itsutils

itsme — Sun, 01 Jun 2008 21:56:00 GMT

itsutils is a set of tools that make life of the windows ce hacker easier. for instance, with pmemdump you can inspect the memory of the kernel or running processes.
with 'psetmem' you can modify memory
with pregutl you can read or change the devices register.
with pmemmap you can get a quick overview of what physical memory is mapped where.
with pps you can get a list of processes, threads or modules.
with pdocread, pdocwrite you can read disk-on-chip flash chips.
with psdread, psdwrite you can read/write sdcards.
with ppostmsg you can send windows messages to windows, or list all windows on the device.

memdump, setmem, regutl, postmsg, sdread and sdwrite are win32 versions of these tools that do the same thing on your normal windows machine.

other tools: prapi, to change settings using the configapi, like certificates, registrykeys, metabase entries.

pget, pput, pdel, pdir, pmkdir can be used to copy from/to, delete, list files, or create directories.

prun and pkill can be used to start or stop processes
preboot remotely reboots your device.

then there is dump, which is a universal hexdump tool.
this is all described on this page. you can leave remarks here on this blog.

strange byte sequence in arm binaries

itsme — Fri, 21 Mar 2008 22:17:00 GMT

00000000 00004033 00444101 09401050 00004005 00534c01 09401050 00002078
00534c01 802910ec 0000c0f0 00534b01 812910ec 00000000 00545204 813910ec
0000900b 00545204 813910ec 0000d0c9 00545204 813910ec 0000e04c 00545204
13001186 000050ba 004c4404 0020100b 0000a0cc 00474e05 905010b7 00006008
00433306 920010b7 00000476 00433306

these 0x90 bytes ( or 0x24 dwords ) occur often in windows ce arm binaries

does anyone know what it is for?
my guess is that it is some kind of padding between static data sections of different modules.

another one is

85E0B100 11D104FA A000DAB7 D64803C9

that also seems to occur in many binaries without obvious reason.

igorsk found out that the first block is defined in halether.h - EdbgVendorIds