How Windows Mobile 6.5 Handled Autorun.exe

Windows Mobile 6.5 managed automatic execution from memory cards through a legacy mechanism inherited from Windows CE, relying on architecture-specific folders and predefined event triggers. When an external storage card was inserted, the operating system scanned for designated executable files, evaluated security policies and digital signatures, and executed the payload with specific command-line parameters based on the device's state.

The Architecture-Specific Directory Structure

Windows Mobile 6.5 did not execute arbitrary files placed directly in the root of a memory card. Instead, the OS scanned the root of the card for a directory matching the numerical processor code of the device.

For virtually all Windows Mobile 6.5 devices, which ran on ARM processors, the system looked for a directory named 2577 (the processor architecture ID for ARM). The structure required the executable to be placed precisely at:

\Storage Card\2577\autorun.exe

If the operating system detected this specific path upon mounting the storage media, it initiated the autorun procedure.

Execution Flags and Life Cycle Triggers

The execution of autorun.exe was driven by insertion and removal events. Windows Mobile passed contextual command-line arguments to the application depending on the action taken:

  • Card Insertion: When the card was plugged in, the shell executed autorun.exe install. This signaled software installers or setup routines to initiate deployment.
  • Card Removal: When the card was removed (if the process had registered clean unmounting procedures or prior cache hooks), the system could call the executable using autorun.exe uninstall to clean up temporary files and registry entries.

Security and Code-Signing Enforcement

Because Windows Mobile 6.5 incorporated enhanced security models compared to older Windows CE versions, autorun.exe was subject to device security policies:

  • Unsigned Binaries: If an uncertified or unsigned autorun.exe was executed, the OS displayed a security prompt alerting the user that the publisher was unknown, requiring manual confirmation to proceed.
  • Locked Devices (Enterprise/Carrier Security): On devices enforcing strict security configurations (such as Mobile Device Management policies or carrier-locked two-tier trust models), unsigned executables were blocked entirely. Only applications signed with a trusted certificate present in the device's root certificate store were permitted to run.

Disabling Autorun via Registry

OEMs, enterprise administrators, and power users could disable the automatic execution behavior entirely to mitigate security risks. Windows Mobile 6.5 controlled this behavior via the Windows Registry. Modifying or adding the Flags or Disable values under the autorun registry path—typically located within [HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\Autorun]—allowed devices to bypass detection completely, preventing untrusted code from launching automatically when an SD or microSD card was mounted.