yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] Jaxbot:
Can you expound upon this? Are you talking about USB deploying or something else? From what I can tell, you can't deploy packages to the phone without it being dev unlocked. In fact, not even reading data from the device is possible to this extent. Or are you talking about something else?

Thanks ;)
[Windows Phone 7 Development and Hacking] colossus_r:
Good Work m8

Well done m8...This serious research ....

I hope someone can help you with this....

Keep up the good work
[Windows Phone 7 Development and Hacking] ChrisKringel:
Hey

another possibility i can think of is trying to use the update-process to update the registry. Did someone look into this approach?
[Windows Phone 7 Development and Hacking] Jaxbot:
I've thought about this, but it would involve some complicated understanding of the update system. If anyone knows how to go about doing this, though, I'm all ears ;)
[Windows Phone 7 Development and Hacking] kingjovius:
Ive no knowledge in this stuff but instead of the update process, how bout maybe the use of flashing? Like instead of flashing a whole new rom, maybe use that process to just put in an edited registry key or something, however it works
[Windows Phone 7 Development and Hacking] ChrisKringel:
I don't own a WP7 myself so I can only hypothesize... When an update is available it is downloaded by Zune. Zune itself checks on a Web-Server whether an update is available. The emulation of this server would not be complicated... The question is the type of the updates and what they consist of... And they have somehow to be transmitted via Zune. Maybe we could reverse engineer the chevron updater?

€dit: I just took a look into the "Unwalsh"-Tool. It seems to download the selected updates as *.cab files:

Mui item = new Mui {
ID = 1,
MUI = "0409",
MuiName = "English (United States)",
CabinetUrl = new List<string> { "http://download.windowsupdate.com/msdownload/update/software/dflt/2011/03/diff-7.0.7008.0-7.0.7355.0-armv7-retail-microsoft.lang_0409.pks_65fe09539f02edc8e1d44609fb537b87613063ea.cab", "http://download.windowsupdate.com/msdownload/update/software/dflt/2011/01/diff-7.0.7355.0-7.0.7389.0-armv7-retail-microsoft.lang_0409.pks_0cdfd833159cd10036e6025ec1db784dd712b2f4.cab", "http://download.windowsupdate.com/msdownload/update/software/dflt/2011/03/diff-7.0.7389.0-7.0.7390.0-armv7-retail-microsoft.lang_0409.pks_b4e3f25a79cfd5514895169ba167d9bd0cdb135d.cab" }
};

These updates are cab files that consist of multiple pku files.
[Windows Phone 7 Development and Hacking] Jaxbot:
Actually, that's really interesting, because from what I can tell, that would install a package to the device rather than having to have a whole new OS ver. Which I already suspected, but it's a good confirmation.

What this means, then, is it might be possible to use the updating system to deploy a registry package to the device that changes the key. As for reverse engineering ChevronWP7.Updater, that's no sweat-it just uses the libraries Microsoft used with Windows Phone Support Tool.

I'll dig around ;) Also, the pku files can be opened in WinRAR.
[Windows Phone 7 Development and Hacking] megagprime:
I think registry is the only way...

I'll be reading this thread religiously

Where the eff is XBOXMOD? he should be in on this...
[Windows Phone 7 Development and Hacking] noelito:
My phone is post nodo unlocked

Is it because non HTC phones are having problems unlocking? A hacker in the forums taught me how unlock my nodo phone
[Windows Phone 7 Development and Hacking] ChrisKringel:
I've extracted some of the RGU files. I opened some with a RGU Editor found in the Forum (http://xdaforums.com/showthread.php?t=587584) and they seem indeed to be registry related files. I've attached some of them, so that you can investigate further.

As you can see the file 37DDC81B-6703-4bde-AB36-B96080CE0F35.rgu is a plain text. Should not be too complicated to make it fit our needs :-D

Edit: I found also a DSM editor here in the forum. So i tried to alter one DSM to contain a self-created RGU file (attachment "test update content"). Now we have to repack them somehow as PKU-file...
[Windows Phone 7 Development and Hacking] borce_razor:
here is the .cer from the dsm
[Windows Phone 7 Development and Hacking] amahfouz:
At last someone has gotten to this, the community seriously needs this thread and to get NoDo hacked, ever since Walsh wad convinced by MS users wishing to unlock their devices were just abandoned.

I'm not very technical but I'll help anyway I can.

Samsung Focus build 7392
[Windows Phone 7 Development and Hacking] borce_razor:
which app/utility/service runs on the phone during the developer unlock process ?
[Windows Phone 7 Development and Hacking] colossus_r:
Wowwwoowow ...This is going fast ... i am impressed ...

Way to go m8...way to go....

Dont post those question here m8....

Its serious devs discussion...

Yes..there is a way ...Go here and read and post your questions
[Windows Phone 7 Development and Hacking] sunhi3man:
Updating device...

Greetings,

I have read about updatewp.exe in the Samsung Focus forums which is loaded into the Zune directory if you download and install the Windows Phone Support Tool. I experimented a little by opening a command window and running the exe. It seems to have a lot of interesting features built in. It seems you could use this software to update a pks file by using the right string. If we could properly package a pks file with a edited rgu file than we could probably push it directly to the device with this software.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hi xboxmod,

Nice to see you back in this forum. :)
[Windows Phone 7 Development and Hacking] poceh:
Maybe we can try to use the restore option in Zune for unlocking?

http://xdaforums.com/showpost.php?p=14297577&postcount=34
[Windows Phone 7 Development and Hacking] Jaxbot:
I've somewhat looked into that, but it seems awfully inconvenient... and if we screw anything up in there, we basically brick the phone.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Probably not going to work
[Windows Phone 7 Development and Hacking] poceh:
So if I understand it correctly the backup is first signed by the private key in the phone before the file is left the device into the PC right? But how is that possible, if I have a 32gb device, the phone itself has to make a hash or something similar on the whole device, before signing it. It will need a lot of memory and space for that. Otherwise the private key has to be exported to the backup program so that the file can be signed on the PC itself.

If the backup file was only signed online by a Microsoft server then we should try to introduce man-in-the-middle so that the file should be patched before signed by Microsoft.

Anyway I wonder how the Microsoft authenticates that the backup is original from the phone and not tampered somehow during the communication... Maybe we can man-in-the-middle to send to Microsoft server another public key part, not the one from the phone, so that it can pass the validation online.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hi,

Well, I don't know any details. But from what I've seen I can make an educated guess. This is how I would have implemented it:

- Send all data to the PC for backup.

- During the transfer, the stream is being hashed. This should not take any memory, as far as I know. The private key does not leave the phone and the hash is made on the device so it can't be altered by a man in the middle, ie. the hash is made before it leaves the device.

- Calculate a signature of the device and add it to the backup. When restoring, the signature must match or else the device will not be accepted.

- I'm not sure about Microsoft signing the backup. But it's possible. The hash could be sent over SSL with a server-authenticated connection, having the public key of the Microsoft server on the device. The signature from Microsoft can be used as an extra check.

The only way to temper with this, is having the device already unlocked and catch the hash somehow. You also need the private key on the phone. Neither of this is possible when you have a locked device. So this will not be useful for the purpose of unlocking the device.

Again, this is just a guess. But it is probably something like this. But don't hesitate to take a look at the binaries that do the actual backup. There may of course always be exploits that could be found.

Ciao,

Heathcliff74.
[Windows Phone 7 Development and Hacking] Marvin_S:
Im not really looking forward to try that backup thing on my own device atm... but Heatcliff do you know if the Backup/Restore will also work with the internet connection disabled? Or does only Restore works without a connection or none?

A little off-topic:

The weird thing is, I sended my device back for repair a while ago and after I received it, I could not restore it to my backup from before repair (Updated to Nodo by the VPN trick, than factory resetted before sending it in for repair). The repair guys flashed it back to 7004. This was quite odd to me, but maybe its not possible to backup to a newer version. Or would the backup become invalid after factory reset?

And about the PN thing to make the settings:

MS also implemented an OTA update system right? Because they were planning to deliver more much smaller updates. These things and the PN system are probably tested a lot for security purposes since they are sensitive for virusses if one can hack into it and alter the registry over the air
[Windows Phone 7 Development and Hacking] munkeyphyst:
Resetting the phone will not invalidate an existing backup/restore file from loading. I would save your existing backup file and once you're updated to a comparable os version, try to restore it then.
[Windows Phone 7 Development and Hacking] Marvin_S:
Thanks but I just started from scratch, it was a month ago or so :)
[Windows Phone 7 Development and Hacking] fiinix:
brb Not sure
[Windows Phone 7 Development and Hacking] hx4700 Killer:
Barring any info from above...since there is none...

I was wondering about the update packages. They seem to just contain cab type files from what I have read. Perhaps one with the dev unlock could be generated, signed and the cert added to the phone? I don't know who MUST sign the update packate?
[Windows Phone 7 Development and Hacking] ROCOAFZ:
Here is another angle.

Analize what exchange does to the phone.

It sets some security via the exchange servers settings and can also issue a wipe command.

It is possible to use these methods to access the registry?
[Windows Phone 7 Development and Hacking] goldenpipes:
Yet another angle...

How does the phone download apps from the marketplace? They are signed XAPs right?

COuld we trick the locked device into downloading "unlock.xap" from a custom marketplace? Hosted on our own PC?

"Unlock.xap" could just be a registry editor or just a quick reg setting app. There was one I seen before that changed the branding of the device.

also I was thinking about the "walshed" tool. When it connects to the phone windows detects the phone being connected Differently then say Zune syncing. Could we some how gain rights to the filesystem by hacking the "walshed" tool?
[Windows Phone 7 Development and Hacking] Jaxbot:
We've discussed this, and it has the same issue as cracking any signed communication to the phone. We can load custom XAPs on to it, but they won't install due to a lack of proper DRM.

As for the Walsh method, it just uses the update APIs from the Windows Phone Support Tool, no secret filesystem access there.
[Windows Phone 7 Development and Hacking] Marvin_S:
Does patching the zune software to allow patched restore files to be used? Unsigned? Or will the checking of the signatures happen on the phone? (Probably yes...)
[Windows Phone 7 Development and Hacking] Jaxbot:
No, I believe it's run on the phone, because when I go to send updates to the phone, they are transfered and then the error messages appear from the phone, not from the software.
[Windows Phone 7 Development and Hacking] d0ugi3:
is there a way to convert the DAT files from our restore into a actual thing we can see and not just file after file of jibberish ?

because if we could do that .. couldnt we also change what we needed to change in it without losing the MS signature ?
[Windows Phone 7 Development and Hacking] goldenpipes:
I thought both of these were covered i read the whole thread must have missed a page. But creating a "hacked marketplace" wouldn't need DRM to install Apps. when the phone tries to get DRM from the "Marketplace" it would get whatever DRM we set up and install.

I don't even know if its possible to make the phone connect to a different "hacked Marketplace" possible through hosts and sniffing?

just thinking out loud.

Seems like the only chink in the chain is getting the unlocking app onto the devices. Making our own marketplace would do it.
[Windows Phone 7 Development and Hacking] Heathcliff74:
And what makes you think the phone will install just any DRM we send? We have to send DRM that the phone will validate correctly. And you would probably need some sort of private key for that.
[Windows Phone 7 Development and Hacking] Heathcliff74:
You can try yourself now with this.

There are many possible exploits. Any communication the phone does with other servers can possibly be spoofed and exploited. But this needs a lot of time, research and expertise. It took me about two weeks to find an exploit in Push Notifications and spoof the server and then find out that this was not easily exploitable for the purpose I intended. At the moment I very busy and also working on WP7 Root Tools. So it would be better if more people start hacking themselves. Thanks for the ideas anyway.
[Windows Phone 7 Development and Hacking] brysonwong:
when will jailbreaking for nodo be available? :(
[Windows Phone 7 Development and Hacking] Heathcliff74:
June 12th 21:43...

Or sooner...

Or later...

Stupid question, stupid answer :P
[Windows Phone 7 Development and Hacking] lutherkingmartin:
jailbeakers working on sunday ? :eek:
[Windows Phone 7 Development and Hacking] theusername:
Yes, jailbreakrs work on Sunday they are Jewish. All you have to do they found is hold you phone in water for about a min. Then your phone is broke, give it a shot brysonwong!
[Windows Phone 7 Development and Hacking] hx4700 Killer:
To second that last part instead of requiring the $100 to dev unlock they should just offer it as a service to customers. If you dev unlock your phone you are put on a "Non supported" list. I think the biggest issue with hacking/modding the devices for manufacturers is having to now support issues that are unknowns like what you did to your device.

So a dev unlocked phone can get support but those who are just wanting to use homebrew and a free unlock don't.
[Windows Phone 7 Development and Hacking] sinister1:
Here's an idea.

Here is a hack that I found online that lets you see your phone as a USB device vs. opening Zune. I thought we could give that a try.

Open the registry editor on your PC by typing regedit in your Start menu.Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB; search for ZuneDriver

Now you will modify three entries (note, if you have multiple WP7 phones, you have to do it for each one)

Change ShowInShell from 0 to 1

Change PortableDeviceNameSpaceExcludeFromShell from 1 to 0

Change EnableLegacySupport from 0 to 1

No restart is necessary. Simply plug your phone in and you should see the phone show up in Explorer. Close down the Zune desktop app in order to modify the files.

Details: http://thetechjournal.com/electronics/tablet/windows-phone-7-registry-is-hacked.xhtml#ixzz1OM0Eppzp
[Windows Phone 7 Development and Hacking] hx4700 Killer:
Not to be an ass but how does this help dev unlock the device? Its a windows (PC) reg entry that allows you to see only SOME of the filesystem, not the registry.
[Windows Phone 7 Development and Hacking] cpx86:
Well, that depends on what's visible. I admit it's pretty unlikely they'd leave something security critical exposed on the USB filesystem, but it's worth to have a look around, right? Though I would guess that even getting close to the registry would require, as per usual, code signed by Microsoft uploaded to and executed on the device itself.
[Windows Phone 7 Development and Hacking] hx4700 Killer:
I assumed the hack had already been tried by the poster.

You can only see the folders that relate to media.... your music, pictures and video.
[Windows Phone 7 Development and Hacking] d0ugi3:
im going back on an idea i asked about before hand ..

what about cracking Windows phone tools ... and unlocking it that way ..?

people crack programs to use full features every day ..

and if you did that the phone would think it was officially unlocked by a Dev and then you wouldnt have to worry about updates ..
[Windows Phone 7 Development and Hacking] Jaxbot:
Um, did you read the first page? What do you think Chevron did?

Edit: To be nice, though, here's why that won't work: The phone itself checks if the dev account is approved, not the program, so cracking the program is of little use (and is actually really easy, though). We can't spoof the verification the phone does, because it requires a CA trusted certificate for the windowsphone domain.
[Windows Phone 7 Development and Hacking] The420Dank:
I would feel wrong for doing this. My reason is because I want WP7 to succeed. I also want to support Microsoft and the devs so that we can beat iOS sooner and android before 2013. Jailbreaking to me is getting everything or free. I don't like that or agree with that and I don't think iys far nor does it support anyone but yourself. Just had to say my standing on this.
[Windows Phone 7 Development and Hacking] munkeyphyst:
"jailbreaking" in this instance is opening up the OS to allow for customization and sideloading of homebrew apps. MS has a reasonable desire to lockdown and protect the OS for the average user, but the XDA crowd has greater needs and interests. It's not about pirating software. It's about ownership and control of the devices we own.
[Windows Phone 7 Development and Hacking] hx4700 Killer:
I second this. It isn't about getting software illegally for most people. It is about allowing people to write code or get code offered from other sources than the marketplace. Allowing customizations that are not otherwise allowed without a dev unlock and access to the registry/file system.

If not for the efforts of others on XDA I would not have custom ring tones NOW. I wouldnt have registry access NOW. I wouldnt have been able to make the tweaks I have made to alter the phones behaviour in a way more to my liking.

Jailbreaking isn't about theft for the vast majority of people on this forum. It is about freedom of CHOICE. One of the fundamental tenets that the U.S. was founded under.

This is one of the fundamental reasons I will never own an iPhone. I loose my right of choice in their world too. Want to change the battery? Forget it! Want to upgrade RAM? Forget it. I have been a windows mobile user for almost 10 years now through many growing pains and pitfalls. I would not be using windows phone 7 if not for winning a phone for free. I love the OS. It is light years ahead of anything prior in the line. Fast, smooth and responsive. It is also many things I hate (ala iPhone). Only time and the efforts of people on this site will tell if I continue to stay with this platform.
[Windows Phone 7 Development and Hacking] Ludacris:
Its pretty useless to do a jailbreak now...
[Windows Phone 7 Development and Hacking] LordM:
Then just don't follow this thread and don't use the things that are developed here..

I would support, if I could be from any help.

But as I can't be of any help for now, I normally follow this thread without spamming.

I hope, you continue trying to open the system for those who want to sideload apps or personalize the phone the way they like.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hi cpx86,

Nice story. But factually incorrect. And who are you calling "would-be-hackers"? Some people are just trying to give an idea (which is not actually very helpful, but that doesn't matter), but there are also quite a few people here that are really working on things (mostly not in this thread though).

And I got news for you: There are still holes in the system. And I got the proof for that. And I've sent that proof to Jaxbot. So you could ask him if you don't believe me. Man-in-the-middle-attacks are still possible. I must admit that I haven't found an exploit for it. So I did not release it yet, because it might still be useful later.

It all depends on how things are implemented. Developers are humans and they can make mistakes. Another possibility is that some holes are left intentionally by the developers, because it would be too expensive to implement (advanced server configurations etc) or it would have a too big negative impact on user-experience. Anyway, there are so many possible attack vectors and there are so many possible implementation errors or possible buffer overflows etc. I know Microsoft made it very difficult. But stating that these things are impossible is just plain b*llsh*t.

No flame intended :p Just correcting some facts, as you asked.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] StevieBallz:
I believe he didn't direct the would-be-hackers at you or Jaxbot but on the people making the same suggestions over and over - especially when it comes to try to be the Man-In-The-Middle concerning the Update-Tool itself. Whereas as far as I remember you worked on and succeeded at getting in between Microsoft's Push-Service and the Device.

But you are absolutely correct in that there will always be security flaws - the interesting part will be to find ones that are exploitable. Breaking a verified SSL connection isn't on the easy side of this.

So either we find a way to inject code into a service on the phone that has the needed security permissions to unlock the phone or we get another service to use the same native calls that e.g. your Root Tools use to gain access to the registry on Samsung phones (but that would make the Jailbreaks dependent on the device type or at least the OEM).

I wish you all the best of luck with this. Although with jailbreaking there is always the problem of warez (which most likely is why Microsoft locked the System down in the first place), many very useful things have already come from this (32 bit color-hack on Samsung devices, Flashlight App for Samsung and LG, etc.).
[Windows Phone 7 Development and Hacking] sinister1:
I was just brain storming because I am agg with MS right now. So I tried it and it didn't work. It only sees what Zune sees.
[Windows Phone 7 Development and Hacking] d0ugi3:
a cracked ROM might be the best way to go then no ?

it would just be hard to do with the different types of phones out there .. need to make a rom for each device .. i havnt even seen a normal 7004 or 7008 rom for the samsung focus yet ..

as a side note if anyone has a working 7004 or 8 rom ..

plz let me know .. ill downgrade crack and upgrade if i have to .. ive already reset my phone 4 times in the past month why not one more .. :mad:
[Windows Phone 7 Development and Hacking] brokenflipside:
I could be wrong, but the problem with a cracked rom has already been stated: the rom is signed, altering it would change the signature and would not be able to go back on a handset. This only works for hd2's at the moment because the bootloader is already unlocked.