yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] Marvin_S:
Well I see you can remove devices also trough the developer panel... this would prevent the xaps from being deleted. And I indeed believe (if im not mistakn) the running xap keeps running and will not be deleted before actually exiting the app.

Well think about registering a dev account on an edu email. Build some tool which does the unlocking with the accounts baked in, protected of course. And removing all registered devices on this account trough the developers panel every day (or everyhour whatever works).

If the live ID and password can be hidden in some sort of way and baked into the unlock tool, unlimited phones can be unlocked.

I have not tried to remove my device from the developers panel, since I need some sideloaded apps for real world testing.

However than the biggest problem is protecting the account and make sure people can not figure it out somehow and I have no idea how easy/hard it is to modify the unlock tool with a hardcoded account in it. Just an idea...

Developer panel:
[Windows Phone 7 Development and Hacking] ruscik:
Well a simple test would be possible. Start update, 1st step is download ofúpdate. When that is done kill the internet connection and let it backup and update. See if it does it.
[Windows Phone 7 Development and Hacking] Heathcliff74:
It's a bit risky though. If you disconnect after downloading the upgrade you might let it fail. A failed upgrade might possibly brick your device. Ofcourse it may all go well too. If someone dares ro risk it, then feel free to test it. It may rule out one of the difficulties of this attack-vector.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
Hey... i have a life, too and i have a official unlocked phone. I didn't need an NoDo unlock... ;) I just want to help and thought it could be usefull and save you or whoever a lot of time to have a Developer unlock. ;)
[Windows Phone 7 Development and Hacking] eug.o:
Hi guys, thanks so much for your efforts.

I saw today that samsung released a tool to fix the 801812C1 error. It updates a driver on the phone. I was thinking, wouldn't it be possible to deploy an 'update' which corrects the registry settings to unlock the phone through a tool like this? Since the update didnt come through zune it might be an easier way to deploy it than to set up a fake update server.
[Windows Phone 7 Development and Hacking] ruscik:
I'll test it tomorrow if I can. It will not brick it until backup is complete nothing is removed from device. Tested that with power failure already :)
[Windows Phone 7 Development and Hacking] Heathcliff74:
I totally appreciate the encouragement. I just didn't want to leave the impression that I would hack it if you throw money at me ;) That wouln't be fair. You probably better wait till we hacked it and then thank us and throw money at us ;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ok. Cool!
[Windows Phone 7 Development and Hacking] Heathcliff74:
Very interresting. I will have a look later today. I know the flash utility for Samsung Galaxy S is also used for updating modified kernels. We'll see.
[Windows Phone 7 Development and Hacking] Heathcliff74:
A similar idea has already been posted in the old NoDo cracking thread. It wouldn't work, because the live-id would get blacklisted jn no-time.
[Windows Phone 7 Development and Hacking] vangrieg:
Well, I did it twice, although for totally different reasons.

It all went fine but after the "Finalizing the update" stage backup was removed by Zune (and there's no Restore option). I'm not sure whether no internet connection is the problem or something else, but that's what I have.

So it's safe but one might want to take action to prevent the backup from being deleted.
[Windows Phone 7 Development and Hacking] fed44:
I have to agree that the certificate option is something one can forget because even if it did work in NoDo patching is a matter of making sure the certificate chains down to a specific CA (probably what they have already done, similar to the whole kernel driver situation, a trusted root cert won't do it, you need to chain down to an MS CA).

IMO the only way one could guarrantee unlockability would be via custom ROMs but I have no idea if the ROM's need to be signed. If they did need to be possibly it could be able to exploit the bootloader or patch it in retrospect after unlocking once (is this similar to the HardSPL method? never looked at WM 6.5)

I haven't looked at the push notification stuff but does that basically allow sth like dll exports to be called? Even if that was the case you would need a dll or something to call but the file system is locked (Having a quick search looks like it uses .Net events, which seems even more pessimistic). Exploiting Microsoft code may have been easy back then but these days you may see that the HW manufacturers apps are the weaker links.

P.S: We could copy modern malware and try social manipulation, aka try to convince Microsoft :P. What actually happened to that discussion between them and Chevron team?
[Windows Phone 7 Development and Hacking] Jaxbot:
I have access to an unlocked NoDo device, as well as a backup I can easily apply to my Focus. The restore thing I will look into, but I don't have much faith in it being a viable solution. Also, if anyone is wondering, you can make a copy of an backups made from your device and then copy them back into the AppData folder for Zune to restore your device whenever you need to.
[Windows Phone 7 Development and Hacking] jaygriggs:
Hi Everyone,

I mod game systems in addition to my phones. Xbox Wii and probably all softmods use the same basic technique. This is copied from wiibrew.org about the twilight hack in particular

The hack exploits a buffer overflow error caused by loading a specially crafted save file for Twilight Princess. The save file stores a custom name for Epona, Link's horse, that is much longer than what the game would usually allow, in fact it even contains a small program. While the game doesn't allow you to manually enter a name this long it doesn't check the name in the file. When the game tries to load the name into memory it inadvertently drops the small program into memory filling not only the "horse name" buffer but adjacent ones. In a round about way these regions of memory happen to be designated the next region the console should execute.

The original xbox uses a similar method

The 360 uses the Jtag hack which is basically soldering to get signals where they need to go and instead of upgrading the dash through MS they have basically they're own built Rom

The Jtag Exploit was actually discovered from the king kong hack which is almost the same to the other soft mods.

So Since there's games on these phones that seem to be pretty powerful I wonder if something similar could be developed. I don't know if this has been discussed in another thread just thinking aloud.
[Windows Phone 7 Development and Hacking] munkeyphyst:
I've posted the 7008 backup files that have no live account associated with them in this thread here. Just in case you want to play with a backup that didn't come from your phone.
[Windows Phone 7 Development and Hacking] fed44:
Custom ROMs are all down to wether or not they must be signed or not, directly JTAGing would be quite dificult and messy as the device is slightly smaller and that is under the condition that it has JTAG pins to solder, but then again it needs to be programmed somehow in the factory...

All those other exploits already seem problematic because you can't really get files onto the device except for media files which brings back thoughts like tiff exploits on the PSP but this would require actual exploits and somehow I don't see many of these in the Frameworks that have been in use for years. The games or exploitable apps would also most likely need to be native as .Net is fairly secure against such attacks but like I said most of that stuff will be quite patched up especially stuff like USB stacks etc. which would be optimal if they could actually be exploited.
[Windows Phone 7 Development and Hacking] jaygriggs:
Right Jtagging is out the window.

However im not talking about a media file or a game that would need to be signed. A game save thats altered to run what you want (quick registry edit that changes the needed value)

I guess the question then becomes

A How to package up the gamesave and

B how to get the gamesave where it needs to be

A Previous poster had spoken of a program that alters 360 saves. Although I have never played with them, I have read that the saves can be played on other systems that were not modded.
[Windows Phone 7 Development and Hacking] Jaxbot:
This wouldn't be limited to just game saves, but I think the idea of memory overflows should be reserved for a last resort scenario.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I did have a look at it. It looks very useful and interesting. I wrote about it here.

Ok. I'm just guessing here. But it looks like the backup-files are double-signed. Once with a private key, which is on the device being backuped and also unique to the device. And it is signed online by a Microsoft server. So the device would then contain a private / public keypair. Backup is signed with the private key. The backup files are verified against the public key of that pair. When the backup is tampered ot from another device, it will be rejected by the device. The device will probably also contain a public key of the Microsoft server, which is being contacted. So when a hash of the backup is sent to Microsoft and it will be signed with a private key, the WP7 device can verify if the backup has been properly verified by an authenticated Microsoft server. If this is correct or very similar, then this can only be reverse engineered and exploited when the device is already unlocked. This is impossible to hack / spoof while the device is still locked. So it can't be used to unlock a device. When the device is unlocked, and TCB privileges are aquired, the private key from the phone can be extracted so that the backup can be signed. And also the public key for the Microsoft server can be replaces, so that it can be spoofed during the verification of the backup.

Agreed. Maybe the Samsung Flash Tool can help here.

No, it is like an XML script language with very much system API's and TCB access. So it is promising. Jaxbot and I are looking into this now.

Don't hold your breath. ;)

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] walshieau:
The theory on signing the update cabs doesn't work. Tried it with my VeriSign cert previously.

They've actually done a decent job in locking down the operating system. Even if you get to the MSPN service, it'll be executing in a chamber with minimal access to the OS and registry. Although it reads it's EndPoints from a specific section, it would only have read access to the DeveloperUnlock registry key.

There are only two real ways in, via a SIGNED TCB driver, which you can't really deploy anyway without an unlocked phone, or a rogue marketplace app, which I doubt will happen.

All that aside from flashing a custom ROM :)
[Windows Phone 7 Development and Hacking] Heathcliff74:
I think I have to disagree. First look here:

HKLM\Software\Microsoft\PushClient\ServerPolicy\Production\PolicyServerURL

It looks like communication with the MPNS is over http, not https. Now look here:

HKLM\Security\PushRouter\Registrations\ByGenericId\PC5

You can see here that the syncml.dm notifications are routed to omadmprc.exe and it will be run with TCB privileges (AccountSID = S-1-5-112-0-0-1). With syncml you can change the registry and with TCB privileges you can access the unlock-value.
[Windows Phone 7 Development and Hacking] Jaxbot:
Thanks for confirming ;) I'm still playing with the push notification thing, been short on time (thanks finals), but I've gotten some ideas lately on how to handle some of this.

I'll let ya'll know how it goes...
[Windows Phone 7 Development and Hacking] tonychou:
still waiting for the jailbreak of nodo,and this 24,will MS announce new Mango?
[Windows Phone 7 Development and Hacking] d0ugi3:
removed my post .. i didnt read all the pages ..

but i guess it still fits .. what if we were not connected to the internet and in airplane mode ..

with a hacked version of Win Dev tools .. to unlock the device ..

or does it need to be online to even unlock in the first place ?
[Windows Phone 7 Development and Hacking] ceesheim:
actually you can forget this to because you need to have a running os to spoof the spl with a fake one to disable the sec check.

you also need a running os to get a hspl on the phone.

so the real only way as I see it , is by flashing a 7004/8 rom, hack it and spoof the spl, flash hspl , custom rom.
[Windows Phone 7 Development and Hacking] d0ugi3:
i would settle for someone just making a ROM for the focus ..

i mean they are out there for almost every other WP7 device .. why not the focus ..

how do you make a ROM for a phone anyway ?
[Windows Phone 7 Development and Hacking] ceesheim:
I just explained that it isn't that easy.

all parts of a rom are sighed.

that mean:

ipl signed.

spl signed.

radio signed.

os sighed.

all the rom's you find are stock rom's made by OEM with platformbuilder from MS and after that all parts are signed.

so you would need to find a way to load a sspl (or something like that) to fake the real spl on the phone (looks the same as for wm6.*)

after you faked the spl and disabled the SEC checking you can flash a modded rom that isn't sighed or you could flash a modded spl (Hspl) that don't have the SEC checks in it.

the problem isn't to make a hspl (thats easy ) the problem is to make a sspl that runs on the os and bring the phone in a faked bootloader mode , for wp7 they have to make one from scratch (parts of haret was used on wm6.* to make sspl's)

here is also the next problem, this only works on a unlocked phone because you would need to get your app (sspl) on the phone and run it.

when all of this is ready it is easy to make custom roms (look at the hd2)
[Windows Phone 7 Development and Hacking] d0ugi3:
if its so hard .. why are there ROMs for other phones already ? ..

shouldnt they be just as hard to make ?
[Windows Phone 7 Development and Hacking] ceesheim:
there is only one phone with custom/unsighed wp7roms and that is a hd2.

and here is way that one isn't so complicated:

it is original a windows Mobile phone (wm6.5)

and to make a hspl for wm isn't the biggest problem because the principle is all the same.

and to get the Hspl on a hd2 you first need to load a stock wm6.5 rom

but on wp7 this isn't the same (and as we speak there isn't any real wp7 phone hacked)
[Windows Phone 7 Development and Hacking] d0ugi3:
See this is why we need a Lynux OS for phones .. i know android is kinda Lynux baised .. but a 100 % customizable phone .. without hacking .. would be amazing ..
[Windows Phone 7 Development and Hacking] ceesheim:
it has nothing to do with linux/android or whatever open source os

the OEM's want to protect there product and app's they put on the phone.

so the OEM makes the phones harder to crack.

actually if you look at android they make it harder and harder to crack/root.

the only real easy to crack os is wm but that is dead :(
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hi ceesheim,

Thanks for the info. I have no experience in cooking ROM's, but I'm interested. Could you have a look at this thread? Are you able to see if the file I attached has any signatures. Only by looking in a hex-editor I don't see anything that looks like a signature.

Could you tell us a bit more about sspl/hspl? Or is there any good guide out there?

You say there are only cooked WP7 roms for HD2. I'm not sure, but I believe Ansar is cooking roms for Samsung and HTC now.
[Windows Phone 7 Development and Hacking] JamesAllen:
Best of Luck

I wish everyone the best of luck in these efforts. From a practical standpoint, I believe whatever solution you come up with, the phone needs to be unlocked. You need to find a way to do this without the requirement to load the Windows Phone Developers Tools. This is just too much overhead for most people and that alone will stop a lot of people from trying. In addition, if you have been following the fiasco with Chris Walshes Updater, you know that making changes on the Focus (especially altering the "state") can have a negative impact on future "offical" updates. Whatever mechanism you come up with must have NO impact on the ability to get OEM, Carrier or MS "official" updates when available. This is critical. While some people may want to flash a custom ROM, they will not want to be held hostage by the ROM chef for future updates to that ROM, with no option to get official updates.

Just some thoughts from someone who has flashed dozens of ROMs on my prior WM 6.5. While I am beyond the compulsion to flash (no need to with WP7), some people may still want to (or think they want to, or "need" to). But, the WP7 environment is not WM 6.5 and there are many more considerations.
[Windows Phone 7 Development and Hacking] Heathcliff74:
What you want is impossible. Hacks are based on exploits. Exploits are often security holes in a specific version of a specific piece of functionality. The security hole will probably be 'fixed' in a next release. If you look for patches on the internet, a patch is always bound to a specific version of the target software. In a next release, you need to find another exploit. That's the way it almost always works. If you want to patch/unlock/crack/keygen etc, you have to stick with that version until an exploit is found for the next version. If you (ab)use exploits you have to do your own version-management and don't rely on automatic updates. Also, demanding things like "I don't want to install developer tools" is kinda ridiculous. Hacking is difficult as it is (try it ;)). You need to install whatever is necessary to make it possible. If you don't want to install that software, then that's bad luck to you (no flame intended).
[Windows Phone 7 Development and Hacking] ceesheim:
ok here we go :)

first I didn't looked in SamsungDriverUpdate but I can tell you one thing that all the files in it have almost certainly a signature and the .dsm in the update has to match the one on the phone if one of this is wrong the update will be rejected.

this is a link to Da_G his thread where he explane how the update works , this is for wm but most of it will be exact the same on wp7.

http://xdaforums.com/showthread.php?t=520009

here is a link on what parts a rom is build.

http://xdaforums.com/showthread.php?t=649914

edit:

the sspl/hspl

I will for a good link of it , but this is almost the same for all wm/htc phones (I don't know on samsung)

the links to the (custom) roms are all parts of stock rom's repacked in a container (nbh/nb0) so it is still a stock rom but made out of 3 different stock roms (all branded roms with htc os.nb)
[Windows Phone 7 Development and Hacking] JamesAllen:
No Flame

Not taken as a flame, thanks. You are making my point for me. With WM 6.5, you just needed to HardSPL the device once and you were good to go. Find a ROM and flash it. Easy. WP7 has made this much more complicated and that alone will eliminate a lot of people who used to flash WM 6.5 ROMs because although it was risky and took them out of their comfort zone, but was relatively "easy" and once you did it, the apprehension about doing it again was gone. I know that I have looked at Chevron and several other "suggestions" for changes to WP7 and my first reaction was "you have got to be kidding, way too complicated and too open to problems". WP7 is a different animal and I think we will find far fewer and a much smaller percentage of WP7 users flashing versus WM 6.5. Partly because, I suspect, the ramifications will be more severe, and partly because (especially after Mango) the OS and UI are much more stable and easier to use. I know I have become more comfortable with it and have put my FUZE to bed for good.
[Windows Phone 7 Development and Hacking] ceesheim:
I know that there will be a hspl/rspl for wp7 so that everybody can flash the living dead out of it :)

but what I think what will happen is that when we have hspl we only have to flash one time our custom rom (and that custom rom is patched to allow updates from the cook :D)

this is what I will try to get working when there will be Hspl for wp7 phones

only flash one rom from me that I have modded that it exept updates from me AND MS

then when I change something I will post the update only and you all are happy because this way you don't need to backup all your stuff

Da_G has started this idea and on wp7 it is a real big possibility to get it working.
[Windows Phone 7 Development and Hacking] JamesAllen:
Plan

ceesheim, sounds like a great plan and I wish you all the luck.
[Windows Phone 7 Development and Hacking] ceesheim:
reading some good old stuff :)

http://xdaforums.com/showpost.php?p=6055626&postcount=349

this could maybe help a bit.
[Windows Phone 7 Development and Hacking] Marvin_S:
Excuse me for being naive but is it not possible to modify a rom lile those on samsungfirmware and replace this devunlocked digit in the registry?

Will this invalidate the signature?
[Windows Phone 7 Development and Hacking] Jaxbot:
Yes, any changes (even a single byte different) will change the checksum, thus invalidating the signature. Otherwise, our lives would all be that much easier ;)
[Windows Phone 7 Development and Hacking] d0ugi3:
i think just making a rom from 7004 or 7008 would be amazing .. then we can all downgrade .. unlock .. permantly .. and get the update ..

instead of finding nodo hacks .. which for now looks pretty locked up ..

finding a real Focus Rom for me would be awesome ..
[Windows Phone 7 Development and Hacking] Jaxbot:
That wouldn't really be unlocking it, though, that just sort of dodges the problem.

For those curious, yes, I've been busy behind the scenes working with this. I've played around with some different techniques along with the MSPN service Heathcliff and I are trying to crack.

Along the lines of the unlock tool spoofing, I've tried some different methods to get around the SSL certificate problem. Unfortunately, not even wildcard certificates and arp poisoning seem to help with getting the service to authenticate. Certificates ruin all our fun ;)
[Windows Phone 7 Development and Hacking] mikeeam:
Guys.. Why botter?

We're almost at mango..
[Windows Phone 7 Development and Hacking] AceofSpades25:
:rolleyes: Okay hands up... who want s a phone constrained to do only what Microsoft allows it to do (even after Mango)

We hack phones because they're ours, because we can and because we're sick of being told what we are and are not allowed to run on our phones.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Who says our hacks won't work on Mango? ;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Amen to that! Microsoft promissed a solution for homebrew, but I'm not holding my breath.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Today I made some real progress. I got around an important part of this SSL crap ;) Microsoft left a nice security hole there for me. We're not there yet, but a very difficult step was made.
[Windows Phone 7 Development and Hacking] Jaxbot:
Amen to that ;)
[Windows Phone 7 Development and Hacking] d0ugi3:
how are you finding these holes in the first place .. ?

do you have a way to actually get into the phone (thats not already unlocked ?)

also second question ..

if you make your phone into a noticable USB drive .. and you get into it that way and get into the guts of the phone ?
[Windows Phone 7 Development and Hacking] mikeeam:
And who says it will? The chance is low, using the common sense. Even lower if it is released before Mango.

I'm not saying "dont hack it". But why try to hack an old version? Not so old, ok . Still, Mango is around the corner. Lets not wait months after it was released to take some action.

So, the day after Mango update, lets create a Project: Let's 'jailbreak' Mango!

And i'm not even saying that maybe.. MAYBE, MS will release the homebrew solution to us.

We will see it today (;