Trusted Environment Creation (Windows Embedded CE 6.0)


Windows Embedded CE powered devices send, receive, and process information that requires protection from potentially unsafe applications. To protect your device, you can implement security measures that prevent the operating system (OS) from loading unknown modules, restrict access to system application programming interfaces (APIs), and prevent write access to parts of the system registry. The kernel uses this information to prevent unauthorized applications from loading or limits their access to the system.


Threads in privileged applications can use any thread priority. For more information about thread priority levels in Windows Embedded CE, see Real-Time Priority System Levels.

To create a privileged environment, you must disable full-kernel mode by setting the second bit of ROMFLAGS in the Config.bib file for the Windows Embedded CE-based run-time image. Depending on what other flags are set, the value of ROMFLAGS might vary. In Windows Embedded CE 6.0, OEM_CERTIFY_RUN is no longer supported. The OS either fully trusts the calling process and loads the module, or it does not.

In Windows Embedded CE 6.0, OEMCertifyModule is no longer supported. For information about how to implement module trust in CE 6.0, see Windows Embedded CE 6.0 Security Model.

In This Section

  • Signature Creation
    Provides information about creating a digital signature from a file by using Signfile.exe.
  • Object Store Security
    Describes how the object store provides several elements of security in a trusted environment.

See Also

Other Resources

Enhancing the Security of a Device
Full-Kernel Mode
.cab File Signing Requirements