[Windows Phone 7 General] shreedharcva:
I happened to look into the WinPho7 Unlocking and found some important items. Chevron team also thinks the same way If I'm right.

1. When We connect our WinPho7 to PC, Zune software creates a proxy server at port 27071 (or something like that) and redirects all calls to localhost(127.0.0.1@27071port) to TCP2UDP port for Mobile Device.

2. All Mobile Related Activities are handled by the dll files ZuneDriver.dll,ZuneTcp2Udp.dll,ZuneIpTransport.dll,ZuneRegUtil.dll and ZuneTcp2Udp.dll).

3. All Communication from PC/Zune software to Device always happens over TCP2UDP, and thats the reason connection issues occur.So never ever close Zune once u connect Device, If u close ZUne, then disconnect device and reconnect.

Coming to Device Unlocking

Well In SDK We can find 2 dll files PhoneRegDll.dll and msidcrl40.dll, which are the main items that handle all unlocking of the device.

Actually when u try to unlock the device, using LiveId and password, a HashToken is generated and returned by liveId authentication along with some secretKey and CryptKey, which is again authenticated with passportservices to get a 300-500 character length encrypted token which is actually a CertificateStoreItem generated by the microsoft passport service. (sorry for this lengthy sentence)

These dll's and transport methods in the dll's convert this into a certificate and install

###REF msidcrl40.dll PE signatures (few of them only)

// ?g_strResponse@@3V?$CStringT@_WV?$StrTraitATL@_WV?

// BuildAuthTokenRequest; Index 26;	Information not available

// BuildServiceTokenRequest; Index 27;	Information not available

// PutTokenResponse; Index 28;	Information not available

// InitializeEx; Index 29;	Information not available

// GetWebAuthUrl; Index 30;	Information not available

// LogonIdentityEx; Index 31;	Information not available

// AuthIdentityToServiceEx; Index 33;	Information not available

// GetAuthStateEx; Index 34;	Information not available

// GetCertificate; Index 35;	Information not available

// BuildServiceTokenRequestEx; Index 36;	Information not available

// BuildAuthTokenRequestEx; Index 37;	Information not available

// CancelPendingRequest; Index 38;	Information not available

// PutTokenResponseEx; Index 39;	Information not available

// VerifyCertificate; Index 40;	Information not available

// GetIdentityPropertyByName; Index 41;	Information not available

// CreateIdentityHandleFromAuthState; Index 42;	Information not available

// ExportAuthState; Index 43;	Information not available

// CacheAuthState; Index 44;	Information not available

// RemoveAuthStateFromCache; Index 45;	Information not available

To find the reference method calls and dll export functions I Used PE Explorer and DllExportViewer along with DependencyWalker, and anybody can check it for verification. I'm attaching the typelib reference from ZuneDriver

ZuneDriver.dll TypeLib exports

//Zune Driver for WUDF 1.0 Type Library

//Version: 1.0

ZuneDriverLib;

GUID = {BC86C3E6-D4A6-41DF-B272-DB2117D095EE};

//ZuneDriver Class

CoClass ZuneDriver;

GUID = {2E2C3051-B7B7-4D51-8C57-784BA5AC0FF0};

//IDriverEntry Interface

Interface IDriverEntry;

GUID = {1BEC7499-8881-4F2B-B01C-A1A907304AFC};

function OnInitialize(pWdfDriver: ^IWDFDriver): HResult; stdcall;

function OnDeviceAdd(pWdfDriver: ^IWDFDriver; pWdfDeviceInit: ^IWDFDeviceInitialize): HResult; stdcall;

function OnDeinitialize(pWdfDriver: ^IWDFDriver); stdcall;

//IWDFDriver Interface

Interface IWDFDriver;

GUID = {AD368EBE-4139-43E3-A875-69B266A9139C};

function CreateDevice(pDeviceInit: ^IWDFDeviceInitialize; pCallbackInterface: IUnknown; out ppDevice: ^^IWDFDevice): HResult; stdcall;

function CreateWdfObject(pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfObject: ^^IWDFObject): HResult; stdcall;

function CreatePreallocatedWdfMemory(pBuff: ^UI1; BufferSize: ULONG_PTR; pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfMemory: ^^IWDFMemory): HResult; stdcall;

function CreateWdfMemory(BufferSize: ULONG_PTR; pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfMemory: ^^IWDFMemory): HResult; stdcall;

function IsVersionAvailable(pMinimumVersion: ^UMDF_VERSION_DATA): I4; stdcall;

function RetrieveVersionString(out pVersion: LPWSTR; out pdwVersionLength: ^UI4): HResult; stdcall;

//IWDFObject Interface

Interface IWDFObject;

GUID = {64275C66-2E71-4060-B5F4-3A76DF96ED3C};

function DeleteWdfObject: HResult; stdcall;

function AssignContext(pCleanupCallback: ^IObjectCleanup; pContext: ^VOID): HResult; stdcall;

function RetrieveContext(out ppvContext: ^^VOID): HResult; stdcall;

function AcquireLock; stdcall;

function ReleaseLock; stdcall;

//IObjectCleanup Interface

Interface IObjectCleanup;

GUID = {244ABE3A-ABBC-43B1-A877-F00077550E6A};

function OnCleanup(pWdfObject: ^IWDFObject); stdcall;

//IWDDeviceInitialize Interface

Interface IWDFDeviceInitialize;

GUID = {74CC381C-0871-43C1-878B-3F7C9D16933D};

function SetFilter; stdcall;

function SetLockingConstraint(LockType: _WDF_CALLBACK_CONSTRAINT); stdcall;

function RetrieveDevicePropertyStore(pcwszServiceName: ^UI2; Flags: _WDF_PROPERTY_STORE_RETRIEVE_FLAGS; out ppPropStore: ^^IWDFNamedPropertyStore; out pDisposition: ^_WDF_PROPERTY_STORE_DISPOSITION): HResult; stdcall;

function SetPowerPolicyOwnership(fTrue: I4); stdcall;

function AutoForwardCreateCleanupClose(State: _WDF_TRI_STATE); stdcall;

function RetrieveDeviceInstanceId(out Buffer: LPWSTR; out pdwSizeInChars: ^UI4): HResult; stdcall;

function SetPnpCapability(Capability: _WDF_PNP_CAPABILITY; Value: _WDF_TRI_STATE); stdcall;

function GetPnpCapability(Capability: _WDF_PNP_CAPABILITY): _WDF_TRI_STATE; stdcall;

Enum _WDF_CALLBACK_CONSTRAINT;

None = 0;

WdfDeviceLevel = 1;

WdfLevelReserved = 2;

WdfLevelMaximum = 3;

Enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS;

WdfPropertyStoreNormal = 0;

WdfPropertyStoreCreateIfMissing = 1;

Interface IWDFNamedPropertyStore;

GUID = {394B48C9-BCA0-498F-8E2C-01225464A932};

function GetNamedValue(pszName: LPWSTR; out pv: ^^VOID): HResult; stdcall;

function SetNamedValue(pszName: LPWSTR; pv: ^^VOID): HResult; stdcall;

function GetNameCount(out pdwCount: ^UI4): HResult; stdcall;

function GetNameAt(iProp: UI4; out ppwszName: ^LPWSTR): HResult; stdcall;

Enum _WDF_PROPERTY_STORE_DISPOSITION;

CreatedNewStore = 1;

OpenedExistingStore = 2;

Enum _WDF_TRI_STATE;

WdfUseDefault = 0;

WdfFalse = 1;

WdfTrue = 2;

Enum _WDF_PNP_CAPABILITY;

WdfPnpCapInvalid = 0;

WdfPnpCapLockSupported = 1;

WdfPnpCapEjectSupported = 2;

WdfPnpCapRemovable = 3;

WdfPnpCapDockDevice = 4;

WdfPnpCapSurpriseRemovalOk = 5;

WdfPnpCapNoDisplayInUI = 6;

WdfPnpCapMaximum = 7;

//IWDFDevice Interface

Interface IWDFDevice;

GUID = {D657FE45-460A-49C3-8219-766AE8032A80};

function RetrieveDevicePropertyStore(pcwszServiceName: ^UI2; Flags: _WDF_PROPERTY_STORE_RETRIEVE_FLAGS; out ppPropStore: ^^IWDFNamedPropertyStore; out pDisposition: ^_WDF_PROPERTY_STORE_DISPOSITION): HResult; stdcall;

function GetDriver(out ppWdfDriver: ^^IWDFDriver); stdcall;

function RetrieveDeviceInstanceId(out Buffer: LPWSTR; out pdwSizeInChars: ^UI4): HResult; stdcall;

function GetDefaultIoTarget(out ppWdfIoTarget: ^^IWDFIoTarget); stdcall;

function CreateWdfFile(pcwszFileName: LPWSTR; out ppFile: ^^IWDFDriverCreatedFile): HResult; stdcall;

function GetDefaultIoQueue(out ppWdfIoQueue: ^^IWDFIoQueue); stdcall;

function CreateIoQueue(pCallbackInterface: IUnknown; bDefaultQueue: I4; DispatchType: _WDF_IO_QUEUE_DISPATCH_TYPE; bPowerManaged: I4; bAllowZeroLengthRequests: I4; out ppIoQueue: ^^IWDFIoQueue): HResult; stdcall;

function CreateDeviceInterface(pDeviceInterfaceGuid: ^GUID; pReferenceString: LPWSTR): HResult; stdcall;

function AssignDeviceInterfaceState(pDeviceInterfaceGuid: ^GUID; pReferenceString: LPWSTR; Enable: I4): HResult; stdcall;

function RetrieveDeviceName(out pDeviceName: LPWSTR; out pdwDeviceNameLength: ^UI4): HResult; stdcall;

function PostEvent(EventGuid: ^GUID; EventType: _WDF_EVENT_TYPE; pbData: ^UI1; cbDataSize: UI4): HResult; stdcall;

function ConfigureRequestDispatching(pQueue: ^IWDFIoQueue; RequestType: _WDF_REQUEST_TYPE; Forward: I4): HResult; stdcall;

function SetPnpState(State: _WDF_PNP_STATE; Value: _WDF_TRI_STATE); stdcall;

function GetPnpState(State: _WDF_PNP_STATE): _WDF_TRI_STATE; stdcall;

function CommitPnpState; stdcall;

function CreateRequest(pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppRequest: ^^IWDFIoRequest): HResult; stdcall;

function CreateSymbolicLink(pSymbolicLink: LPWSTR): HResult; stdcall;

//IWDFIoTarget Interface

Interface IWDFIoTarget;

GUID = {CC060D79-C0C2-407F-8B10-A5E900FC3474};

function GetTargetFile(out ppWdfFile: ^^IWDFFile); stdcall;

function CancelSentRequestsForFile(pFile: ^IWDFFile); stdcall;

function FormatRequestForRead(pRequest: ^IWDFIoRequest; pFile: ^IWDFFile; pOutputMemory: ^IWDFMemory; pOutputMemoryOffset: ^_WDFMEMORY_OFFSET; DeviceOffset: ^I8): HResult; stdcall;

function FormatRequestForWrite(pRequest: ^IWDFIoRequest; pFile: ^IWDFFile; pInputMemory: ^IWDFMemory; pInputMemoryOffset: ^_WDFMEMORY_OFFSET; DeviceOffset: ^I8): HResult; stdcall;

function FormatRequestForIoctl(pRequest: ^IWDFIoRequest; IoctlCode: UI4; pFile: ^IWDFFile; pInputMemory: ^IWDFMemory; pInputMemoryOffset: ^_WDFMEMORY_OFFSET; pOutputMemory: ^IWDFMemory; pOutputMemoryOffset: ^_WDFMEMORY_OFFSET): HResult; stdcall;

//IWDFFile Interface

Interface IWDFFile;

GUID = {CC8FE04B-FE8B-4245-AFD6-C31BC830C791};

function RetrieveFileName(out pFileName: LPWSTR; out pdwFileNameLengthInChars: ^UI4): HResult; stdcall;

function GetDevice(out ppWdfDevice: ^^IWDFDevice); stdcall;

//IWDFIoRequest Interface

Interface IWDFIoRequest;

GUID = {896DF312-22B4-4A9D-95DD-A364AAF59769};

function CompleteWithInformation(CompletionStatus: HResult; Information: ULONG_PTR); stdcall;

function SetInformation(Information: ULONG_PTR); stdcall;

function Complete(CompletionStatus: HResult); stdcall;

function SetCompletionCallback(pCompletionCallback: ^IRequestCallbackRequestCompletion; pContext: ^VOID); stdcall;

function GetType: _WDF_REQUEST_TYPE; stdcall;

function GetCreateParameters(out pOptions: ^UI4; out pFileAttributes: ^UI2; out pShareAccess: ^UI2); stdcall;

function GetReadParameters(out pSizeInBytes: ^ULONG_PTR; out pullOffset: ^I8; out pulKey: ^UI4); stdcall;

function GetWriteParameters(out pSizeInBytes: ^ULONG_PTR; out pullOffset: ^I8; out pulKey: ^UI4); stdcall;

function GetDeviceIoControlParameters(out pControlCode: ^UI4; out pInBufferSize: ^ULONG_PTR; out pOutBufferSize: ^ULONG_PTR); stdcall;

function GetOutputMemory(out ppWdfMemory: ^^IWDFMemory); stdcall;

function GetInputMemory(out ppWdfMemory: ^^IWDFMemory); stdcall;

function MarkCancelable(pCancelCallback: ^IRequestCallbackCancel); stdcall;

function UnmarkCancelable: HResult; stdcall;

function CancelSentRequest: I4; stdcall;

function ForwardToIoQueue(pDestination: ^IWDFIoQueue): HResult; stdcall;

function Send(pIoTarget: ^IWDFIoTarget; Flags: UI4; Timeout: I8): HResult; stdcall;

function GetFileObject(out ppFileObject: ^^IWDFFile); stdcall;

function FormatUsingCurrentType; stdcall;

function GetRequestorProcessId: UI4; stdcall;

function GetIoQueue(out ppWdfIoQueue: ^^IWDFIoQueue); stdcall;

function Impersonate(ImpersonationLevel: _SECURITY_IMPERSONATION_LEVEL; pCallback: ^IImpersonateCallback; pvCallbackContext: ^VOID): HResult; stdcall;

function IsFrom32BitProcess: I4; stdcall;

function GetCompletionParams(out ppCompletionParams: ^^IWDFRequestCompletionParams); stdcall;

Alias ULONG_PTR;

UI4

//IRequestCallbackRequestCompletion Interface

Interface IRequestCallbackRequestCompletion;

GUID = {8A7CC8CB-CEB2-46F6-9851-77BD347A15C2};

function OnCompletion(pWdfRequest: ^IWDFIoRequest; pIoTarget: ^IWDFIoTarget; pParams: ^IWDFRequestCompletionParams; pContext: ^VOID); stdcall;

//IWDFRequestCompletionParams Interface

Interface IWDFRequestCompletionParams;

GUID = {707A2B42-69B8-4971-A49C-4031861E7AFF};

function GetCompletionStatus: HResult; stdcall;

function GetInformation: ULONG_PTR; stdcall;

function GetCompletedRequestType: _WDF_REQUEST_TYPE; stdcall;

Enum _WDF_REQUEST_TYPE;

WdfRequestUndefined = 0;

WdfRequestCreate = 1;

WdfRequestCleanup = 2;

WdfRequestRead = 3;

WdfRequestWrite = 4;

WdfRequestDeviceIoControl = 5;

WdfRequestClose = 6;

WdfRequestUsb = 7;

WdfRequestOther = 8;

WdfRequestInternalIoctl = 9;

WdfRequestTypeNoFormat = 10;

WdfRequestMaximum = 11;

//IWDFMemory Interface

Interface IWDFMemory;

GUID = {AB098F88-8F16-472A-B0BC-ECA46486C102};

function CopyFromMemory(Source: ^IWDFMemory; SourceOffset: ^_WDFMEMORY_OFFSET): HResult; stdcall;

function CopyToBuffer(SourceOffset: ULONG_PTR; TargetBuffer: ^VOID; NumOfBytesToCopyTo: ULONG_PTR): HResult; stdcall;

function CopyFromBuffer(DestOffset: ULONG_PTR; SourceBuffer: ^VOID; NumOfBytesToCopyFrom: ULONG_PTR): HResult; stdcall;

function GetSize: ULONG_PTR; stdcall;

function GetDataBuffer(out BufferSize: ^ULONG_PTR): ^VOID; stdcall;

function SetBuffer(Buffer: ^VOID; BufferSize: ULONG_PTR); stdcall;

Record _WDFMEMORY_OFFSET;

BufferOffset: ULONG_PTR;

BufferLength: ULONG_PTR;

//IRequestCallbackCancel Interface

Interface IRequestCallbackCancel;

GUID = {4E9F1A77-4587-4235-81C4-E6D24545A656};

function OnCancel(pWdfRequest: ^IWDFIoRequest); stdcall;

//IWDFIoQueue Interface

Interface IWDFIoQueue;

GUID = {AE1162B9-8B11-4714-993D-93DC48CC9E8A};

function GetDevice(out ppWdfDevice: ^^IWDFDevice); stdcall;

function ConfigureRequestDispatching(RequestType: _WDF_REQUEST_TYPE; Forward: I4): HResult; stdcall;

function GetState(out pulNumOfRequestsInQueue: ^UI4; out pulNumOfRequestsInDriver: ^UI4): _WDF_IO_QUEUE_STATE; stdcall;

function RetrieveNextRequest(out ppRequest: ^^IWDFIoRequest): HResult; stdcall;

function RetrieveNextRequestByFileObject(pFile: ^IWDFFile; out ppRequest: ^^IWDFIoRequest): HResult; stdcall;

function Start; stdcall;

function Stop(pStopComplete: ^IQueueCallbackStateChange); stdcall;

function StopSynchronously; stdcall;

function Drain(pDrainComplete: ^IQueueCallbackStateChange); stdcall;

function DrainSynchronously; stdcall;

function Purge(pPurgeComplete: ^IQueueCallbackStateChange); stdcall;

function PurgeSynchronously; stdcall;

Enum _WDF_IO_QUEUE_STATE;

WdfIoQueueAcceptRequests = 1;

WdfIoQueueDispatchRequests = 2;

WdfIoQueueNoRequests = 4;

WdfIoQueueDriverNoRequests = 8;

WdfIoQueuePnpHeld = 16;

//IQueueCallbackStateChange Interface

Interface IQueueCallbackStateChange;

GUID = {E7ECE381-7CB1-468A-BC43-ABD5948FFC75};

function OnStateChange(pWdfQueue: ^IWDFIoQueue; QueueState: _WDF_IO_QUEUE_STATE); stdcall;

Enum _SECURITY_IMPERSONATION_LEVEL;

SecurityAnonymous = 0;

SecurityIdentification = 1;

SecurityImpersonation = 2;

SecurityDelegation = 3;

//IImpersonateCallback Interface

Interface IImpersonateCallback;

GUID = {99B01D17-9FBD-4AA6-B16D-82DAB6A4107F};

function OnImpersonate(Context: ^VOID); stdcall;

//IWDFDriverCreatedFile Interface

Interface IWDFDriverCreatedFile;

GUID = {B7615D26-494B-47A6-B4CF-0271BCC3DA4B};

function Close; stdcall;

Enum _WDF_IO_QUEUE_DISPATCH_TYPE;

WdfIoQueueDispatchSequential = 1;

WdfIoQueueDispatchParallel = 2;

WdfIoQueueDispatchManual = 3;

WdfIoQueueDispatchMaximum = 4;

Enum _WDF_EVENT_TYPE;

WdfEventReserved = 0;

WdfEventBroadcast = 1;

WdfEventMaximum = 2;

Enum _WDF_PNP_STATE;

WdfPnpStateInvalid = 0;

WdfPnpStateDisabled = 1;

WdfPnpStateFailed = 2;

WdfPnpStateRemoved = 3;

WdfPnpStateResourcesChanged = 4;

WdfPnpStateDontDisplayInUI = 5;

WdfPnpStateNotDisableable = 6;

WdfPnpStateMaximum = 7;

Record UMDF_VERSION_DATA;

MajorNumber: UI4;

MinorNumber: UI4;

ServiceNumber: UI4;

Note: I'm not a Microsoft developer or a hacker or a cracker.I just do some research by peeping into dll's and exe's for fun.