[Windows Phone 7 Q&A, Help & Troubleshooting] experience7:
Hello :)

These are just my assumptions.. and I'll edit this post with everything I found out. If you find wrong information, please correct and help me solving this "problem". I'd be relly glad if someone could clarify this whole thing:

If you're updating your phone to Mango (maybe all other updates too), there'll be a .cab file which provisions your registry with some new entries that are needed for Zune to recognize your phone as a developers device and show up the update message. This .cab file (which is basically comparable with a little update) can edit entries in the phones registry without having a developer unlock. A good example is this method to get the Mango update: @windowsphonehacker.com. Even with the value "DeveloperUnlockState" set to 0 you can use this tool to update to Mango.

In our example the "prov.cab" which is part of the tool "says" the phone to change/create the following registry entries:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\DeviceUpdate\Agent\Protocol]
"TestTarget"="15c00000-0003-0001-c0d4-m4a1f005ba11"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\DeviceUpdate\Agent\Settings]
"GuidOfCategoryToScan"="0fdd4743-cba1-4a2b-af7c-5af9fd93951a"

With this two keys changed and your phone plugged to your PC you'll be able to get the update.

Now.. if we could edit this .cab file so that it tells the phone something like this...

[HKEY_LOCAL_MACHINE\Comm\Security\LVMod]
"DeveloperUnlockState"=dword:1
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]
"PortalUrlProd"=""
"PortalUrlInt"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7fffffff

...we should be able to jailbreak any version of WP7 :)

What I figured out is that you can easily unzip the .cab file. You'll get a .pkg file which is also an archive. After extracting this one there are three more files:

61784efe-031a-4673-b7a0-16d3f78efc2e.dsm

61784EFE-031A-4673-B7A0-16D3F78EFC2E.rgu

mxipupdate_DeviceUpdateSelfhost_200.provxml

Okay, in short:

prov.cab

|

UNZIP

|

v

DeviceProvisioning.cab.pkg

|

UNZIP

|

v

61784efe-031a-4673-b7a0-16d3f78efc2e.dsm

[COLOR="DarkRed"]IN EDITOR:[/COLOR]
[COLOR="Gray"]Nothing useful :o Just hieroglyphs.. maybe it's encrypted :(
EDIT: I found a tool which can read/write/save this .dsm files: [URL="http://xdaforums.com/showthread.php?t=523139"]DSM Editor[/URL]. But the information it shows me is still worthless for me.. I don't understand anything of it =/[/COLOR]

61784EFE-031A-4673-B7A0-16D3F78EFC2E.rgu

[COLOR="DarkRed"]IN EDITOR:[/COLOR]
[COLOR="Gray"]REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\DeviceUpdate\Agent\Protocol]
"MuReDirCabUrl1"="http://download.windowsupdate.com/WM/MicrosoftUpdate/redir/duredir.cab"
"MuReDirCabUrl2"="http://download.microsoft.com/WM/MicrosoftUpdate/redir/duredir.cab"
"MuReDirCabUrl3"="http://www.update.microsoft.com/WM/MicrosoftUpdate/Redir/duredir.cab"
"TestTarget"="15c00000-0003-0001-c0d4-m4a1f005ba11"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\DeviceUpdate\Agent\Settings]
"GuidOfCategoryToScan"="0fdd4743-cba1-4a2b-af7c-5af9fd93951a"[/COLOR]

mxipupdate_DeviceUpdateSelfhost_200.provxml

[COLOR="DarkRed"]IN EDITOR:[/COLOR]
[COLOR="Gray"]<!--
Copyright (c) Microsoft Corporation. All rights reserved.
-->
<!--
Use of this source code is subject to the terms of the Microsoft
premium shared source license agreement under which you licensed
this source code. If you did not accept the terms of the license
agreement, you are not authorized to use this source code.
For the terms of the license, please see the license agreement
signed by you and Microsoft.
THE SOURCE CODE IS PROVIDED "AS IS", WITH NO WARRANTIES OR INDEMNITIES.
-->

<wap-provisioningdoc>
<characteristic type="Registry">
<characteristic type="HKLM\Software\Microsoft\Windows\DeviceUpdate\Agent\Protocol">
<parm name="ClientServerUrl" value="" datatype="string"/>
<parm name="IdentCabFileSize" value="0" datatype="integer"/>
<parm name="IdentCabUrl" value="" datatype="string" />
<parm name="IdentCabFileSize" value="0" datatype="integer"/>
<parm name="ReDirCabFileSize" value="0" datatype="integer"/>
<parm name="ReDirectorId" value="0" datatype="integer"/>
<parm name="ReportingServerUrl" value="" datatype="string" />
<parm name="SelfUpdateCabUrl" value="" datatype="string" />
</characteristic>
</characteristic>
</wap-provisioningdoc>[/COLOR]

Another thing I noticed was that some of those files where digitally signed with a certificate (e.g. right click the prov.cab and you'll see a tab showing the certificate). After modifying any of these files they loose their signature and you can't "update" them via the UpdateWP.exe - it throws out an error. I searched for quite a long time on how to resign the modified files.. I came over a tool named "signcode.exe" - it seems to be able to sign files (.exe, .dll, .cab). I was able to sign the original prov.cab but not my modified one. But after replacing Microsofts signature of the original prov.cab file with mine (<- found a .cer + .pvk) in the internet, I wasn't able to get the prov.cab "updated" to my phone.

Maybe this is way to complicated and there's a much easier solution.. but any help is appreciated :)

Thanks in advance,

experience7