Windows Mobile 6.5 Software Signing Requirements

This article provides an overview of the software signing requirements enforced by Windows Mobile 6.5, detailing its security architecture, certificate authority structures, execution roles, and how carrier or original equipment manufacturer (OEM) policies determined whether an application could run on a device.

The Security Architecture and Execution Roles

Windows Mobile 6.5 inherited and refined the security framework introduced in Windows Mobile 5.0 and 6.0, which was built around the principle of role-based access control and Microsoft Authenticode technology. The operating system categorized all native applications (.exe) and dynamic link libraries (.dll) into two primary execution trust tiers:

  • Privileged Role: Applications granted this status had unrestricted access to system APIs, the system registry, core communication layers (such as the Radio Interface Layer or RIL), and device hardware. To run in this tier, binaries had to be signed with a digital certificate rooted in the device's Privileged Execution Trust Authority (ETA) certificate store.
  • Unprivileged (Normal) Role: Applications in this tier ran in a sandboxed, restricted capacity. They could not modify critical operating system files, alter secure registry hives, access specific telephony APIs, or install privileged drivers. Applications signed with certificates from the Unprivileged ETA or standard trusted third-party root authorities were assigned to this tier.

Authenticode and Certificate Stores

Code signing in Windows Mobile 6.5 relied on standard public key cryptography (PKCS #7) using X.509 digital certificates. Windows Mobile devices maintained dedicated certificate stores that dictated execution permissions:

  • Privileged Execution Trust Authority: Contained root certificates from Microsoft, the device OEM, and mobile network operators.
  • Unprivileged Execution Trust Authority: Contained certificates for general software developers, including certificates issued via the Microsoft Mobile2Market program or the Windows Marketplace for Mobile.
  • SPC (Software Publisher Certificates): Standard commercial software signing certificates (such as those issued by VeriSign or Thawte) used for identity verification.

Both the application binaries (.exe, .dll) and the cabinet installation files (.cab) were subject to signing. Signing the CAB file ensured the integrity of the installer and allowed the setup process to modify system-level configurations if signed with a privileged certificate.

OEM and Mobile Operator Security Policies

While Windows Mobile 6.5 established the technical framework for code signing, the strictness of enforcement was governed by the device's security policy configuration. These policies were configured by OEMs and carriers via Provisioning XML (OMA Client Provisioning):

  • Open Policy: The device permitted unsigned applications to run. When an unsigned application was launched, the system presented a security prompt asking the user to confirm whether they trusted the unknown publisher. If accepted, the application ran in the unprivileged role.
  • Prompt/User-Approval Policy: Any application not signed by a trusted authority prompted the user before execution. Some carriers configured this to only allow signed code, prompting only when an unprivileged certificate was encountered.
  • Restricted (Locked) Policy: Common on enterprise deployments and carrier-branded smartphones, this configuration completely blocked unsigned applications from running. Only binaries signed with a recognized certificate residing in the device's ETA stores could execute; all other executables failed silently or triggered an "Access Denied" or "Installation failed" error.

Windows Marketplace for Mobile Requirements

With the release of Windows Mobile 6.5, Microsoft integrated the Windows Marketplace for Mobile as the primary distribution hub. Applications submitted to the Marketplace were required to pass through Microsoft’s code signing pipeline. Microsoft ingested the developer's binaries, performed testing, and signed the final packages with Microsoft's own Marketplace root certificate, ensuring that the software would seamlessly install and run on any retail Windows Mobile 6.5 device regardless of carrier-specific locking.