yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] Jaxbot:
Nope, tried that and it didnt work. Its installed, but I think the problem is its not Trusted. Thats why I want to see if someone with a trusted cert can sign it and see if it accepts it.
[Windows Phone 7 Development and Hacking] slyoldfox:
If you want to move on with the certificate thing, I suppose you should try and find the client certificate on the phone and see which Trusted Root certificate it was signed by? Indeed if you look in your Windows 7 snap-in, you can see a list of ROOT certificates, I ran it a process monitor and here are some interesting registry keys that maybe we should cross check with the registry on a WP7 phone:

HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates

HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs

HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates

You can of course also find the same ones under the HKCU but these are mostly empty (unless you have added some root certificate authority for yourself).
[Windows Phone 7 Development and Hacking] ChrisKringel:
Allright... Lets emulate the marketplace :-D Are the apps requested over http or https? Is there a emulator image available, that is capable of using the marketplace? I'll take a look into Zune and capture some traffic.
[Windows Phone 7 Development and Hacking] Jaxbot:
Whoa whoa whoa calm down people ;) We can't emulate the Marketplace. I've already tried this, and the problem comes down to the fact that XAP files are not only signed, but contain some serious DRM required for installing.

While this *could* be cracked, I think it's probably just easier to stick with what already had going with the updater.
[Windows Phone 7 Development and Hacking] derausgewanderte:
No expert here. But seeing that LG phones have a built in registry editor (see link in my sig) that allows unlocking even after NoDo would this be possible?

Write an app that pulls the MFG registry editor off from an LG phone and the disassemble it, so it can be loaded on any phone?
[Windows Phone 7 Development and Hacking] Jaxbot:
Thing is, the application is built into LG phones, and it's not possible to side load it onto other devices. Also, it only works on LG devices, because it uses the OEM libraries. We have registry editors for all devices, we just don't have the ability to get them on the devices.
[Windows Phone 7 Development and Hacking] ChrisKringel:
Hehe... I took a quick look and the emulation of the marketplace for zune should not be that hard. But i think we'll run into the same certification problems as with the update (as you said). So we still have to figure out how to bypass or trick the update progress.

As for the ROM solution: i think this approach is much more risky than "simply" hack the phone via an update. Plus a custom ROM could also void your warranty preventing people from unlocking their phones...
[Windows Phone 7 Development and Hacking] derausgewanderte:
Yeah, stupid me . I forgot the important next step to sideload a patched reg editor. Its Sunday here ....
[Windows Phone 7 Development and Hacking] Jaxbot:
Right you are. I actually have made a completely custom Marketplace server for WP7 that would spoof the applications listed, and of course, the XAP files. But the problem is, it has to be signed or you just get an error on install.

I really think the update solution is the best, we just need to find a way to get it signed with a regular cert.
[Windows Phone 7 Development and Hacking] ChrisKringel:
You could ask the news sites like WMPoweruser and wpcentral to inform their readers that we're looking for a certficate. The have already written about this topic so they could just edit the articles accordingly...
[Windows Phone 7 Development and Hacking] Jaxbot:
Thought about that.. It seems a little shady, though. But technically, all we're trying to do is sign the cab file, it doesn't really matter at this point of testing who signs it, so long as its signed by someone with a trusted cert.
[Windows Phone 7 Development and Hacking] FlowerPotmen:
Hi Jaxbox

I can only contribute with a donation, so if you put a send donation link, and with the rest of the other 4,000 + viewers sending you one USD, you will be able to buy a cert and try it.

No big loss for anyone wanting to donate a buck, to see if it would work/help.

Looking forward to your donation link. I'm in on this one...

Flowerpotmen
[Windows Phone 7 Development and Hacking] Jaxbot:
While I'm flattered, I don't think donations will be of much use here. If we can't get this unlocked without the need of a $4000 certificate, it's probably not worth it.

But I have faith that we'll find a way ;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
I hate to break it for you, but there is no such thing as a "certificate server" in the sense you're telling. WP7 has a set of certificates in a CA store. Certificates that can be traced back to their root in this store are trusted. There is also a personal store. If you add a certificate, it is stored there. That means it is a certificate that YOU trust. The certificates in the CA store are the ones that Microsoft trusts. The registration process used all certificates to connect to the registration server, but since NoDo it only uses the trusted certificates to connect. That means, that you can't use a self-signed certificate to connect to the registration-server. So if you say "build you own CA", that doesn't really make sense. If you have an unlocked device, then you can use hacks to get TCB access (root access) and then you can add your own certificate to the CA store. But for the purpose of unlocking this is not possible, because you need an unlock first.

That is very generous, but it won't work. When you want to buy such a certificate the issuing authority has to do a background check on you to validate that you are really trustworthy of such a certificate. They will not issue a certificate for these purposes.

The update-cab's are also signed and verified against the CA's. So I guess this is not a very easy thing to exploit.

I have not done really much research yet, but I think the weakest link is still the Microsoft Push Notification Server. If we can fake that server and send a syncml.dm message to it, we're in business. So far I know, the MPNS does not use https (no certs needed) and the syncml.dm messages are also not signed. But this needs more research (arp poisoning + packet sniffing) to see the actual data being transfered from the MPNS to the device and see if there are in fact really no signatures in it. After all, I could be wrong ;)
[Windows Phone 7 Development and Hacking] Jaxbot:
Right you are. I was hoping that someone with a trusted code signing cert (eg someone who works for a software company) could sign a cab to see if it would be recognized, but I'm leaning towards doubt on that one.

I've actually done some looking into on that SyncML stuff, and it looks *really* promising. The problem is, I have no basis for how to use it. The only thing I could find was SMS based provisioning, which is a bit far off :p

So, question is... how does it connect to the push notification server? Is the server the same one you would see for application push notifications? If so, I might just be able to sniff around.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I have no details on this, so I'm guessing here: The phone connects to the MPNS and just keeps the connection alive and waits for notification messages. Apps on the phone can register endpoints for notifications, based on an application-identifier and device-identifier. That means that a notification can be sent to a specific app on a specific device. If a notification with AppId "x-wap-application:syncml.dm" and content-type "application/vnd.syncml.notification", then it will be routed to omadmprc.exe and executed with TCB privileges.

We need to spoof the MPNS server. It is probably over http or https. If it is http, it can easily be spoofed on a wifi network. If it is https I hope it can be spoofed like the classic Chevron-method (install our own certificate and hopefully it will be accepted). Then we need to figure out the details of the push-notification formats. So far I have not seen anything about message-signing, but that needs to be verified too.

Another possibility, that has been mentioned in this thread already, is a custom ROM. But I have no experience in this. I'm not sure if it's possible to do with the current bootloaders. Do they allow unsigned ROM's?
[Windows Phone 7 Development and Hacking] Jaxbot:
I'll play around and see how the push notification stuff works.

As far as ROMs, I'd sway away from that; it's already possible on HTC-esque devices, but Samsung people are in the dark
[Windows Phone 7 Development and Hacking] Heathcliff74:
Well, I'm on Samsung Omnia7. My wife has a Samsung Galaxy S. It's ridiculous to see how many ROM's and other updates there are for that device. The hardware and bootloaders are almost identical to Omnia7 and Focus. So I guess it should be possible. If it is possible on HTC, then there is probably no restriction on signatures on the ROM applied by Microsoft. I'd really like to see custom ROM's for my Omnia. :cool:
[Windows Phone 7 Development and Hacking] Heathcliff74:
About that one... Even in companies that have such certificates, the private keys are stored in a secure location where only few people have access to. They are only used to sign certain data and kept very secret. You won't get someone to sign some test data for you.. I think...

Edit: Well, maybe if you have long blond hair and very big tits... ;)
[Windows Phone 7 Development and Hacking] Jaxbot:
Figured as much. Oh well. And hey, not so much on that last one ;) But I'll try and whip together an example push notification app and then see what services my phone is trying to reach, should be interesting.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Very good. I've meant to work on that, but the WP7 Root Tools is taking me way much more time than I planned to. So if you need any help, just ask. But I need to give the WP7 Root Tools development time too, so I'm a bit limited on time. If you need to sniff your WiFi packets, let me know. I can give you details on that.
[Windows Phone 7 Development and Hacking] Jaxbot:
Yeah, I've had to put a lot aside to give jailbreaking a go. Good work on your root tool development, by the way. As for WiFi sniffing, I normally just hook it up to my computer and disable all data on the phone, since Wireshark doesn't seem to work on my network across different computers. Socketsniff works decently for now, but if you have suggestions, I'm welcome to them ;)

Thanks
[Windows Phone 7 Development and Hacking] Heathcliff74:
Well, I'm not really sure, but I think push-notifications only work over WiFi or cellular data (just like marketplace). Could be wrong though. If you get push-notifications over USB then you better use that, because that's a lot easier. If it doesn't work, then let me know.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
Only a question. But isnt it possible to Hack or Fake or whatever ;) the Windows Phone Developer Registration Tool?
[Windows Phone 7 Development and Hacking] hounsell:
The Developer Registration Tool does very little by itself - it just starts the process on the Phone really.

I suspect the certificate root is a dead-end. Similarly, if the update system is anything like that of Windows, and I believe it does at least use the same server-side infrastructure, it will only accept updates signed by MS.

The whole push-notifications/SyncML route sounds more interesting though.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
OK. It starts the process on the phone means it will download or do something or am i wrong?

Is it comprehensible/understandable what the Windows Phone Developer Registration Tool do, track and copy it?
[Windows Phone 7 Development and Hacking] captain-foivos:
Big Thanks

I want to say a big big thanks to:

Jaxbot

ChrisKringel

and Heathcliff74

primarly for starting and continueing this effort to unlock NoDo. And also others that contribute to this

Guys ..you have the full support of all XDA community on this...
[Windows Phone 7 Development and Hacking] MarcHoover:
Yep, thats what I mean. Sniff the Traffic (USB/TCP) and relay it "manipulated" to the phone. Done.
[Windows Phone 7 Development and Hacking] ChrisKringel:
Yep. Another interesting approach. Since i don't own a WP7 myself (still waiting for 2nd Gen Devices ;-) ) i could really use som information about the push/syncml system itself. Would you mind sharing some insights with me :-D?

Thanks in advance
[Windows Phone 7 Development and Hacking] LongZheng:
One of the first things we tried.
[Windows Phone 7 Development and Hacking] MarcHoover:
Oh,... okay... with which result?
[Windows Phone 7 Development and Hacking] Heathcliff74:
LOL! The result was the ChevronWP7 tool. Zheng, Rivera and Walsh built it. But the certificate exploit has now been 'fixed' by Microsoft.
[Windows Phone 7 Development and Hacking] Jaxbot:
The TCP traffic of the registration tool, or of the SyncML system?

I'm well aware of this regarding the former ;) But I'm a little worried about the latter. Still need to experiment a bit more though.
[Windows Phone 7 Development and Hacking] WithinRafael:
I have certs, the idea of signing your own updates/Marketplace should be abandoned for the reasons Heath mentioned (two stores, your personal store is no longer looked at for sensitive operations).
[Windows Phone 7 Development and Hacking] Jaxbot:
Thanks for confirming, I wasn't sure whether or not they patched it for everything or just the unlocking function. Time to dig another hole...
[Windows Phone 7 Development and Hacking] WithinRafael:
What sucks is this fix also hampers https sniffing. We're at a point where we can't even see what's being exchanged back and forth anymore -- scary if you think about it.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yep. Except there are more stores:

- MY

- CA

- Root

- Code Integrity (Used to check exe-files to determine privileges for its chamber)

- TCB (this one seems empty though)

- Messaging
[Windows Phone 7 Development and Hacking] Jaxbot:
Exactly, which makes it almost impossible to figure out some of the things the phone does. Though, I don't think we have to worry about our phone sending off info it shouldn't, but who knows at this point ;)
[Windows Phone 7 Development and Hacking] Jaxbot:
But can you use a CA cert to sign an update, on the rare offchance you could get one?
[Windows Phone 7 Development and Hacking] Heathcliff74:
I haven't actually tried, but I think I can add my own cert to this store. Problem is, that I can only do it on an unlocked device. So that is not useful for unlocking a device. I have an exploit that I can use on Samsung devices that has access to these stores :)
[Windows Phone 7 Development and Hacking] WithinRafael:
I suppose you could use some native code + TCB access to insert certificates into the other stores; haven't really had time to test that out. Would be good to know for ssl auditing at least.
[Windows Phone 7 Development and Hacking] Jaxbot:
Agreed, it's certainly a useful thing to have access to, even if it requires an unlocked device.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I can confirm that it works! :cool: I just added the ChevronWP7 cert to the CA store. LOL!
[Windows Phone 7 Development and Hacking] Jaxbot:
Say, is it a NoDo device? Might want to try ChevronWP7 Unlocker and see if it can communicate, unless you already have changed the portal URL
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yes, it is a NoDo device. And I already removed the Portal URL before the upgrade to NoDo. This is my only WP7 device and also my phone for daily use and also my dev phone for WP7 Root Tools, so I don't want to risk locking it. But I'm quite sure that it would work.
[Windows Phone 7 Development and Hacking] Jaxbot:
Can't say I blame you :\ But I'm sure this could prove extremely useful in the future, especially if we're looking at unofficial updates. But first things first ;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Yes. I think it is. Might also be useful to add our own cert to the Code Integrity store. We'll be able to run our own self-signed exe's :)

Edit: I really need to finish the Certificate Store in WP7 Root Tools too! To bad this is only for Samsung devices. I've been working on exploits for other devices too, but unsuccessful so far.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I did a little bit of poking around in the certificate stores. This is what I found:

CA

This store contains 21 pre-installed certs from Certified Authorities, like "Comodo", "Cybertrust", "MicrosoftGenuineWindowsPhoneCA3", "MicrosoftWindowsPhonePCA", etc. I can install certificates here with an exploit I found. :)

MY

This store contains 4 pre-installed certificates that are related to the phone-identity. There are names like "Phone Identity" and "Zune-tuner", etc.

TCB

This is one of the names I tried and it works. It is an empty store, but I can add a certificate to it. I'm not sure what it is used for.

ROOT

This one contains 57 pre-installed certificates that are related to Root CA's. They are different from the certs in the "CA" store. But in this store are also 2 certs that I installed myself using the normal installation method: mailed the cert to myself and clicked it to install. Just like we used to install the ChevronWP7 cert. Really weird that these certs show up in the "ROOT" store.

There are two certificate store names that can be found in the registry, but I can't open them. They are "Code Integrity" and "Messaging". I also tried "CI", "Code%20Integrity", "MSG" and names like that, but I get an error when I try these names. I'm not sure why that is. Maybe the "TCB" store has to do with it.
[Windows Phone 7 Development and Hacking] WithinRafael:
Should work fine now that he has the cert. where he needs it. But keep in mind, his phone is already unlocked. Doesn't really solve the initial problem.
[Windows Phone 7 Development and Hacking] Heathcliff74:
If only I could put it there when I would need it! Too bad I can only put it where I need it, when I don't need it anymore ;)

Edit: LOL, you beat me to it.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
I really didn't understand it. When the Windows Phone Developer Registration tool do something (whatever... i haven't got a clue) to officially unlock my device, without the need of the first step to install a cert. manually, it is not possible to catch the process of the registration tool and use this to unlock other devices?
[Windows Phone 7 Development and Hacking] Heathcliff74:
The unlock tool initiates the unlock-process on the device. The device contacts a Microsoft server to validate the developer account. The Microsoft server is authenticated with certificates. There was a security hole that ChevronWP7 guys found that let install a cert so that the Microsoft server could be spoofed. That hole is now 'fixed' in NoDo. So the WP7 device will only unlock when it can verify against an authenticated Microsoft server. And this can't be spoofed now anymore. So the process can not be simulated anymore.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
Thanks, Heathcliff74. Now i got it.
[Windows Phone 7 Development and Hacking] MarcHoover:
I was talking about NoDo not the things happen before NoDo ;p

This is the answer I looked for! Thank you guy :) (I know my english is really bad).

Can I help someone (e.g. for testing)? I can unlock and relock my NoDo device.
[Windows Phone 7 Development and Hacking] Heathcliff74:
You mean you have a genuine unlocked device? At the moment I don't have any tests that I would like to perform. But if I need it, I will let you know. Thanks.
[Windows Phone 7 Development and Hacking] e.v.o:
How about StartSSL Free?

They offer free SSL Certificates...
[Windows Phone 7 Development and Hacking] Der Fuzzy:
I have a official unlocked device, too. IF you need some help. ;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
from the site:

The free certs are Class 1. You would probably at least Class 2 certs in order to pass authentication on the WP7 device. For that you will be background-checked and the certs will be revoked if abused.
[Windows Phone 7 Development and Hacking] Der Fuzzy:
What about a donation for officially unlock your device? If the device is unlocked, like my device, you can lock, unlock how often you want and search a way for jailbreaking.

After it is not possible to unlock other devices with my account :( i think it's the fastest way.
[Windows Phone 7 Development and Hacking] ruscik:
One option no one mentioned. After each update zune makes backup of phone or of some parts of it (update dependent). Last security update dealt with certificates and it also backed up. As such it must have backed up certs as well as registry.

Would it not be possible to edit that backup and then use zune to restore? I used restore with no internet connection.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Before you donate, please consider the following:

- I have an unofficially unlocked NoDo device. I can't lock it because I probably can't unlock after that (only possibility would be flashing an old ROM, unlock, prevent relock, upgrade to NoDo, reinstall all apps, docs, settings, etc). Way too much work, since I use my phone 24/7. So an official unlock would help, because then I can lock my phone for testing and then unlock again to continue development / hacking. But I don't know how much it would actually help. Having a dev account absolutely does not guarantee that I can hack it. It's possible that I will never be able to. Keep that in mind.

- I also have other hacking / development projects like WP7 Root Tools and more. I have to put time in those projects too.

- I also have a life. I have a wife, kids, family. My mother is recovering from brain-surgery. I have a decent job. So I'm putting much time in hacking, because it's a challenge for me and I enjoy it. But I can't be hacking all the time.

- If you donate money, that is not a guarantee that others will donate too and there may not be enough money to buy a dev account.

- If I manage to hack it, the hack may be undone when Mango is released (or an interim update). So it may possibly work for limited time.

Point is: If you donate, I don't want to expect you that I will keep on hacking till I drop or till it's hacked. Because that is not realistic and I don't want to feel guilty when I spend quality time with family or doing work for my boss or sleep.

If you still feel comfortable donating money to me for an official dev-account, then I don't mind you hit the 'donate to me' button :)
[Windows Phone 7 Development and Hacking] Marvin_S:
Has anybody tried if this will work:

- Unlock with dev-account

- Install Samsung Tools or some similar app to edit the registry

- Run Samsung Tools

- Relock with WPDR-tool (while Samsung Tools is active)

- Run Samsung Tools to do the registry edits again

or will step 5 not be possible anymore?

In theory one can have unlimited unlocks with 1 dev account.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I have discussed this. It is a realistic possibility. It should be researched. It is difficult however. The backup is encrypted and possibly signed. So the decryption/encryption of the backup needs to be figured out. It is also possible that during the upgrade/backup, a hash of the backup is sent online to request a signature for that. If that is the case, then that needs to be spoofed too (fake a legit backup and request the signature ourselves).

The last update did not backup certs in the sense you put it. The update was mainly an update to the revocationlist of the certificates.
[Windows Phone 7 Development and Hacking] Heathcliff74:
After a relock all sideloaded apps don't work anymore until you unlock again. If you try to run them they will even get uninstalled.

Edit: I see you edited your post. In the edited post you propose to run WP7 Root Tools while locking the device. I'm not sure the sideloaded app will be killed on relocking. It might work. But what help would it be us?