yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] estens:
We use a certificate called a SMIME certificate to sign random files that are then sent to an iPhone that show up as trusted on the device.

This SMIME certificate was purchased from a normal Certificate Authority (not mentioning here, but if someone PM's me i'll give them more details).

I am really not sure how we're allowed to do this, but we use that SMIME certificate to sign file an push them to iPhone to get installed, without jailbreaking.

Basically, Apple gave the world a list of the certificate's that are loaded into the device, you go to one of the CA's in the list and purchase the SMIME cert.

We then generate .mobileconfig files, sign them and push them down to each iPhone and it appears as trusted.

Could this approach be used for signing the cab files. All you'd need then is a list of trusted CA's already on the device and a $20 SMIME certificate.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Thanks, but I'm quite certain, that is not going to work for more than one reason.

A S-MIME certificate is a cert of type "Key exchange" and Extended Key Usage is "Client Authentication". A cert for code-signing in WP7 needs different Key Usage and Extended Key Usage. I just wrote a detailed post about that here. To be honest I'm quite surprised that iOS accepts a S-MIME cert to be used for code-signing :rolleyes:

For the DRM on the app-packages (xap for WP7, not cab) a different signing method is used. If a device is locked, you can't sideload. It might be possible to spoof the marketplace, but you would still need signed packages to be able to load to app onto the locked device. To do that you need to sign the code in the xap with a cert such as I mention in the post I did refer to. And you would also need to add a DRM file to the xap, which has some unknown checksums/signatures. And you would also need to add a licensefile, which contains some signatures in an xml-container. So that's a total of three different signatures, from which the first cert with very specific thumbprint, keyusage and extended keyusage is needed and the other two are completely unknown, so far.

So this type of side-loading on a unlocked device is still impossible atm.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] fiinix:
Were'nt the xap's extracted to a folder on install (\Applications\Install\GUID\Install\), by just making a new map {GUID}, and extract the xap data there. Then run app://guid, wouldnt that run, dont you think?. Once again, do we have enough access to the extraction folder?

Then we dont need DRM licence.

(All happens on the device)
[Windows Phone 7 Development and Hacking] Heathcliff74:
The point estens was trying to make was that he knew a way to load homebrew onto his unlocked iOS device. And I tried to explain why that wouldn't work on WP7.

If I understand correctly, you are trying to figure out how to install homebrew on an already unlocked WP7 device, right? So that's a different story.

To answer your question: I do have write access to these folders. I could probably extract a xap in one of these folders. But I guess there is more to it. During installation of a xap there will most probably be a lot more changes to the device configuration. I believe we already mentioned a homebrew package manager in the DllImport thread. Have a look at that.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] ROCOAFZ:
Back to a question i had earlier. How does exchange make changes to the phone. We have a work Microsoft exchange server 2010. I can modify rather users can install apps and other things via exchange. I can also wipe any phone connected to it. To do this would it not have to have priveledges to the registry on the phone? Is it done through push? Just thinking...

Here is some more info on it including certs that windows phone 7 will trust.

http://blogs.technet.com/b/dcaro/ar...g-a-windows-phone-7-to-exchange-2010-sp1.aspx
[Windows Phone 7 Development and Hacking] hx4700 Killer:
I think the real question is can exchange change a reg entry on the phone to make it dev unlocked? If that were true then this would be an ave. worth pursuing.

Further, I have SCCM that can manage a windows 7 phone. Perhaps I should explore what I can do with that. Perhaps its behavior can be mimicked.
[Windows Phone 7 Development and Hacking] withinboredom:
Has anyone thought of writing and submitting a simple "quote of the day app" with a built in buffer overflow exploit ie

int length = (int)socket.read(4 bytes);
char buffer[] = char[length];

int i = 0;
while (socket.available)
{
buffer[i++] = (char)socket.read(1 byte);
}

It would throw an exception, but surely there has to be a way around it.

Then it would only be a matter of changing the feed location in the settings and downloading a "bad" quote that would simply unlock the device.

I don't know how stringent they are about app submitting though. I haven't submitted my app yet.
[Windows Phone 7 Development and Hacking] hx4700 Killer:
That thought occurred to me too but in the end its your app with your name tied to it that is allowing this opening you up to a host of litigation from MS if it is found that you wrote the app then posted the exploit to unlock the phone online somewhere (or had anything to do with it)

Further, I know from attending many MS events that they have a whole host of tools for scanning code for buffer underrun/overrun holes and would most likely test it with those.
[Windows Phone 7 Development and Hacking] withinboredom:
Well, let me ask you this, can you install signed apps without using the market place and without having an unlocked phone?
[Windows Phone 7 Development and Hacking] munkeyphyst:
Nope
[Windows Phone 7 Development and Hacking] withinboredom:
So, even if that were to work, MS would take it down and that would be that.
[Windows Phone 7 Development and Hacking] hx4700 Killer:
Damn, thats what I get for going to MS conferences and doing hands on courses for future products....

The SCCM functionality to manage Windows Phone 7 will come in SCCM 2012 due out later this year.
[Windows Phone 7 Development and Hacking] StevieBallz:
Buffer overflows in managed code won't allow you to write executable code anywhere - perhaps one of the reasons why Microsoft decided to only allow managed code. Perhaps if you found a buffer in the CLR that was vulnerable to overflows you could create an XAP that exploited this vulnerability but it is likely that Microsoft would find this code during Marketplace testing.
[Windows Phone 7 Development and Hacking] withinboredom:
http://www.diaryofaninja.com/blog/2011/05/11/the-story-of-a-windows-phone-7-bug--live-tile-updates

Maybe point someone who was trying to spoof notifications that there is a possible overflow there.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Could be something. This is probably in native code. Depends on whether this is just an error or a real buffer-overflow. I will have a look at it later on and report back.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] fiinix:
Native exception code "FFFFFFFF

81110975

" 81110975.

>Stack trace NotificationAgent.dll

Looking further in to it.
[Windows Phone 7 Development and Hacking] Jaxbot:
But if it's throwing a native exception, wouldn't that mean the buffer overflow is caught and stopped? Or is the native exception the result of an overflow?
[Windows Phone 7 Development and Hacking] athompson:
It's possible to write native code on the device using the com interfaces. Not sure what that gets you though, except the ability to crash your own app.....
[Windows Phone 7 Development and Hacking] Heathcliff74:
I haven't looked into it yet, so I'm not sure. But this is probably an errorcode in native code, which is pushed into managed code as an exception. This also happens if a call to native code through a COM interface returns a negative value. Anyway, it looks like this is not a native bufferoverflow, but just an error that is caught and then thrown back to managed code. I hope to have time to look into it this weekend. I kinda hope that is can actually be exploited and used in combination with my man-in-the-middle-attack. But to be honest, I have not much hope for that.
[Windows Phone 7 Development and Hacking] sinister1:
Good luck Heathcliff, I hope you find something man becaus I would hate to have to Flash my phone and the re-upgrade to nodo again.
[Windows Phone 7 Development and Hacking] d0ugi3:
at least you can flash your phone ..

i cant even do that with mine .. i dont have a rom ..

theres a demo one floating around there .. but i dont wanna try it and brick my phone ..
[Windows Phone 7 Development and Hacking] sinister1:
http://infocommunity.webs.com/apps/blog/show/7353538-microsoft-over-charging-for-developer-licenses

Very disappointing article :eek:

http://infocommunity.webs.com/apps/blog/show/7353538-microsoft-over-charging-for-developer-licenses
[Windows Phone 7 Development and Hacking] sinister1:
Microsoft has confirmed to WinRumors that the company will push a Windows Phone 7 security update via its Zune software.

The software giant has been working on a patch to block several fake SSL certificates that may affect Windows Phone 7 owners. The company originally warned of nine fraudulent digital certificates in late March. Certification authority Comodo issued the certificates in what the company described as a “politically motivated” attack. The certificates have been revoked by Comodo and Microsoft has issued an update for all supported desktop versions of Windows to help address the issue. Microsoft says the certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer. Read more...........

http://www.winrumors.com/microsoft-...phone-7-security-update-installation-not-ota/
[Windows Phone 7 Development and Hacking] ROCOAFZ:
That site was not an apple site. Note it also goes to a paypal account.

Apple is 99.00 just like MS

http://developer.apple.com/programs/ios/

Next time check your facts before putting MS down.

I have about 100 keys for dreamspark which would get you Windows phone 7 developer license for free on each. I could sell them for 5.00 a piece. Would they then report Apple is a ripp off?

Also that isn't giving you a developer account. That is to register your device under HIS developer account.

The 2nd article.. pushing through zune an update. Looks like the jailbreakers may want to analyze this update if it goes through.
[Windows Phone 7 Development and Hacking] sinister1:
Yeah $7 did sound to good to be true. But the second article does put a damper on future possible hacks.
[Windows Phone 7 Development and Hacking] KilZone:
That's the May Security Update (7392) that has been released already, several devices have been updated and some are in testing. You're a little behind of schedule (article is from April '11), please check where is my update for more information about the update-schedules.
[Windows Phone 7 Development and Hacking] withinboredom:
So, yesterday, I had this crazy idea to create my own 'unsafe' function by writing it in asm in the already compiled code ... still learning how this clr thing works. BUT, how in the world do we take apart these xap files?
[Windows Phone 7 Development and Hacking] Jaxbot:
Open them in WinRAR/WinZIP/Windows Explorer.

And I don't think that'll work, because it has to be unlocked to sideload them in the first place.
[Windows Phone 7 Development and Hacking] withinboredom:
Oh, cab file ... wow. ok.
[Windows Phone 7 Development and Hacking] withinboredom:
Still, seems like a decent challenge and would apply to other CLR based applications like servers and probably chunks of Win8 ... which from what I've seen on youtube looks a lot like these phones: youtube video here.
[Windows Phone 7 Development and Hacking] sinister1:
This post is like 5 months old but could it be that this is possible? Or is this some more non-sense B.S.? I hope something like this comes up because I'm tired of being able to tweak and side load apps to the damn Androind but not to my Windows Phone.
[Windows Phone 7 Development and Hacking] fiinix:
This is all **** old and Julien Schapman is said to been pwned by MS that he could not release the jailbreak for nodo. Of cource Julien Schapman was probably very close (and troll) but it ended up being a to early announce that did not work after further research (probably). Heard another troll here on xda saying he had cracked nodo but MS had ALSO came to him (message). Trolls go away. Also there is to much **** in this thread that trolls are posting thinking "that they know how easy it is to hack wp7 because WM6 got hacked". Hacking this WP7 IS NOT WM6 HACKING. Keep this thread clean, its hacking nodo, not hacking your salad in the kitchen. Please..... Gtfo.
[Windows Phone 7 Development and Hacking] sinister1:
http://wmpoweruser.com/post-nodo-certificate-update-for-windows-phone-7-now-rolling-out/ Question has anybody gotten this update and does it affect an unlocked phone?
[Windows Phone 7 Development and Hacking] fiinix:
Yes, Zune says that i can download this update, but i press cancel, because every security patch makes it harder to crack the system. First Heatcliff and i must come deeper (hacking) before i install it, to be sure i don't get blocked out. Just saying.
[Windows Phone 7 Development and Hacking] sinister1:
Nob Question

I'm new to WP7 and have no idea when it comes to hacking it like I did with WinMobo 6.5; with that being said, I have a USA HTC Trophy which came with NoDo pre-installed and I have not been able to hack it via the Chevron way since they patched it. So I heard that you can download a European non-branded ROM and flash, jailbrake it and then up grade it back to NoDo. My question is my reads Radio software version:1.52.00.03.28_23.15w.05.06u what ROM will work. Thanks in advance.
[Windows Phone 7 Development and Hacking] colossus_r:
That update is a certificate update and probably it will be harder to unlock after applying that.

But its not effecting the chevron unlock state of the device... the device is still unlocked after the update..

I did this update on up to 10 htc trophy's and they where still unlocked after the update...
[Windows Phone 7 Development and Hacking] DominikZ:
Hm. I stumbled across the Windows Live Webpage today. And I got an (maybe?) useful Idea.

Some days ago (I'm too lazy to scroll through all pages now - sorry mate :)) "somebody" mentioned, that all Windows Phones can be reset with the Exchange Server Software - in case somebody loses his phone.

Well the exact same thing can (as we all know) done with the Windows Live Homepage. So maybe there is a way to edit the registry by spoofing the server because it must have some privileged rights, to alter the phone? (Eg. locking screen etc..)

I don't know which packages will be sent to the phone and if you can interfere but I think it's definitely worth taking a look?

What do you think?
[Windows Phone 7 Development and Hacking] wbadry:
I think Windows Phone 7 Device Manager was another way to blackmail developers just like what Microsoft did by restricting developers to "pay to develop". I think these acts were Apple trademark, but look who joined too.

I'd love to thank all decent developers here on XDA for their recurring attempts to "not restrict" our freedom to develop on this "still under construction" platform.

Regarding Julien, his application is great but just as I said, his way is no different than Microsoft. Even if we pay donations for the good work, it is not rational to force us to pay.

Once more, thanks to all magnificent XDAs. You will always ROCK.
[Windows Phone 7 Development and Hacking] sinister1:
Yes, I would also like to thank all the people on her you guys work hard and diverse a thank you.
[Windows Phone 7 Development and Hacking] domineus:
^

with fiinix

let's keep the clutter away
[Windows Phone 7 Development and Hacking] sinister1:
Question

If I were to cough up the $99 for a dev account; could I then run the reg hack to keep the phone from re-locking and keep it open permanently and not have to pay the fee every year there after?
[Windows Phone 7 Development and Hacking] Marvin_S:
yes depending on which phone you have. But the majority has regaccess to those keys. LG even has it native withoud needing to pay/sideload anything.
[Windows Phone 7 Development and Hacking] Jaxbot:
Thoughts on this, people?

http://windowsphone7central.com/art...ng_lowcost_homebrew_to_windows_phone-06-17-11

I have some things I could be saying, but I guess it's all better than nothing. I wonder how this service will be applied, and specifically, if it will open up any holes in the system. (Sorry for my thought process, to any Chevron folks reading this thread.)
[Windows Phone 7 Development and Hacking] fiinix:
I kind of agree; well is cheaper than the Microsoft solution (but how), and why would you still pay for homebrew, i really don't see the point.

First Chevron was a "free of charge" team, and now they want money; typical...

"Plans have recently solidified and we can now reveal a solution we’ve been working on."

And what may that be for a solution of homebrew, well i can guaranty its not a "exe" solution, because then new policy <Rule>'s need to be applied. This will truly be fail if not exe. Aren't all homebrew projects go get the most out of the device, super rooting it. I don't see this becoming a root solution so i say nope();

edit (size that dumb idea up):

>Pay for homebrew, dumbest i heard in a long while (look @ Android, free homebrew)

"The service will require a small fee — currently via PayPal — to offset costs but we assure you it will be more affordable than the App Hub."

This is how it should be: free

Final is, why did even Microsoft take money for developing for WP7, don't they have to much money already...
[Windows Phone 7 Development and Hacking] sinister1:
I hope it's not to wattered down and that it comes out real soon because I was seriously thinking about giving up and just pay the $99 for a dev account through MS.:mad:
[Windows Phone 7 Development and Hacking] sinister1:
I agree 100%. Question, I thought that jailbreaking your own device was legal; so what isn't what Microsoft doing illegal? I mean they are blocking our rights to jailbreak our own devices and charging us for financial gain?
[Windows Phone 7 Development and Hacking] sinister1:
Thanks for your response. I have an HTC Trophy; would it work on my phone?
[Windows Phone 7 Development and Hacking] Marvin_S:
Very true, its a bit of a robbery. People already pay to get Apps in the marketplace, people pay MS for every App they sell, people can not install Apps outside of the marketplace so there is no way around not paying MS. I think this is why they want you to pay for homebrew (mainly the sideloading and free distribution of add-supported software).

But then again the users already paid a lot of money for their phones, and Microsoft should thank their first adopters for this by releasing this stuff for free. Or at least for a half year for free or something.
[Windows Phone 7 Development and Hacking] Marvin_S:
Sure, look in the appropriate threads there are a bunch of regeditors for htc devices. I dont have an HTC so I can not pinpoint you to a working xap directly
[Windows Phone 7 Development and Hacking] withinboredom:
They aren't so much blocking it. I don't think. "Jailbreaking" is the exploitation of security holes.
[Windows Phone 7 Development and Hacking] LongZheng:
I'd be ignorant to say circumstances didn't change but our goal is the same.

It will make your phone unlocked to the same state the ChevronWP7 tool used to and the official App Hub account does. Since this will be an approved unlock, this will not require any hacks to maintain the unlock state.

This is an optional service. You don't have to use it if you don't want to, but we want to provide the choice for those that do.
[Windows Phone 7 Development and Hacking] RoboDad:
I, for one, applaud you for your work, and will gladly pay whatever small fee you ask for the new and improved unlock tool.
[Windows Phone 7 Development and Hacking] Marvin_S:
Fiinixx, Heatcliff, Jaxbot and others working on the unlocking...

Be sure to understand that everything (good things) you guys do will go against the buisness model of the chevron team. If you guys find a hole and post it here, they and MS will lose customers for their official service, so they will probably try to patch it. Posting all the code here might be usefull to devs trying to unlock, but its also exposing your tricks to the competition.

Im not trying to blame anybody. The chevron team did a good job and i respect them and i also respect you guys for opening up the system.

But if i was not student unlocked i would have felt betrayed... Its my phone I bought it I want to test and develop apps on it even if its just for myself.

I was assisting a course of developing... A lot of students wanted to dev an app for a mobile phone, try to tell them you cant because you did not pay Apple/MS to be able to load apps on your OWN phone.
[Windows Phone 7 Development and Hacking] colossus_r:
+1

You are soooo correct ....

Its my phone and i want to do anything i want with it...
[Windows Phone 7 Development and Hacking] sinister1:
I just read some where that even if you cough up the $99.00 per year for an app hub dev license there are still limits to how many apps you can side load, WTF? Man Microsoft is so full of it.
[Windows Phone 7 Development and Hacking] sinister1:
With that being said, I'd rather you guys find a way to jailbreak Nodo and give you guys the donation fee rather than to give it to Microsoft because you know that their official unlock method is going to be watered down and limited.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Guys, Chillax!

Lets first see what Microsoft and ChevronWP7 come up with. They said it's going to cost a small fee. So I guess they're talking about a couple of bucks. Just and administrative fee. Well, assuming that is true, I think we shouldn't complain. ChevronWP7 team has negotiated with Microsoft and I'm happy Brandon Watson has realized that Microsoft should embrace the homebrew community.

I think Microsoft wants to register the homebrew people, in order to let you agree with some different license terms in which we probably have to agree with dropping some of the warranties. That sounds resonable.

Let's be honest. Microsoft built a very cool OS and development environment. Silverlight is cool. And Windows Phone is super stable and smooth. It's just too secure for us tweakers. And Microsoft is realizing that now. Let's just be happy about that. The OS also has some missing features etc, but NoDo and Mango make up a lot of that. All will be well. Microsoft wanted to built a secure OS for the majority of people. They monitor everything in the marketplace so the common user will always have a secure and stable phone. If you want to sideload Microsoft just wants you to realize that you may get a bad user experience from that (unstable, bad performance, etc).

So, I will still try to tear the OS apart. Just because I'm curious. I like to get to the bottom of things and be able to tweak every bit of the OS. But I see the Chevron Labs as a good thing. And I like it that Microsoft is turning around on this!

Just my two cents!

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] sinister1:
I guess Microsoft wins this round :( I am literally sitting in front of my computer trying to decide if I should spend the $100 on the damn dve account. I guess the Androids are right, MS does suck.