You’ve installed a new application and, now, can’t boot in your Pocket PC? Ever wondered how you can boot into a Safe Mode simil

1. A quick (executive) summary

If you don’t want to read the article in its entirety (I DO recommend the latter – it contains a LOT of never-before-published tips and plain English explanations of what is happening behind the scenes!), here’s what you should do:

1. depending on your preferences, get either Spb Pocket Plus or iLauncher, install it
2. if you encounter boot-in problems (the device wouldn’t boot after installing a new application and resetting the device), make sure you quickly (in less than one minute after the first reset attempt) reset the device so that the Safe Mode boot message is triggered and displayed
3. when the above-mentioned message is displayed, tap the screen area; Spb Pocket Plus / iLauncher will boot in Safe Mode
4. now, simply go to Settings/System/Remove Programs and remove the application
5. finally, click the “Reset” button on Spb Pocket Plus / iLauncher. It’ll reboot in the standard (non-safe) mode – now, without the offending application.

1.1 Non-bootable Pocket PC’s?

However much the Windows Mobile operating system is much safer than many desktop operating systems, there may be cases when things just go wrong and you just won’t be able to boot in: after resetting the device, it will just hang at the boot splash screen.

This is particularly true of cases when you install new software. There are some well-known software products (or unlucky combinations of them) that are bound to cause sometimes severe, reset-time problems. Just two of the well known “dangerous” cases:

1. some old(er) ThinkOutside StowAway drivers (for example, version 4.3) installed on some specific Pocket PC models (for example, the Fujitsu-Siemens Pocket Loox 720): after the (self)-reset upon installation, the device, in general (particularly if you don’t enable Bluetooth before starting the install), most probably just hangs and not even subsequent resets help in most cases.
2. trying to install the two great Pocket Internet Explorer / Internet Explorer Mobile plug-ins MultiIE and PIEPlus on the same time (not all the time, mostly when it’s not a clean device). In these cases, if you’re unlucky enough, the device is rendered unbootable and you will need to do a hard reset if there are no other chances to make it work again. (Note that alone these plug-ins cause no problems at all. Also note that this is the case with all the versions I’ve tested – even the latest ones.)

In this article, I explain how, with which applications you can fight all these problems. First, I provide a generic overview of the booting sequence of the Windows Mobile operating system so that you know where things can go wrong. Note that you don’t need to understand it: if you don’t, it’s no problem, you will still understand the rest of this article. However, it casts light on a lot of issues discussed in the article and, therefore, is highly recommended.

2. The booting sequence

In this section, I explain the sequence the Windows Mobile operating system executes software during booting in. Software also means third-party software – that is, software like the above-mentioned MultiIE, PIEPlus or the StowAway unified driver. Note that I don’t explain how system software is booted in as it’s irrelevant in this case: I only pay attention to explaining how third-party software is executed. Again, it’s user-installed third-party software that causes unbootability problems.

2.1 HKEY_LOCAL_MACHINE\ init\

The first place Windows Mobile can run into user-installed software is the executable list stored in the Registry, under the HKEY_LOCAL_MACHINE\ init key. (I’ll also refer to HKEY_LOCAL_MACHINE as HKLM.)

This list (to put it simply) contains values named LaunchX with the value of an EXE file contained in \Windows. The name, LaunchX, ends in a number (here, denoted by an X); in general, it’s between 1 and 80…90 and can take any value in between. The smaller the number, the more early the execution of the given application. For example, if, say, the systems executable gwes.exe is Launch30 and, say, the third-party executable SafeMode.exe is Launch49, then, you can be sure it’s gwes.exe that executes first and only after this follows the execution of SafeMode.exe.

2.1.1 HKEY_CLASSES_ROOT\CLSID DLL’s

In this section, not only direct execution is possible: it’s also now that the (executable), in the HKEY_CLASSES_ROOT\CLSID (I’ll also refer to HKEY_CLASSES_ROOT as HKCR) section registered DLL files are (indirectly) executed. For example, both MultiIE and PIEPlus (as far as the current versions are concerned; older versions still used the “traditional” \Windows\ Startup directory to start them) are initialized this way.

This also means you can only avoid problems caused by DLL’s listed under HKEY_CLASSES_ROOT\CLSID if you use a Safe Mode application that is loaded before the latter DLL’s are loaded. Only Safe Mode applications that are loaded in the first stage (that is, from HKEY_LOCAL_MACHINE\ init) are capable of this – in our case, Spb Pocket Plus only.

2.1.1.1 Third-party Software Input Panels

Third-party Software Input Panels (SIPs for short) may also cause lock-up problems. Therefore, it may also be advantageous for a Safe Mode application to disable all the non-standard SIP’s to allow for booting in the device. SIP’s are also stored under HKEY_CLASSES_ROOT\CLSID and are a special class of executables.

2.2 HKEY_LOCAL_MACHINE\ Services

After the HKEY_LOCAL_MACHINE\ init executable files and the HKEY_CLASSES_ROOT\CLSID DLL’s have been loaded / initialized, the operating system loads the services listed in HKEY_LOCAL_MACHINE\ Services, also in the Registry.

In addition to systems applications and services (for example, the OBEX driver), many Today plug-ins (for example, two of the reviewed Safe Mode applications, the non-Safe Mode related services of Spb Pocket Plus etc) and drivers (for example, the ThinkOutside drivers) register themselves in there. Therefore, it’s essential to have a Safe Mode application that is able to disable at least third-party applications in this section. Fortunately, all the available Safe Mode applications are capable of this, unlike with stopping the execution of the above-discussed executable third-party apps.

2.3 \Windows\ Startup

The most widely known place that contain autostart applications is the \Windows\ Startup directory in the file system. Not the Registry: it’s the only stage of loading third-party applications that they are directly stored in the file system. Many (much more than in the first three cases) applications are started from here (for example, the StowAway auto-starting configuration dialog after the install). Therefore, it’s essential for a Safe Mode application to disable all the applications that are stored or linked from \Windows\ Startup.

2.4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Today

Finally, the Today plug-ins are loaded. Their list is stored in the Registry, under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Today key.

2.5 A quick note on the DB_notify_events database

Note that the “NOTIFICATION_EVENT_WAKEUP”, that is, the “The device woke up” event (which is sent via CeEventHasOccurred) is only sent when the device is powered up, NOT after a soft reset (there is no “callback after a soft reset” notification in WindowsCE as can also be seen in here).

This means Safe Mode applications need not disable any kind of events in DB_notify_events. (See Why ActiveSync- or Remove Programs-based uninstalling may not be sufficient? for more information on this database if interested. Note that as of version 2.0+ and 4.1+ (respectively), Skype and eWallet no longer register themselves in DB_notify_events.)

3. How do Safe Mode software products work?

3.1 Invocation, auto-timing

They are in common in that they ask the user whether he or she wants to boot into “safe mode”. To do this, the latter needs to either tap the screen (in a given region) or press a given hardware button (with one of the applications, mCube, this can be even configured; with the two other applications, only the Action button can be used for this.)

Two of the Safe Mode applications also offer a really decent feature: timing features. This mean they only present a “do you want to boot into safe mode” message if the last reset was less than one (with Spb Pocket Plus) or two (with iLauncher) minutes ago. Particularly with Spb Pocket Plus, where displaying the dialog may, on some (not all!) Pocket PC models, mean a six-seven-second long additional pause in the booting sequence, this is a big advantage over the “message is always displayed” case.

In most cases, using the timing feature will prove really useful. After all, if you have boot-time incompatibility problems, you are likely to reset your device quickly one after another. Even with the slowest-to-boot WM5 devices, this may mean consequent resets in under one minute. While Safe Mode apps operated in this mode won’t display the switch message (and won’t actively listen to the user input) during the first reset, they will do so upon encountering the second if it’s done really soon (as you would do when struggling with un-bootability problems).

3.2 Renaming / moving files and/or Registry keys/values

When the user instructs the given Safe Mode application to boot into Safe Mode, it, after doing some housekeeping (of which I’ll elaborate in this very section), it restarts (soft resets) the device again – now, already in Safe Mode.

To understand what happens during this is actually very easy and logical, particularly if you look at what two (mCube, iLauncher) of the three Safe Mode applications do. That is, they just move away the links/ executables from \Windows\ Startup to another directory in the file system and modify the Registry (SIP’s, Today plug-ins and HKLM\ Services) so that the system won’t be able to access these. Then, they just reboot the PC and let it just boot in as if it booted normally – now, without additional SIP’s, Today plug-ins, \Windows\ Startup applications and HKLM\ Services; that is, the potentional harmdoers. This means it’s only with very few cases that the device remains unbootable (again, the MultiIE + PIEPlus (HKCR/CLSID) case, where only Spb Pocket Plus is usable).

As soon as you’ve finished fixing the problems (for example, with the StowAway drivers, just manually starting the Bluetooth unit of your Pocket PC and, then, manually starting the StowAway application – this will fix everything), you just instruct these applications (by clicking their Reset buttons or other, designated screen areas) to move back all the links and executables to \Windows\ Startup in the file system and restore all the original registry values / keys from the backup (which you may already have modified) and just restart the machine.

Note that if you don’t use the Reset facility of the Safe Mode applications but directly reset the PDA (you shouldn’t do this, but, as is explained here, it won’t cause problems), they will notice (during the next reboot) this and will restore them. Notice that, in this case, you may end up having to re-reset the device again. (I’ve also thoroughly tested and elaborated in the comparison chart on this.)

Using a backup copy of these settings also means you should NEVER uninstall iLauncher or mCube while it’s in Safe mode; it’ll never restore your “unsafe” SIP / \Windows\ Startup files/ Today / HKLM\ Services settings and you’ll end up having to restore them yourself by hand, which isn’t easy for a newbie.

Note that Spb Pocket Plus, as opposed to the two other applications, does not rename / move files / registry values around. It uses much more sophisticated techniques to avoid loading unneeded, third-party boot-time stuff. This also means you don’t need to know how it modifies these values in order to be able to manually clean them up.

3.3 Cleaning up the device

Now that we know where the most “problematic” references are stored, let us have a look at whether these applications have built-in support to access these areas or you’ll need an external registry editor and a file explorer to make the cleanup.

One of the applications, mCube, contains a GUI that lists all these areas (except for HKLM\ init and non-SIP HKCR\CLSID stuff). That is, with it, you can use its (excellent) GUI to review all the potentially dangerous links or registry entries and can even delete them by hand.

Of course, the Settings/System/Remove Programs is the best way to do this, particularly with Registry entries. Note that, however, as mCube and iLauncer will copy back a saved file system/registry snapshot when you instruct them to reboot, some dead links may remain if you use Remove Programs. In this respect, Spb Pocket Plus’ backup-less solution is the best: Remove Programs will directly remove all the associated links / references and, consequently, you won’t run into ‘dangling link’ problems after a reboot.

The two other applications don’t offer any GUI like that of mCube. However, as most problems can (and, because of the high number of inter-related files and Registry entries, should) be fixed by simply using Settings/System/Remove Programs, this isn’t a problem.

4. Safe Mode software

4.1 Spb Pocket Plus

(tested, current version: 3.1.2)

As far as Safe Mode functionality is concerned, this application is definitely the best. It’s better than the mCube app in that it’s also WM5-compatible. It’s also excellent in that it’s able to avoid loading HKCR\ CLSID classes (unlike the other two alternates): for example, this is why it’s the only application that offers MultiIE + PIEPlus clash-resolving capabilities.

Note that it doesn’t have full HKLM\ init filtering capabilities (I’ve tested this pretty thoroughly): if a misbehaving third-party program registers itself in HKLM\ init, not even Spb Pocket Plus will be able to boot in. Fortunately, very few applications register themselves in there and their number is constantly decreasing, particularly because of my article published a year ago on the matter (alternates: MobilitySite, AximSite, PPC Magazine, FirstLoox, BrightHand). For example, the latest version(2.98 and 1.65, respectively) of neither XCPUScalar nor Mad Programmer’s ForceHiRes register themselves in this section any more (but in the “traditional” \Windows\ Startup instead). (Note that, consequently, I needed to use version 1.51 of ForceHiRes, which still does this, in my current tests to find out more about real HKEY_LOCAL_MACHINE\ init protection.)

This application has some disadvantages too. The most important is, as opposed to the two other apps, is the slightly increased boot time on some (not all!) Pocket PC models. On the WM2003SE F-S Pocket Loox 720, for example, the boot-in time is extended by six to seven seconds with always-on Safe Mode boot-time prompt; that is, if it is configured to actively ask the user whether the latter wants to switch to safe mode. By default (if you use the timer-dependent, default mode), there will be no additional waiting – that is, it’s highly preferable to use Spb Pocket Plus’ default Safe Mode setting, which only offers the (and, therefore, incurs the 6-7-second penalty) user the possibility of rebooting into Safe Mode if the last soft reset was less than a minute ago.

Note that there are no delay problems on some other devices; for example, the Dell Axim x51v . With ROM version A12, it boots in about 32 seconds, with both Safe Mode prompt disabled and enabled. That is, you will want to measure the boot time of the application on your particular PPC model to see whether you want to enable the always-on prompt or leave it at the default, timer-only mode to speed up the booting process.

It has no GUI to edit the contents of \Window\Startup or the Registry. However, this isn’t a big problem as in most cases you’ll just uninstall the misbehaving program, where the backup-less architecture of Spb Pocket Plus will really pay off in having no further problems of dangling, “dead” links.

4.2 iLauncher

(tested, current version: 3.0)

The brand new version of SBSH’s excellent Today launcher iLauncher also has support for Safe Mode.

Its Safe Mode capabilities are pretty good but, unfortunately, not as good as that of Spb Pocket Plus (read: there is no HKCR\ CLSID protection). However, it's still a good choice, particularly if you, generally, prefer it as a complete Today launcher and task manager solution to Spb Pocket Plus. I'll publish a complete comparison of the two applications in this respect later.

4.3 mCube's SafeMode

(tested, current version: 1.02. Note that mCube’s site is down for maintenance; it’s available here)

This free and, unfortunately, WM2003(SE)-only application was the first on the Pocket PC to deliver real Safe Mode.

In some respects, it’s certainly better than the two alternates (most importantly, the price (free), the GUI, the ability to assign any hardware button to it etc). It, however, is clearly worse than Spb Pocket Plus as far as HKCR\CLSID DLL file loading is concerned (and, of course, it isn’t WM5-compliant).

Therefore, while its price can’t be beaten, I recommend both Spb Pocket Plus and iLauncher over it – particularly for WM5 users.

5. The comparison chart is HERE (click the link to see the chart!)

5.1 Explanation for the chart

There isn’t much to explain here as the contents of this chart should already be clear if you understand Chapter 2 of the article.

6. Verdict

If you want to have the absolutely best solution, go for Spb’s Safe Mode. It, being loaded on the first real occasion, offers far better protection against bad-behaving programs than the other solutions.

If you don't want / need protection against misbehaving, HKCR \ CLSID-registered applications and/or would prefer iLauncher's capabilities over those of Spb Pocket Plus, go for the former - it's a very good application too and, as has already been pointed out, there are very few HKCR \ CLSID-based, "problematic" applications.

UPDATE (12/24/2006): mCube's SafeMode 2, with WM5 compliance and REALLY enhanced protection, is out; read the story here

UPDATE (04/12/2007): As has been explained above, it's not possible to pass parameters to programs started from HKLM\init. XDA-Developers user baniaczek has just fixed this problem by providing a third-party tool taht does this. Check out his thread here for more info / the download.