Here is my very short, sweet summary of this new stuff.  First, Windows 7:

• Winows 7 will fix all that stuff that caused negative reviews on Vista. 
• It also has a lot of great, new shell features that will positively impact the experience for the everyday user.  Just the taskbar improvements alone are pretty cool.
• UAC will still be there, but in a more flexible format for configuration and they have decided to except more operations from prompting.  However, Microsoft continues to be hardcore about forcing all apps to the do the right thing and operate under “standard user”.  The stats do show that most developers are getting the message and a lot of progress has been made.  As a user, UAC drives me up the wall.  As a security person, it’s the right thing to do.

The more exciting (to me) and new technology has to do with the new Microsoft services strategy which includes “Azure” and the “Geneva” server.  This technology will catalyze  two, important business scenarios that really need to get over the hump:  (1) B2B connectivity in which there are many enmeshed partners sharing a workflow and (2) hosted services for enterprises (not just small orgs).

Microsoft has a big cloud in the sky and plays traffic cop for all services that register to the Microsoft “Services bus”.  But, the bus supports some serious authentication and authorizatio through use of WS federation and SAML tokens.  And, part of the offering is SQL services which equates to a SQL DB that is up in the cloud and protected by the aforementioned authentication and authorization.  So, you can support some great B2B scenarios:

• Partners that all need access to a workflow, but need a slightly different type of data for the same workflow transactions
• Partners that all use a different directory or authentication type can still positively identify into one cloud
• Eventing enables store and forward of transactions when one particular partner connectes to the service.

If you are a small company and you are interested in advertising your service, click into the Microsoft service bus and you just go a free advertisement to services consumers.

But…that’s not all.  The biggie is Geneva because it creates a super easy to setup and configure Enterprise Service connector for Active Directory.  This could enable hosting of an internet-based service to a company with an internal Active Directory.  There is a question here of whether the company will accept the Microsoft EULA for connecting to the Services bus and whether their security policy will accept their authentication getting proxied through the Microsoft Federation Gateway in the cloud.  But, the good news is that all the authentication against the hosted service is handled by the Microsoft Service Connector which is located on the company premises.  It reminds me a little bit of ADSI, but better.  If the company doesn’t want to accept the Microsoft EULA, they can set up a B2B direct to their partner ( the hosting provider) who will have the Federation Gateway  (Geneva) handling “claims”.

We still have 1.5 more days here, but I think all the big news has already popped.

Dave Field, CISSP, MCP

Alltel HTC PPC8600 [Posted 10/10/2008]
Alltel HTC Touch [Posted 10/10/2008]

ASUS PDA Phone P527 (Released by country): [Posted 9/16/2008]
ASUS PDA Phone P750 (Released by country): [Posted 9/18/2008]

AT&T Motorola Q9h
AT&T Tilt [Reposted 8/26/2008]
AT&T Pantech C810 Duo [Posted 10/8/2008]
AT&T BlackJack II (SGH-i617) [Posted 9/2/2008]

Bell HTC Touch [Posted 8/23/2008]

Fido BlackJack (SGH-i616) [Posted 10/8/2008]

HTC TyTN II (unlocked)
HTC Touch Cruise [Posted 9/30/2008]
HTC Touch Dual [Posted 10/10/2008]

Intermec CN3 [Posted 9/26/2008]

O2 XDA Stellar [Posted 9/19/2008]
O2 XDA Orbit 2 [German] [Posted 9/19/2008]

Orange HTC TyTN II
http://www.coolsmartphone.com/news4172.html

Rogers BlackJack (SGH-i616) [Posted 10/8/2008]

Samsung SCH-i760
Samsung Omnia SCH-i900 [Posted 8/9/2008]

Sprint Motorola Q9c
Sprint Mogul [Posted 8/6/2008]
Sprint HTC Touch [Posted 8/6/2008]
Sprint Samsung Ace (SPH-i325) [Posted 10/16/2008]

Telus HTC Touch [Posted 8/6/2008]
Telus HTC S720 [Posted 9/12/2008]
Telus HTC P4000 [Posted 8/6/2008]

Verizon Samsung SCH-i760
Verizon UStarcom XV6800 [Posted 8/27/2008]
Verizon XV6900 [Pending ???]
Verizon Motorola Q9c [Posted 9/18/2008]

Vodafone v1615 [Posted 6/27/2008]

If you know of others, or corrections, please let me know!

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org

So, you’ll need to purchase an SSL certificate for your web server and any Windows Mobile clients should have the root of your SSL certificate in the device’s root certificate store. 

The problem comes when the root certificate is not already in the device root certificate store by default.  You can add certificates to the root store (this got a lot easier in Windows Mobile 6.0).  But, this will likely require a user trying to perform the task or the support tech will need to “touch” the device.  And, if the device is cold reset, you have to perform this task all over again.  It is much easier just to use an SSL server certificate from a Public Certificate Authority  that chains to a root certificate that’s already resident on the device.

Unfortunately, Windows Mobile has no root certificate updating service as included in Windows XP and Windows Vista.  With Windows Mobile, you get the root certifcates that were added when the image was built.

If you are using Windows Mobile 5.0 devices, you should not use GoDaddy or Comodo root certificates for the most part.   Here is a table showing which versions of Windows Mobile includes which Public CA certificates:

Another consideration is the use of wildcard certificates.  As you probably already know if you are reading this, a wildcard certificate allows the use of a wildcarded DNS name prefix such as “*.acme.com”.  You can use the same SSL certificate for many different web servers that all have assigned DNS names that end in “.acme.com”.  It is important for SSL security that the server’s internet DNS name matches the subj or subj alt name on the certificate.  So, if you wildcard th prefix in the certificate, you can use one cert for a lot of servers.

Windows Mobile started supporting wildcard certificates in Windows Mobile 6.0.  If you have Windows Mobile 5.0 devices, you should take a look at the offering from Digicert.  They allow you to pre-populate the subj alt name of the certificate with a list of server names.  This ends up giving you something approaching wildcard certificate features.  However, you do need to know the internet DNS names of all the web servers you’ll be using.  See more details on the Digicert site. Note that digicert is not shown on the list above because they actually chain back to the Entrust root.

Dave Field, CISSP, MCP
Device Management and Security Architect
Enterprise Mobile, Inc.

One of the most powerful things about Microsoft System Center Mobile Device Manager (SCMDM) is the ability to manage all of your Windows Mobile 6.1 or above devices through Active Directory (AD) Group Policy Objects (GPOs). A large percentage of the corporate market is already using GPOs to manage their desktop, notebook and server environments.

The GPO technology was introduced in Windows 2000 Server. Before that there were System Policies in Windows NT 4.0. There is already a fair amount of documentation and knowledge around extending GPOs to your own needs. But here I will go into some aspects more important around making use of SCMDM and supporting Windows Mobile in an enterprise running AD.

In this article I will go through how you can extend your own GPOs to have additional settings not available out of the box in the default Windows Mobile GPO template supplied by Microsoft in SCMDM 2008. I will expect that you already know how to access and use the default SCMDM GPO settings.

Windows Mobile Registry Keys

GPOs work by manipulating how registry keys are changed and written on the client machines. This is no different on Windows Mobile, compared to other Windows platforms at this point in time.

I will save the discussion on where to find and research Windows Mobile registry locations. But will point out that many are bound to specific OS levels, OEM and hardware requirements. So what works on one WM device may not work on another. So I can’t stress enough the aspect of testing such settings before a larger deployment to end-users.

For this article I have asked my colleague, Chris De Herrera, to suggest some registry keys to use:

Improve text rendering performance by increasing the GLYPH Cache to 32k (decimal):

[HKEY_LOCAL_MACHINE\System\GDI\GLYPHCACHE]
“limit”=dword:00008000

Internet Explorer Mobile homepage settings:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs]
“home_0409″=”file://\\windows\\default_0409.htm“
“version_0409″=”file://\\windows\\about_0409.htm“
“blank”=”res://webview.dll/blank.htm”

Configure Communicator Mobile:

[HKEY_CURRENT_USER\Software\Microsoft\Communicator\System Settings]
“ServerInternal”=”sip.yourcompany.com”
“Server”=”sip.yourcompany.com:443″

Furthermore I have also researched the following registry keys which may be helpful in corporate environments:

ClearType Activation:

[HKEY_LOCAL_MACHINE\System\GDI\ClearType][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
“ClearTypeText”=dword:1[HKEY_LOCAL_MACHINE\System\GDI\ClearTypeSettings]
“OffOnRotation”=dword:0

Browser History:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“DaysToKeep”=dword:00001E

Default Search Page:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Search Page”=http://m.live.com/search/Results.aspx?q=%&mid=8001

Internet Explorer User Agent:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
“Default”=”Mozilla/4.0″
“Platform”=”Windows CE”
“Version”=”MSIE 6.0″

Menu Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE\Menu]
“AniType”=dword:0

Windows Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE]
“Animate”=dword:0

Error Reporting:

[HKEY_LOCAL_MACHINE\System\ErrorReporting\DumpSettings]
“DumpEnabled”=dword:0
[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“DontUpload”=dword:1[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“ConnectionFlags”=dword:0

Today Screen Text:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\DeviceBeta]
“Today”=”EnterpriseMobile”

Display Time/Date in Taskbar or disable for battery indicator:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell]
“TBOpt”=dword:3
“ShowTitleBarClock”=dword:1

Permit Bluetooth and IrDA File Transfer:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Obex]
“IsEnabled”=dword:1

Please be aware that most of these settings require a soft reboot of the device before they become effective. The SCMDM policy agent should prompt you for a reboot of the device when an updated policy is synchronized from the Device Management Server.

Creating .ADM Files

Using the information published here about the correct registry key prefix to use for GPOs on Windows Mobile I created my own .ADM file with my sample registry keys listed above and a few other samples currently available.

You can download it here. I have noted in my sample the references used.

Look for a new folder called “Windows Mobile Settings-Extended” in the Computer Configuration section of the Group Policy Object Editor.

 
The single main trick was to prefix the native Windows Mobile registry keys with the <SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry> path.

So the native:
<HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs> became the longer:
<SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry\HKLM\Software\Microsoft\Internet Explorer\AboutURLs>.

Note the collapsed HKEY_LOCAL_MACHINE hive into the named HKLM. This also works for the HKEY_CURRENT_USER hive into HKCU.

Further Information on .ADM Files

Please see the reference links below for more details on the syntax used in the example .ADM file. The syntax and commands are not the easiest in the world of IT.

I also found a ADM file editor, called ADM Template Editor from a small company in Australia that may be useful if you are planning to write and manage a large number of custom .ADM/.ADMX files.

Again, please test the policies on the OS platform, level, and hardware you wish to broadly deploy your Windows Mobile settings out to.

Look for more articles soon on useful Windows Mobile registry keys and GPOs!

References:

• Microsoft articles on writing GPOs:
  • How to Write a Simple .Adm File for Registry-based Group Policy
  • KB225087: Writing Custom ADM Files for System Policy Editor
  • KB816662: Recommendations for managing Group Policy administrative template (.adm) files
• Creating a New Group Policy Object for (Windows Mobile) Devices
• SCMDM Technical Article: Deploying and Configuring Communicator Mobile with MDM
• SCMDM Technical Article: Name Resolution Considerations for Company Web Site Access
• ADM Template Editor: (Recommended, one of the few I believe out there!)

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org

At first glance, I assumed this would be a breeze. I have a powerful layout, key handling, and paint framework that I use in every project I work on, and thought that creating a home screen leveraging that would make it trivial. Sadly I was sorely mistaken.

Those of you familiar with WM Home Screen development know that there are actually two APIs: the Home Screen API (Smartphone) and the Today Screen API (Pocket PC). I was only interested in the prior. Smartphone Home Screen development is considerably more difficult: you don’t have nearly as much control. The developer must implement IHomePlugin which only receives paint events (the plug-in is supplied only an HDC) and some key events (left and right only). On Pocket PC, you get an HWND and all the good things that go along with it.

That didn’t phase me too much. My plan of action was to implement this IHomePlugin interface in managed code and then let the magic happen. Easy enough. I implement a dummy plug-in in C#, and try to register the COM object… and it doesn’t work. It refused to register, the error claiming it was an invalid DLL. I poked at it for a while before finally giving up and checking to see if Google would know why I could not register a C# COM object on Windows Mobile.

I searched for a while, and found plenty of examples of how to invoke unmanaged code from managed code. Then I noticed, not a single site showed how to invoke managed from unmanaged. I began searching explicitly for that, and found my answer:

The .Net Compact Framework does not support hosting the runtime from native code. This means that you will not be able to call CoCreateInstace to instantiate a managed object, or register managed objects as COM objects on the system. You will also not be able to call CorBindToRuntime or ClrCreateManagedInstance. In order to call managed functions from native code, you must first use the runtime to marshal a managed interface or a delegate down to native code. This means you must always start out in managed code (with a .net executable) in order to expose .net components to native code.

This was news to me. And pretty devastating; the thought of creating a fairly complex home screen from scratch in unmanaged code was daunting. If it is not obvious, I’m primarily a .NET developer. Don’t get me wrong, I have grass roots in C, but, the facts of life are that the lower level your programming language, the higher the development time and bug count.

So I quickly thought of a workaround though: create a managed service executable that hosts the UI framework. And using a combination of MessageWindows and sharing memory between processes, I could construct a bridge from unmanaged to managed code:

Implement IHomePlugin in unmanaged code and add that plug-in to the home screen. The unmanaged plug-in will do the following:

1. Create a pool of shared memory.
2. Create a back buffer HDC. This back buffer is what painted whenever the home screen requests a repaint. The managed code will write to this back buffer across process boundaries.
3. Whenever the PE_DATACHANGE event is received, invalidate the plug-in.
4. In the shared memory, write the HDC value, system colors, and plug-in dimensions.
5. Start my managed executable.

Once started, the managed executable does the following:

1. Gets the back buffer HDC and other relevant values from the shared memory pool.
2. Paint to the back buffer HDC.
3. Notifies the Home Screen API that a plug-in has had a data change event using SHOnPluginDataChange. This in turn causes the plug-in to invalidate and repaint from the back buffer.

That solves the painting issue, but the plug-in still needed to get key events from the Home Screen API and deliver them to managed code. Easy enough: the managed executable can create a MessageWindow and the unmanaged can deliver the key events provided by the Home Screen API. The managed code can then process the key event, repaint the back buffer, and invalidate the plug-in to refresh the screen.

This works great, but the catch with the API is that it delivers only left and right key presses. It won’t send up and down key events (because then the user can’t navigate to another plug-in on the home screen). However, since my plug-in was full screen, I did not matter. I needed a way to navigate vertically between elements laid out in my single full screen plug-in.

The solution to capturing all key events is a neat trick that native Win32 API developers are familiar with. Have the unmanaged plug-in subclass the home screen window (DesktopExplorerWindow as found in the VS Remote Spy++ tool) proc to steal the key presses and send them off to the managed code.

And there you go, a fully functional “managed” Home Screen Plug-In. My initial worry was that performance would suffer terribly from the cross process communication, but the home screen was actually very responsive. Users reported that the UI was quite “snappy”.

Unfortunately I don’t have any sample code to provide (yet), since this is all company IP. But maybe it will be released in the future!

Note: I should mention that Home Screen development actually gets easier with this interprocess communication. Developing a purely unmanaged plug-in means that the entire home.exe process needs to be stopped and started with every little change made to the plug-in. This can grow to be quite tedious. With the two-process model, starting and stopping the second managed process leaves the home.exe undisturbed.

Koushik Dutta
Software Engineer
www.koushikdutta.com

Sadly, I did not create an installer for this template.

Installation instructions (adjust your installation directory accordingly):

1. Unzip the contents onto your drive.
2. Copy CESetupDLL.ico, CESetupDLL.vsdir, and CESetupDLL.vsz to C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcprojects\smartdevice
3. Copy the Scripts and Templates folders into C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\VCWizards\SmartDeviceAppWiz\CESetupDLL
4. Edit CESetupDLL.vsz and edit the ABSOLUTE_PATH value to whatever you supplied in Step 3.

And that should do it! You will now find the new project template in Visual Studio under the Smart Device folder in Visual C++.

Koushik Dutta
Software Engineer
www.koushikdutta.com

However Scott, from scottandmichelle.net, successfully reverse engineered the HTCSensorSDK.dll. This allows developers to use the g-sensor that is available on the device. Very impressive work on the part of Scott!

Anyhow, I spent a portion of today writing a managed wrapper for HTC’s Sensor API. You can download it here. The code also includes a sample Teeter-esque type application which allows you to roll a ball around the screen.

The managed API exposes the HTCGSensor class which allows you to hook to query the state of the g-sensor on the device. It exposes the following methods, properties, and events:

GetGVector
Returns a vector that desribes the direction of gravity/acceleration in relation to the device screen.

• When the device is face up on a flat surface, this method would return 0, 0, -9.8. The Z value of -9.8 would mean that the acceleration in the opposite direction of the orientation of the screen.
• When the device is held standing up, this method would return 0, -9.8, 0. The Y value of -9.8 would mean that the device is accelerating in the direction of the bottom of the screen.
• Conversely, if the device is held upside down, this method would return 0, 9.8, 0.

The vector returned will have a length measured in the unit meters per second square.

Ideally the when the device is in a motionless state, the vector would be of length 9.8 (the gravitational constant). However, the sensor is not extremely accurate, so this almost never the case.

Orientation
Retrieves the current orientation of the device, returning one of the following enums: Landscape, ReverseLandscape, Portrait, ReversePortrait, FaceDown, FaceUp.

OrientationChanged
This event fires whenever the device’s orientation changes.

Enjoy, and let me know if you find any bugs!

Koushik Dutta
Software Engineer
www.koushikdutta.com

I hit 3 snags while working on this:

1. Build Service Setup and Permissions
2. Automatic versioning in the standard Major.Minor.Build.Revision style
3. Smart Device CAB files are not supported by MSBuild

Build Service Setup and Permissions

1. Set up Team Build on the Build machine (BuildMachine)
   1. Install Team Build
   2. Install Visual Studio 2008 on the machine as well, otherwise Compact Framework projects will not compile.
   3. Install the Windows Mobile 6 Professional and Standard SDKs, Visual Studio 2008 only ships with Windows Mobile 5 SDKs.
2. Make sure the Build Service account (TFSBuild) has full access and permissions to the share you are publishing (\\PublishMachine\Builds\…).
3. Create a Build Agent (only needs to be done once per server, and then is accessible to everyone). In Visual Studio, click Build, and type the server name (BuildMachine).
4. Create a Build Definition for your project
   1. In Team Explorer, under Builds, create a new Build definition. The wizard is very straightforward. Choose a location in the source tree, and choose a build configuration (Release). This will create a tfsbuild.proj file in the location you specified in the source tree. You will need to edit this file later on.
   2. Right click the build definition and perform a build. Verify it succeeded. You will notice that the build number is Ole Automation dated. Not very easy on the eyes.

Automatic Versioning

Microsoft has some generic MSBuild tasks available that can be used to handle this. They are a separate download from Visual Studio however. Here’s the relevant links:

• TFSBuild
• SDCTasks

1. Setting up your Solution
   1. Add the Microsoft.Sdc.Common.tasks and Microsoft.Sdc.Tasks.dll to the root of your solution. Using the ones provided by Microsoft actually caused me build errors for whatever reason. Some of the tasks they included were the cause. I have commented out all the tasks but those necessary to accomplish versioning. I have attached the .dll and the edited .tasks file to this blog.
2. Preparing the Version.xml File
   1. I have attached a sample Version.xml to this blog. Save this to a network share (preferably the same as the one being used when the Build definition was created). The task will reference this file to retrieve the current version, increment it, and save the new version back to the file.
   2. The build service account (TFSBuild) needs to have full permissions to this file. This file must not be read only.
3. Modifying the TFSBuild.proj
   1. Check the tfsbuild.proj file out for edit
   2. Add the following XML blob before the ending </Project> tag:

      1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

      <!-- This will retrieve and increment a version number from a file on a network share --> <import Project="$(MSBuildProjectDirectory)\Microsoft.Sdc.Common.tasks" /> <target Name="BuildNumberOverrideTarget"> <!-- Now update the version number --> <versionnumber .Update VersionNumberConfigFileLocation="\\emsea100\path\to\Version.xml" SkipSourceControl="true" OnlyIncrementRevision="true"> <output TaskParameter="VersionNumber" PropertyName="BuildNumber" /> </versionnumber> </target>   <!-- This will replace all version numbers in the assemblyinfo.cs files with the one from the share --> <!-- This target is called after Team build gets all the source files from TFS. --> <target Name="AfterGet" DependsOnTargets="VersionAssemblies" />   <target Name="VersionAssemblies"> <!-- Get the Assembly Info files.--> <createitem Include="$(SolutionRoot)\**\AssemblyInfo.cs;"> <output TaskParameter="Include" ItemName="AssemblyInfos"/> </createitem>   <!-- Update the version numbers --> <file .Replace Force="true" Path="%(AssemblyInfos.FullPath)" NewValue="AssemblyVersion(&quot;$(BuildNumber)&quot;)" regularExpression="AssemblyVersion\(\&quot;(\d+.\d+.\d+.\d+)\&quot;\)" ignoreCase="true" /> </target>

   3. Edit the VersionNumberConfigFileLocation value to be configured for your publish machine and directory. You can also change the OnlyIncrementRevision to false so that the build number also gets autoincremented.

Building a Smart Device CAB Project Using MSBuild

There is no “good” way to do this. I did this by creating a standard Smart Device CAB project, and then building it on my development machine. If your project is called SmartDeviceCab, in the SmartDeviceCab\Debug folder, there is a SmartDeviceCab.inf file. That file can be used as input to CabWiz.exe to create the file from a command prompt. I will be using the INF file of our recently released tool, Device IP Utility, as an example.

1. Solution Setup
   1. Copy the EMIPUtil.inf file to the solution root folder.
   2. Right click the solution and add existing file: %SolutionRoot%\ EMIPUtil.inf
2. Modifying the INF file
   1. The INF file will contain a section of absolute paths to the location of the binaries on the development machine. This needs to be changed to absolute paths on the build machine. Note that all the binaries on the build machine will be dumped into the same directory, making it relative easy to edit. The first INF file shows what the file may look on your development machine, and the second will show how it should look on your build server.
      1. Old Paths Local to Your Development Machine

         
         1=,”Common1″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\EnterpriseMobile.WindowsMobile.IPUtil\bin\Release\”
         2=,”Common2″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\EnterpriseMobile.WindowsMobile.IPUtil\obj\Release\”
         3=,”Common3″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\EnterpriseMobile.WindowsMobile.Utilities\bin\Release\”
         4=,”Common4″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\EnterpriseMobile.WindowsMobile.Utilities\obj\Release\”
         5=,”Common5″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\WMIPUtil\obj\Release\”
         6=,”Common6″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\WindowlessControls\bin\Release\”
         7=,”Common7″,,”C:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\WindowlessControls\obj\Release\”
         8=,”Common8″,,”c:\Users\kdutta\Documents\Visual Studio 2008\Projects\Device IP Utility\Device IP Utility - Production\EnterpriseMobile.WindowsMobile.IPUtil.Interop\Windows Mobile 5.0 Smartphone SDK (ARMV4I)\Release\”
         

      2. New Paths on Build Machine

         
         1=,”Common2″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         2=,”Common3″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         3=,”Common4″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         4=,”Common5″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         5=,”Common6″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         6=,”Common7″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         7=,”Common8″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         8=,”Common9″,,”C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries\Release\”
         

3. Making MSBuild call CabWiz.exe
   1. Check out and edit the tfsbuild.proj file
   2. Before the ending </Project> tag, insert the following:

      1 2 3 4 5 6

      <!-- This will build a CAB file from an .inf file --> <target Name="BeforeDropBuild" DependsOnTargets="MakeCAB"/> <target Name="MakeCAB"> <message Text="Building a CAB file" Importance="normal"/> <exec Command="&quot;C:\Program Files\Microsoft Visual Studio 9.0\SmartDevices\SDK\SDKTools\cabwiz.exe&quot; &quot;C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Sources\EMIPUtil.inf&quot; /compress /dest &quot;C:\Documents and Settings\TFSBuild\Local Settings\Temp\Device IP Utility\Device IP Utility - Production\Binaries&quot;"/> </target>

   3. Modify the following Command Attribute to be set up specifically for your build machine. This defines the path to CabWiz.exe, the path to your INF file, and the output directory of the CAB file.
   4. This XML insert calls the CabWiz.exe prior to publishing the binaries. CabWiz.exe adds the CAB file to the binaries folder, which in turn gets published with everything else.

Sadly there is somewhat poor support for Smart Device Projects in TFSBuild, so making it work isn’t exactly elegant, but it works!

Koushik Dutta
Software Engineer
www.koushikdutta.commicrosoftsdccommon

DPAPI provides easy-to-use functions for encryption and decryption.  A number of applications use DPAPI.  The thing that makes DPAPI easy to use for developers is that they don’t have to wite all the key generation and key management code that typically goes with any encryption solution.  DPAPI uses a master key that is stored in the memory of the device.  When an application calls DPAPI, the same master key is used to generate symmetric keys for all encryption and decryption operations.  In this way, the application does not have to generate or manage the encryption key used.  For a thorough description of DPAPI see the MSDN article covering Windows Data Protection

Of course, this begs the question, “How is the master key protected?” The master key is encrypted itself at the time it is generated.  And, it is decrypted at system boot time.  It must be decrypted for use during boot in case an encrypted file is loaded during the boot process. The key used to decrypt the master key is derived from a password and used during boot.  In Windows Mobile, there are 2 master keys, the “user” master key and the “system” master key.  The “system” master key is encrypted using a key derived from the system “password” which is a mixture of system information.  The “user” master key is typically derived from a user password. 

The “user” master key is considered more secure then the “system” master key because the entropy used to encrypt it includes information only the user knows (i.e., their password).  The “system” master key is more flexible though because the system does not need to go get input from the user.

The “user” master key on WM 6.1 is derived from the Windows Mobile device lock PIN or password that is entered by the user during device boot.  Therefore, when you enable encryption on a device, the user must configure a PIN/Password, if not already configured. 

Note that the encryption of data written to storage cards in Windows Mobile 6.0 and later also uses DPAPI, but with the “system” master key rather then the “user” master key.  This is a lot less of an issue for removable storage card encryption then for main memory file encryption.  The primary attack on the “system” master key requires access to the system used to create it and typically,the attack on the removable storage card is mounted from a different computer that the lost or stolen removable storage card is inserted into.

btw, the default encryption algorithm used since Windows Mobile 6.0 for DPAPI is AES-128.  Prior to Windows Mobile 6.0, DPAPI utilized RC4.

Dave Field, CISSP, MCP
Device Management and Security Architect
Enterprise Mobile, Inc.

The beauty of anonymous methods is that the compiler’s syntactic sugar handles a lot of the aforementioned for the developer very elegantly in the background.

Here’s what a fully asynchronous download looks like now, with error handling and cleanup and all (5 anonymous methods in total):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

HttpWebRequest req = WebRequest.Create("http://www.google.com") as HttpWebRequest;
MemoryStream memStream = new MemoryStream();
HttpWebResponse resp = null;
 
// anonymous method to handle cleanup
EventHandler Cleanup = (s, ev) =>
    {
        using (resp)
        {
        }
        resp = null;
        using (memStream)
        {
        }
        memStream = null;
    };
 
// anonymous method to handle errors
EventHandler Error = (s, ev) =>
{
    MessageBox.Show((s as Exception).Message);
    Cleanup(null, null);
};
 
req.BeginGetResponse(responseResult =>
    { // anonymous method that waits for a response from the web server
        Thread.Sleep(1000); // for asynchronous testing
        try
        {
            resp = req.EndGetResponse(responseResult) as HttpWebResponse;
            Stream responseStream = resp.GetResponseStream();
            byte[] buffer = new byte[1024];
            AsyncCallback rc = null;
            rc = readResult =>
                { // anonymous method that waits to read a some data from the web server
                    Thread.Sleep(1000); // for asynchronous testing
                    try
                    {
                        int read = responseStream.EndRead(readResult);
                        if (read > 0)
                        {
                            memStream.Write(buffer, 0, read);
                            responseStream.BeginRead(buffer, 0, buffer.Length, rc, null);
                        }
                        else
                        {
                            // We finished downloading! Invoke the UI thread to print the data!
 
                            // anonymous method to handle completion
                            EventHandler Done = (s, ev) =>
                            {
                                memStream.Seek(0, SeekOrigin.Begin);
                                string blob = new StreamReader(memStream).ReadToEnd();
                                Cleanup(null, null);
                                MessageBox.Show(blob);
                            };
 
                            Invoke(Done);
                        }
                    }
                    catch (Exception ex)
                    {
                        Invoke(Error, ex);
                    }
                };
            responseStream.BeginRead(buffer, 0, buffer.Length, rc, null);
        }
        catch (Exception ex)
        {
            Invoke(Error, ex);
        }
    },
    null);