How to Disable Signature Checks in Windows Mobile 6.5

This article provides an overview of how users and developers historically disabled application signature checks—commonly known as "application unlocking"—on devices running the legacy Windows Mobile 6.5 operating system. By modifying specific system policies within the Windows CE registry, users could bypass the restriction that required all executable binaries and installation packages to be digitally signed by a trusted certificate authority.

The Role of Security Policies in Windows Mobile 6.5

Windows Mobile 6.5 utilized a role-based security model implemented via the device registry. By default, devices were often locked down by network operators or OEMs to run only privileged, signed code. Disabling signature checks required elevating the execution tier to allow unsigned or unprivileged code to run without throwing certificate or trust errors.

Modifying the Registry to Disable Signature Checks

To bypass signature verification, users needed a mobile registry editor (such as Mobile Registry Editor via an ActiveSync desktop connection, or an on-device editor like PHM Registry Editor). The following registry keys under HKEY_LOCAL_MACHINE\Security\Policies\Policies controlled the execution policies:

  1. Query Policy (00001001)

    • Path: HKLM\Security\Policies\Policies\00001001
    • Type: DWORD
    • Value: Change to 1
    • Description: Allows the execution of unsigned applications. A value of 1 (or in some configurations 2) permits the execution of binaries that lack an embedded digital signature.

  2. Unsigned CAB Installation Policy (00001005)

    • Path: HKLM\Security\Policies\Policies\00001005
    • Type: DWORD
    • Value: Change to 40 (Decimal) or 28 (Hexadecimal)
    • Description: Governs how the operating system handles unsigned .cab (cabinet) installation archives. Setting this allows the package manager to install unsigned applications.

  3. Prompt Behavior Policy (00001017)

    • Path: HKLM\Security\Policies\Policies\00001017
    • Type: DWORD
    • Value: Change to 144 (Decimal) or 90 (Hexadecimal)
    • Description: Suppresses the security warning dialogs that appear when launching unsigned software, enabling execution without confirmation prompts.

Applying Changes via Provisioning XML (.provxml)

Alternatively, administrators and developers could deploy these registry modifications using a Configuration Service Provider (CSP) provisioning XML file. By packaging the XML into a .cab file or placing it in the device's \Windows\ directory during a reboot, the operating system's Configuration Manager would parse and apply the rules:

<wap-provisioningdoc>
  <characteristic type="SecurityPolicy">
    <parm name="4102" value="1"/>
  </characteristic>
  <characteristic type="Registry">
    <characteristic type="HKLM\Security\Policies\Policies">
      <parm name="00001001" value="1" datatype="integer"/>
      <parm name="00001005" value="40" datatype="integer"/>
      <parm name="00001017" value="144" datatype="integer"/>
    </characteristic>
  </characteristic>
</wap-provisioningdoc>

Finalizing the Configuration

After updating the registry entries or executing the provisioning script, a device restart (soft reset) was required to reload the security manager and enforce the new execution privileges, allowing any unsigned executable to run freely on the system.