Oh… please make it stop!

I was recently challenged by trying to collect retail device data and needed a way to stop Hopper. I was running on a standalone device and an unexpected error dialog popped up and Hopper dismissed the dialog before I could take a look. The documentation says I can us the /k option to stop Hopper, but it occurred to me this will only really help me when connected to a debugger. The documentation also states that I can use /txxx to limit Hopper to a certain time, but there is no way to retroactively set this time without starting over.

What I needed was a “kill switch” for Hopper to let me investigate while the problem was occurring, I needed a way to stop Hopper in its tracks. The process is fairly simple if you have a little insider knowledge and the ability to sign binaries. Copy the below sample code, build into a trusted executable and autorun from an SD card to relieve your system of Hopper:

//------------------------------------------------------------------------------

// The following sample code 'snippet' is provided 'as is' without

// warranty of any kind either expressed or assumed. No copyright,

// ownership, or any other claims should be made for this code.

//------------------------------------------------------------------------------

#include "windows.h"

#define STOP_HOPPER_MUTEX TEXT("MTTF Test Mutex")

INT WINAPI WinMain(

    HINSTANCE hInstance,

    HINSTANCE hPrevInstance,

    LPWSTR lpCmdLine,

    INT nCmdShow )

{

    HANDLE hMutex;

    if( ! (hMutex = CreateEvent(NULL, FALSE, FALSE, STOP_HOPPER_MUTEX)))

    {

        OutputDebugString(TEXT("ERROR: could not create Hopper Mutex"));

        return 1;

    }

    // Signal Hopper to stop

    SetEvent(hMutex);

    CloseHandle(hMutex);

    return 0;

}

It may take a few seconds for Hopper to respond to the event, but soon device control will return to the user. Please note that using the above will stop Hopper and Hopper will unload – it is not a “pause” event.