Application unlocking a Windows Mobile 2003 / 5.0 Smartphone

Most Windows Mobile Smartphone devices by default are configured to be Application Locked. That is a rather irritating limitation for people like myself who develop on Windows Mobile devices quite extensively.

Since most Windows Mobile Smartphones are difficult to hard reset (especially mine - O2 Xphone II), a malicious app can make you run down to the service center to get your phone hard reset! Microsoft has built in the Application Lock for smartphone, to protect the device from malicious applications accessing the core windows privileged APIs.

What this means is that if you want to have functionalities in your application which interfaces to core phone functionalities, such as SMS message interception, keypad hooking, etc, you need to have privileged access (on locked devices) for your application. An application has privileged access to the core APIs if it is code signed by certain dedicated authorities:

• GeoTrust
• VeriSign

If you have a locked phone, and you want to run an application which is not code-signed, you must first unlock the phone. After digging through piles of segmented information, this is how I went about unlocking my application.

Download the following (bundle):

• Registry Editor (HTC Signed)
• Windows Mobile Smartphone Lock Checker
• RAPI Config & ResetSecurity.xml

Once you have downloaded the necessary components, perform the following.

Installation

• Connect your device to the PC using ActiveSync.
  
• Copy the registry editor, and lock checker to the phone memory through active sync file transfer
  

Check for application lock

• Use the device file explorer to navigate to the directory to which you had copied the lock checker.
• Tap the file to execute it.
• The application will tell you if you phone is locked. If your phone is unlocked, you can skip the rest of this article. Otherwise, go on to the next step.
  

Registry Updates

Change the value of the following registry keys in [HKEY_LOCAL_MACHINE \ Security \ Policies \ Policies]:

• Key: 00001001, Value: 1
• Key: 00001005, Value:40
• Key: 00001017, Value: 144

Running the Security Unlock

• Open command prompt
  
• Go to the path which contains RapiConfig.exe and ResetSecurity.xml
• Key in: rapiconfig /p resetsecurity.xml
• Hit Enter

Verify the Application Lock

• Use the device file explorer to navigate to the directory to which you had copied the lock checker.
• Tap the file to execute it.
• The application should now say that your device is unlocked.
  

Bibiliography:

• Modaco Forum: (Registry Editor Signed by HTC), (App unlocking guide)
• Usenet: microsoft.public.pocketpc.activesync (Guide to Certificate/Application Unlocking Windows Mobile 5 Smartphones)
• MSDN: A Practical Guide to the Smartphone Application Security and Code Signing Model for Developers (thanks Varun for the link).