hardware. Have they cracked RIM's Playbook yet? Nope.
That said, if there is even a teeny, tiny exploitable error in the chain of security (hardware->bootloader->OS->application) somebody is going to figure out how to break it.
Re: (Score:1)
Re: (Score:2)
What makes it innovative?
Re: (Score:2)
Kudos (Score:5, Insightful)
Re:Kudos (Score:5, Interesting)
Kudos to MS for being good sports about it.
Why wouldn't they? Now that I can run (and compile) my own programs on it, I'd be willing to buy a windows RT tablet.
... maybe.
Well
Re: (Score:2)
Re: (Score:1)
I guess...developing a lot of RT stuff are you? I'm an avid MS-tech developer and I'm not buying an RT device...hopefully the pro will come through. Not to happy about the fan :\
I'm a developer, and I use Visual Studio for lots of C projects, and some C#. I bought the RT specifically because of RemoteFX.
Seriously I don't understand why MS isn't touting RemoteFX as the "killer app" of the entire "tablet" world. I'm not buying the Pro, because there is literally no reason when my RT still runs Remote Desktop.
Crysis on the Surface RT anyone?
Re: (Score:3)
I guess...developing a lot of RT stuff are you? I'm an avid MS-tech developer and I'm not buying an RT device...hopefully the pro will come through. Not to happy about the fan :\
I'm a developer, and I use Visual Studio for lots of C projects, and some C#. I bought the RT specifically because of RemoteFX.
Seriously I don't understand why MS isn't touting RemoteFX as the "killer app" of the entire "tablet" world. I'm not buying the Pro, because there is literally no reason when my RT still runs Remote Desktop.
Crysis on the Surface RT anyone?
Exactly.
I bought my playbook the moment they announced the playbook keyboard because of the same reason. In this case, it's citrix at work and splashtop at home.
Re: (Score:2)
Seriously I don't understand why MS isn't touting RemoteFX as the "killer app" of the entire "tablet" world. I'm not buying the Pro, because there is literally no reason when my RT still runs Remote Desktop.
That makes a lot of sense. Tie up TWO machines to do the work you could otherwise handle with the tablet alone. I think MS marketing department has an opening for you.
Nice but not new and may be better ways (Score:1)
For an MS Windows only comparison or *nix to MS Windows, how does it stack up against TurboVNC? I really don't see what RemoteFX can do that VirtualBox plus TurboVNC couldn't do a few years ago unless they've rewritten
Re: (Score:3)
Yes, which is why I mentioned TurboVNC which has been doing the same sort of thing for a couple of years. I think I know how RemoteFX works, what I don't know is how it performs.
Similar things of course even back in 1999 with that p90 and a 64CPU beast at the other end of a 10Mb/s pipe, I'd say exactly the same thing now with TurboVNC export
Re: (Score:2)
The fan?
Re: (Score:2)
Did you know that you could already compile and run your own apps on it? They even give you the dev tools for free:
http://msdn.microsoft.com/en-US/library/windows/apps/hh974577
Not the same. (Score:2)
Did you know that you could already compile and run your own apps on it? They even give you the dev tools for free: http://msdn.microsoft.com/en-US/library/windows/apps/hh974577 [microsoft.com]
That's like saying the ipad is open because you can get your apps by sending them through the app store. Not quite the same, but close enough that it doesn't make a big difference.
Re: (Score:2)
ARM desktop apps? (Score:2)
You can compile and run your own apps on it if you happen to have completely rewritten them as metro apps. I wonder whether this jailbreak could unleash a protest movement to enable compiling WIN32 desktop code for ARM. Do the tools even exist for that?
Just because Microsoft wants to force-feed their phone/tablet ecosystem - and are willing to screw win32 developers to do it - doesn't mean there aren't plenty of win32 dev's with code out there they'd like to port. Microsoft should've provide a way to eit
Re: (Score:2)
Not only do the tools exist for developing desktop apps for RT, they're actually the same (free, for the Express versions) Visual Studio tools used for developing Metro apps. You have to change one configuration file to stop it from bitching at you about not being able to create ARM desktop apps, and you'll find the list of .LIBs is sorely lacking, but the fix for the first was posted on StackOverflow weeks (months?) ago, and the second is easily fixed by "cutting" LIBs out of DLLs using scriptable programs
Re: (Score:2)
Why wouldn't they?
Because in nearly 40 years, Microsoft has never been a good sport about anything, and the last thing Microsoft has ever wanted is any decrease in their ability to control what their users do.
Frankly, I'm surprised at their reaction. Maybe they already have a fix in the channels and know they will plug the hole soon.
I can't imagine Microsoft being so blase about this particular form of jailbreak, otherwise they wouldn't have bothered to implement the app lockout in RT in the first place.
Re:Kudos (Score:5, Informative)
They don't have a lot of choice. The 'hack' leverages the debug support. Can't remove that support while they desperately need devs and it won't be easy to safely plug exploits via it. While the debugger is available there's no point blocking the exploit, it's certain another will be found as quickly as they can fix them.
In a few months when they've had time to decide if RT is worth continuing expect them to do something drastic disruptive to block jailbreaks. While it's struggling there's no point.
Re: (Score:3)
Re: (Score:2)
That they didn't lead the charge with a bunch of lawyers does not mean they won't try to
fix the problem.
The guy did them a service, finding a hole that they can now try to patch.
Further Microsoft knows that this will only be used by a quarter of the 28 existing Windows RT users, so its no big deal.
Applause? (Score:5, Insightful)
We applaud the ingenuity of the folks who worked this out and the hard work they did to document it. We’ll not guarantee these approaches will be there in future releases.
Translation: Thank you for carefully documenting how you jailbroke our new operating system. Your documentation will help us close that hole, even though it poses no security risk.
Re:Applause? (Score:4, Funny)
Linus Torvald hereby announces that he will be the only person with Root access on all Linux systems. He will not share the passwords with anybody.
Theo removes Root access even from himself.
Re:Applause? (Score:4, Informative)
They could also just be reminding everyone that this "feature" is not officially supported. It's very possible that there are legitimate reasons to change the implementation of the security mechanism in ways that break the tool.
Keep in mind they didn't take any action against the homebrew Kinect stuff.
Re: (Score:1)
Since when did playing devil's advocate call for that kind of insinuation?
I must have forgotten to end my post with a cynical anti-M$ blurb. Ya know, a unique contribution that really enhances the discussion.
Re: (Score:3)
Note that this hack does actually make use of a genuine security vulnerability. Specifically, the user-mode system process CSRSS.EXE (Client/Server Runtime SubSystem) makes a bunch of calls into the kernel. The kernel checks that CSRSS is the process making these calls, but beyond that, it doesn't bother validating the parameters much, if at all. Some of the calls have parameters that, if deliberately modified, can be used for write-only access to kernel memory. That's what this hack is doing: changing a ke
Re: (Score:2)
the kinect stuff is way, way more different.
they made a high level political decision about this being out of limits on RT. it's not a question about support or it's technically feasible, it was a question of promoting metro and the app market.
Re: (Score:2)
It seems to me the homebrew Kinect stuff can only affect Microsoft by causing more Kinects to be sold. Jailbreaking RT obviates the whole reason it exists.
Re: (Score:1)
There were arguments on Slashdot that the homebrew Kinect stuff actually could hurt Microsoft. They could no longer assume that 8 million Kinects sold meant 8 million Xbox 360 systems with the Kinect peripheral, which turn could make it harder to convince developers that there's an actual market for Kinect games.
I have no idea if that's true, I just remember it being brought up around here.
Re: (Score:2)
Similarly, jailbreaking RT can be argued to give it a new reason *for* existing. Before, it was a partially crippled device which had excellent battery life and portability, but you were so restricted in what you could do with it, no matter where you were or how long the battery lasted, that it wasn't as compelling a purchase. The Windows Store is ramping up quickly, but there will always be some classes of apps that just can't run in it, or at least not practically, and there will be more people who choose
Re: (Score:2)
True, but clearly Microsoft has clearly considered this scenario and rejected it.
Jailbreaking RT might be a great thing, but it's not what MS wants or they wouldn't have made it necessary in the first place. I think they place as much importance on control as they do sales.
I could personally do some cool stuff with a jailbroken RT machine since I run a lot of open-source software, but I would be afraid of Microsoft doing everything in its power to plug that hole and leaving me with a device that only runs
Re: (Score:2)
Perhaps, but Microsoft has released libraries to use Kinect with Windows. I would think that they would be doing everything they can to come up with ways to use this innovative and successful device as a new peripheral for computers because:
1. There are possibly some really cool applications of Kinect technology that could enhance Windows (though I'm not too sure what they would be... certainly using a Kinect to control a Windows Media Center could be very useful).
2. There would be a reason to purchase a
Re: (Score:2)
We applaud the ingenuity of the folks who worked this out and the hard work they did to document it. We’ll not guarantee these approaches will be there in future releases.
Translation: Thank you for carefully documenting how you jailbroke our new operating system. Your documentation will help us close that hole, even though it poses no security risk.
Also, now we know where to put the crocodiles.
Ok (Score:2)
This is a very honest question, who would want to buy this Windows RT?
Re: (Score:2)
People who can't tell a 'Surface' and a 'Surface Pro' tablet apart; but see that one is thinner and cheaper... Never you mind about those return rates.
Re: (Score:2)
The RT is notable for its better battery life too. Depending on the circumstances its the right option for the right person... not me personally, and probably not here in the slashdot echo chamber... but it would probably be the right choice for my mom.
Re: (Score:2)
It's not that it's necessarily an objectively bad product(reports are that 'metro' is actually an OK interface on the devices it was designed for), just that 'Windows RT' is the biggest break with backwards compatibility in the history of Windows, yet it is sold in a package barely distinguishable from Windows 8 devices that have roughly the behavior and backwards compatibility that people expect from 'Windows'.
Re: (Score:1)
Re: (Score:1)
I don't know. But it's fair to say that before this jailbreak and Microsoft's pleasantly surprising reaction to it, I wouldn't have even considered the question. Now it might be worth looking at.
Re: (Score:3)
Re: (Score:2)
You could always deliver sideloadable APPX packages. They would require your users to install a developer license (free, supported, less complicated than this jailbreak tool, and doesn't rely on a patchable OS security hole) but it works fine. In fact, this tool requires sideloading such a package already.
The difference is that APPX packages (bundled "Metro" apps) only work for apps that run within an "AppContainer" sandbox. That means very restricted access to the whole system, no ability to run as Admin,
Re: (Score:3)
Restate the question: Who would want to buy ARM hardware without knowing whether they would be locked into Windows RT forever. Or could rescue the hardware by loading some other O/S.
This is going to boost the market value of used ARM devices. It may have the perverse effect of selling some more Windows RT, as people don't have the useless brick issue to deal with should they tire of RT.
Re: (Score:2)
Note that this "jailbreak" allows the user to trick the kernel into disabling the signature requirements for desktop apps.
It does not let them directly mess with the kernel itself or load an alternate OS.
Re: (Score:2)
I'd buy one, but I'm just an average Internet user. Browsing, mail, maybe a video here and there. So long as few of the popular tablet games get copied over into the RT Store, I'd be totally content with it. For the right price, though, of course.
I'm sure there are plenty of other folks like me, but all you hear is the squeaky wheels around here.
I also have no problems using Unity or Windows 8... just to peg out your rage meter... :)
ARMless (Score:5, Funny)
allow for the execution of unsigned ARM desktop applications
Awesome! Quick, somebody write some applications!
Re: (Score:3)
Supposing RT does indeed include the full Win32 API to support Office, for many FLOSS applications it's theoretically as simple as a recompile.
e.g. when I evaluated a simple text editor that would work on both Linux and Windows, with easy installation, I chose geany (sorry emacs/vi users!) The code is cpu and OS agnostic, so there would be minimal porting to ARM Win32 provided the code for Windows didn't contain too many x86-isms.
Re: (Score:2)
Re:ARMless (Score:4, Informative)
Actually it looks like it does from my own examination of a Surface - it's just locked so that only Microsoft can use it.
Re: (Score:3)
Gwala is correct, and the purpose of this hack is to remove that restriction. There are a handful of apps which have already been ported. PuTTY, TightVNC, Bochs, and 7-Zip were the first. There are ongoing efforts to port more (including some mildly ambitious projects, like Firefox, Chromium, Thunderbird, Java, and Python).
Additionally, any pure .NET 4.5 app will run, unmodified, on the Surface RT after "jailbreaking". It has to be entirely 4.5 though; Windows RT doesn't include the legacy versions.
There's
Re: (Score:2)
4.5 is an in-place update for 4.0, so any app targeting 4.0 should also run.
Re: (Score:2)
People are already doing this. Notepad++, putty, bochs, and 7zip (with UI) are already ported.
Comment removed (Score:4, Funny)
Re: (Score:2, Funny)
I'm sure the three people using windows rt are grateful.
Those three people? They're WINNING.
They are not full of grate, they are full of windows.
Re: (Score:1)
Ha ha. Three? There are TENS of users now.
Microsoft applauded the hacker for his ingenuity (Score:5, Informative)
Re: (Score:1)
But in the same written statement, MS said it will be patched in the future.
Re: (Score:1)
Whereabouts?
The quote I see is
Re: (Score:2)
I see their compliment sort of like a scene in an action movie:
"Ah, Mr. Bond. Your escape from my heavily armed henchmen was clever. Very clever, indeed. But let's see how clever you are when I drop you in the piranha tank."
It's good PR on their part to not act offended, but I would bet they are.
Now to see whether MS buys these people off (Score:2)
If they can maintain their independence from Microsoft, unlike the sellouts from the WP7 era, more power to them.
Re: (Score:2)
No. It just lets you run unsigned desktop applications.
What's the point? (Score:2)
Re: (Score:2)
The "why" is twofold. First of all, it's there, and we could. People have been working on this since literally launch day. Hackers gonna hack. Second, the Surface RT (and presumably other Windows RT devices) actually make very nice highly portable computers. With the familiar Windows interface and standard system tools, plus the keyboard and mouse provided by the cover, and excellent battery life... the only thing they are missing is software. The restrictions on third party apps (the AppContainer sandbox)
Rabble Rabble Rabble (Score:1)
Not a Jailbreak (Score:1)
Re: (Score:1)
Re: (Score:2)
You came *so close* to understanding, and then you lost it.
This hack involves the following steps:
1. Probe the address of a kernel flag.
2. Attach a debugger to the user-mode CSRSS.exe and modify a function call it makes into the kernel using info from step 1.
3. Execute the function call to change kernel-mode memory.
Step 1 is fairly legit, even though it's not really supposed to be possible from a WinRT app.
Step 2 is completely legit, assuming step 1 succeeds.
Step 3 is the tricky one. This is not a kernel de
Re: (Score:2)
Take a simpler view of it.
Using a stock device, and some external software that's easily available and can send certain commands, you can modify the device remotely and run arbitrary code on it.
Sounds like a jailbre, ak on a closed to me. It's like saying that plugging in a USB device into a laptop gives you admin access, or that you can send certain packets over the network to a machine and end up with admin access.
Those functions shouldn't be available remotely, the processes should have permission to mo