yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] erebusting:
I hope a solution is found soon ...i am looking forward to it :)
[Windows Phone 7 Development and Hacking] andrew35133:
I wonder what HTC would do if we asked them to stop making these devices so locked down. But what stops us from editing the whitelist and blacklist?
[Windows Phone 7 Development and Hacking] Blinx:
The problem is not in editing the dll, but the way you'll push it to the device once it's modified.

Plus the dll might be signed, so it won't work after beeing modifyed.
[Windows Phone 7 Development and Hacking] jdbastardy:
If we could just do this we will had fixed this long ago i think.
[Windows Phone 7 Development and Hacking] Heathcliff74:
With my file-deployment-exploit it is possible to overwrite some of the files on the device. The white-list we are referring here to is a ROM file. So it can't be modified. The only way to modify it is sending an unsigned cab update, but you need to have a special crafted custom ROM for that.

It's also not possible to overwrite dll's from apps with this exploit. Well, actually, you can overwrite the dll's, but it will break the app, because when an app is installed with DRM (not side-loaded), then the signatures of the dll's are stored in a database and checked by the loader-verifier, when the dll is loaded into memory. If the signature is missing, invalid or different, the dll won't load and the app will not function or crash.

Hope that clarifies it for you.

Heathcliff74
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Thank you, @jandevries12. I think what you guessed to be a blacklist is actually just another whitelist; "<nocharacteristic type=[registry value]>" is valid provxml and says to delete a registry key.

There are a few good, and a few bad, things visible here. The good:

We now know what parts of the registry we should have access to.

We have access to some potentially interesting provision capabilities, such as "APPLICATION" (potentially only, I don't know what to do with it now).

There is a file, probably not signed and possibly overwritable, which may affect the behavior of the driver.

The bad:

The list of valid registry paths is pretty limited.

The "FileOperation" provider type doesn't seem to be allowed (this is used to copy or delete files).

I have an evil plan. Testing...
[Windows Phone 7 Development and Hacking] Heathcliff74:
Not sure about this, but I conclude so far:

- Fileoperation is allowed

- The white-list is a bit longer :) Just open ApprovedlistDB.db in a plain-text-editor.

- And no, ApprovedlistDB.db can't be overwritten, because it is a ROM-file.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] jdbastardy:
What does this do?

EDIT: read in the post before... Sorry but it's 23.30 here and I had a full day at university.

@GoodWayToDie: hope your evil plan is working. We are 5 guys with a HTC Surround waiting for your work and we wish you good luck. I also have some nice NativeApps in mind... Cannot wait to develop :)
[Windows Phone 7 Development and Hacking] dopecoder:
might sound dumb or maybe i missed something but i couldnt find 'connection setup' app on marketplace, is that what its called?
[Windows Phone 7 Development and Hacking] MJCS:
Marketplace -> HTC Apps -> At the bottom you will find connection setup
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Sadly, my evil plans have come to nothing. It appears that provxml registry provisioning doesn't allow path traversal. I'm mildly surprised by this, but c'est la vie.

Hmm, if FileOperation is allowed, that's probably our next best option. I'll keep looking.

EDIT: Heathcliff74, where are you reading ApproveddListDB from?
[Windows Phone 7 Development and Hacking] jdbastardy:
:o

I am sorry... What do you think that can be done with fileoperation?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
We may be able to find a non-ROM file in the Windows folder (or another location that is normally not writable using XAPs) that, by modifying it, we can change the behavior. It's not a full solution, just a possible component of one.
[Windows Phone 7 Development and Hacking] jdbastardy:
Hope you will find something. If yuo need any help or testing I am gonna check tomorrow. Time to sleep for me :) good night.
[Windows Phone 7 Development and Hacking] Heathcliff74:
http://download.windowsupdate.com/msdownload/update/software/dflt/2011/08/404443_2250.21.40502.401_oemupdate_release.cab.pks_4e1f62edd8e6fe93d4daa106f915f4b9eba38df1.cab

Extract cab (use winrar or 7z) and then extract HTC_AppDrivers.cab.pkg (again use winrar or 7z).

PS 1: They did a little obfuscation trick on the HTCProvisionDrv.dll. But I already fixed that :D Now looking at the disassembly.

PS 2: @CeesHeim is kind enough to lend me his HTC HD7. He sends it tomorrow. So in a couple of days I'll have an hands on HTC. Hope that speeds things up for me.

Ciao,

Heathcliff74

Ciao,
[Windows Phone 7 Development and Hacking] Heathcliff74:
I'm looking through the code of the HTC provision driver. So far, I have not found an exploit for the whitelist. But, the way it is set up, I have hope that it can be done. It's late now. Gotta get some sleep. I will do another attempt tomorrow.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] lucas.scott:
You guys are very appreciated for the work you are doing . Thank you
[Windows Phone 7 Development and Hacking] starsoccer9:
Htc arrive

Thanks for working so hard. If you need help or want me to test in on my htc arrive pm me or something. I would love to help however I can
[Windows Phone 7 Development and Hacking] ropp29:
Looks like you guys are making some good progress. Thanks for your efforts - I hate how locked down my HTC 7 Pro (basically an Arrive) is despite being developer unlocked. I would LOVE to have interop unlock and be able to mess around with the registry and whatnot.

As much as I loathed classic Windows Mobile, at least you could do whatever you wanted with it, with basically no restrictions. Registry editors and apps from anywhere with no unlocking whatsoever.
[Windows Phone 7 Development and Hacking] H3ALY:
@GoodDayToDie: No the app it's self installs fine but installing apps that require interop services won't deploy. This is what i was getting at sorry for the confusion.
[Windows Phone 7 Development and Hacking] ceesheim:
its already on its way , have fun with it :D
[Windows Phone 7 Development and Hacking] ca2l3vin:
Heads up for Verizon Wireless HTC Trophy owners

You can actually process the setup. You have to activate your SIM card in your phone (normally free with the right features) then set the phone data to GSM and data roaming on. Once this is done you have to go to the connection setup and it should be set to Vodafone. Then begin the steps in the instructions on the first post and it should add everything on.

Problem is at least for me the interop-unlock did not work.

so info on my phone:

Verizon Wireless HTC Trophy

7720.68

Chevron Unlocked
[Windows Phone 7 Development and Hacking] s10010001:
Sweet thanks!,

Now how do I go about activating the sim? However, I think the HTC Mango update included the said updates that break this interop unlock. :( But the Sim trick should allow us Verizon users to play with all the possible future methods.
[Windows Phone 7 Development and Hacking] jaygriggs:
I have a cdma sprint arrive. Im on 7403 currently. Any link for the sim trick?

I just want internet sharing... Hopin we get a custom rom sooner or later that would be so much easier
[Windows Phone 7 Development and Hacking] dsramesh:
I just tried this on my Verizon HTC Trophy as it is sim unlocked (have sim from India). It is chevron unlocked.

It reported success but I can't still install the apps.

- Did I miss anything from first post?

..Ramesh
[Windows Phone 7 Development and Hacking] MJCS:
This might work:

http://labs.mwrinfosecurity.com/files/Advisories/mwri_htc-htcutility-kernmem_2011-11-10.pdf
[Windows Phone 7 Development and Hacking] Heathcliff74:
Interresting info.

BUT... quote from the very last paragraph:

So, this can only be exploited when the device is still on NoDo or RTM, or the device is on Mango and already interop-unlocked. So the article forgets to mention that a fully updated device is not vulnerable anymore (Mango prevents calling the driver by means of Interop Lock!)

This means that this exploit can't be used to perform Interop Unlock, because the exploit only works when the device is already interop unlocked.

The article sounds a bit like overreacting, but interesting nonetheless.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] ca2l3vin:
I just called and activated the preinstalled one that came with the phone (Verizon/Vodafone). Just call up and add international dialing (its free) and the global data pay as you go feature (also free unless you travel). Inform that you may be traveling to a GSM country soon and have them activate the SIM with the SIM number (they will need the number and I said I was planning on going to England soon which I do hope I do visit in 3 months anyways)

I assume its similar with sprint.

Good luck and hope it helps :)
[Windows Phone 7 Development and Hacking] Frenk 19:
I do not understand what it is: why are not made ​​new Mango applications with native code?
[Windows Phone 7 Development and Hacking] MJCS:
I wonder if someone tried to create a custom sim card with a network called "Phone Customization" if this would work. I just sim unlocked my phone with a AT&T card from 8 years ago and the connection setup listed AT&T right away and did not let me change it. I am not sure if this is possible or not.
[Windows Phone 7 Development and Hacking] s10010001:
Thanks! I will do it as a just in-case thing. (Hopefully in-case this hack starts working)

Now, do you leave your data on GSM always? Or turn it back to CDMA?
[Windows Phone 7 Development and Hacking] ca2l3vin:
You have to put it back to CDMA unless your outside the USA or dont want data/voice access. ATT and T-Mobile networks are locked out on the Verizon/Vodafone global SIM's.

You only need to do this for the temporary process then once the unlock happens (if it happens by this method) then it should be fine to change back to cdma and even disable your SIM if you want.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@MJCS: we have full control over the database. I could replace the AT&T-US data with a custom provxml easily enough. I doubt that will get past the whitelist, but is possibly a good avenue to consider.
[Windows Phone 7 Development and Hacking] MJCS:
Feel free to try it.
[Windows Phone 7 Development and Hacking] HypeZ85:
HTC just updated the Connection Setup App, i hope they didn't fix this
[Windows Phone 7 Development and Hacking] fuzzycuffs:
Watching this thread like a hawk. :)

My wife's factory unlocked HTC Radar works fine on our carrier with HTC Connection Setup (voice and data wise), but MMS won't work. It could be because of one or both of the following:

1. It's not using the correct MMS proxy settings (which I have no idea how to check)

2. Our carrier checks the user agent string for the MMS client. So even if it is using the right MMS settings it probably is being rejected by the server. There are multiple ways to fool it on Android but so far I haven't found any way to do so on Windows Phone. :(

Hoping interop unlock will at least open some doors for me to muck around and try to get around these restrictions.
[Windows Phone 7 Development and Hacking] Ludacris:
I have tested your method on my interop unlocked trophy on 7740 with HTC updates and that value does NOT exist.
[Windows Phone 7 Development and Hacking] MJCS:
While the files are identical (according to winmerge) I suggest NOT updating. Well unless you make a restorepoint before you do.
[Windows Phone 7 Development and Hacking] anttaz:
Updated connection setup installed today :-S

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] Ttblondey:
what's the new version.mine is still v 1.12 build 2119.18323
[Windows Phone 7 Development and Hacking] anttaz:
V1.13 build 210.41318

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] killerkhatiby009:
I'm still running the developer beta II of mango on my HTC Arrive, is there any way for me to get it interop-unlocked? HTC Connection setup does not run on the Arrive at all, so is there any other way to do this? I wouldn't mind even going back to NoDo but I believe all those methods still involve HTC Connection setup
[Windows Phone 7 Development and Hacking] MJCS:
You are right. Look up the method for Nodo in the search.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Ok guys.

I don't want to anticipate too much, because I'm not sure yet. But I think I have found a break-through for Interop Unlock on HTC's!

I reverse engineered the HTC drivers and looked at the part where xml's get rejected. I think I can craft an XML that contains necessary setting for Interop Unlock and fool the checks in the driver to allow it to provision.

But I still need to test some details to be sure. If it was just one thing, I would make a test app and ask you to test it. But I actually need to run a series of tests, so it's much easier when I have a hands-on device. @CeesHeim sent me a HTC HD7 yesterday, so I hope to receive it tomorrow. If I can test the apparent exploits I will let you know the result!

Fingers crossed!

Heathcliff74
[Windows Phone 7 Development and Hacking] anttaz:
Good news thanks :-)

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] zeke0613:
Wonderful new @Heathcliff74!!!

Thanks for your efforts!!!
[Windows Phone 7 Development and Hacking] LiFePo4:
Just FYI on the new Connection Setup. If you have the HTC updates and on Verizon BEWARE...

http://xdaforums.com/showpost.php?p=19646924&postcount=3

---------- Post added at 06:48 PM ---------- Previous post was at 06:46 PM ----------

Even if not on Verizon, make note.
[Windows Phone 7 Development and Hacking] ryotgz:
very nice of them to send you an hd7
[Windows Phone 7 Development and Hacking] lucas.scott:
This thanksgiving....im thankful for Heathcliff & gooddaytodie....and all others working tirelessly on this . You guys are awesome . Even the attitudes of the end users is fantastic in the wp7 sections. We got a nice little community started here . You guys have a good one . And good luck with the exploits heathcliff!
[Windows Phone 7 Development and Hacking] roqstr:
Heathcliff, should we update our connection setup or stay 1.12? I'm a lil bit scared :P

and does the unlock stay for interOP-unlocked devices, when HTC thinks they must fix that ?

btw: great work, i was sure you both could handle it :)

Can't wait for it <3
[Windows Phone 7 Development and Hacking] parnunu:
Waiting a good new.
[Windows Phone 7 Development and Hacking] arimozuki:
You probably shouldn't.
[Windows Phone 7 Development and Hacking] s4cr3d:
Great news I am down to 8 out of the max 10 for chevron

Sent from my Radar C110e using Board Express
[Windows Phone 7 Development and Hacking] Heathcliff74:
You do realize that you need to developer-unlock a device first and then after that you can Interop Unlock the device (if it works!). So you still need the chevron-labs-unlock if you want to Interop Unlock a device!

Don't update unless you really need to! Exploits can always be patched by HTC. In this case I did a quick check and it looks like all necessary elements for the exploit are still present in HTC Connection Setup 1.13. But I can't be 100% sure, because I can't test it myself. I will probably have a HTC HD7 by tonight. So *hopefully* I can test everything tonight and release a working Interop Unlock.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] s4cr3d:
I am chev-unlock me using radar ....waiting for you patiently pal
[Windows Phone 7 Development and Hacking] Ttblondey:
well, i don't get any update from htc...but nvr mind thanks for the hilight.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Unfortunately I didn't get the HD7 from @CeesHeim in the mail today. According to track&trace it's already in the Netherlands. So I guess I should be getting it tomorrow. Testing possible Interop Unlock on HTC will have to wait a little longer.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] kwill:
Well this looks promising and you guys have about a week until my Titan gets here from Amazon:) I have to have Adv. Config and with interop, that's a no go. I'll kill myself I have to keep the stock colors.:D THanks for all the work in advance though. OP and heathcliff.
[Windows Phone 7 Development and Hacking] roqstr:
argh,i was so amazed ... why don't you publish an open alpha or smth like that, so we can damage our phone on own risk ;P i don't come along with 3 fcking non-native homebrew apps .. :/
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hehe.. I understand... Testing your patience, man!! :p

Anyway, the point is that I need to fiddle some settings from a debugger to test what works and what not. The other option would be to create dozens of test apps and see which one would work. That would probably cost me more time than waiting for the HD7.

I did the announcement, because I wanted to let you know that there's a big chance we can fix this and because I was excited to have found a new exploit. I should be able to get to it this weekend. So don't hold your breath just yet. Just bear with me.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] chriskay:
If HTC or M$ approach you, don't talk to them, don't take their money... they are EVIL... ;)
[Windows Phone 7 Development and Hacking] W0RSCHD:
Today i tried to Interop-Unlock my Mozart.

I have Chevron Unlock, and Mango without the newest HTC Updates, actually 7.10.7720.68.

I had Connectivity Setup installed and then i installed the interop-unlock XAP.

I did the Interop unlock through Connectivity Setup, it wrotes done fine, but i cant install other XAP´s like root Tools or more then 10 XAP´s, so it didnt work for me :(
[Windows Phone 7 Development and Hacking] anttaz:
That's not interloop unlock, that's your developer unlock with a max of ten. Interloop is the native block of id caps service that blocks native and access to certain parts of os and reg as far as I understand?

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] majkeljj:
so if I have chevron unlocked phone, install this interloop unlock, I still will have max 10 apps but range of apps which I can install will be bigger because I will be able to install apps which need ex. registry access, native and drivers?

If, yes, maybe it is possible also to increase max. apps in similar way?

I thought that MaxUnsignedApp >300 = interloop unlock, and I will be able to install more apps then 10 (chevron unlock).
[Windows Phone 7 Development and Hacking] Heathcliff74:
With Interop Unlock you can install unlimited apps :p
[Windows Phone 7 Development and Hacking] majkeljj:
haha when you reply me, I edited my previous post;) thanks, I thought so :)
[Windows Phone 7 Development and Hacking] roqstr:
so, pls tell me that you don't have to work today and the htc already arrived ... :P
[Windows Phone 7 Development and Hacking] :
@majkeljj what you thought is correct 300 is interloop unlock etc. So I believe it did not work for you.
[Windows Phone 7 Development and Hacking] Siddharth Thevaril:
Interop unlock successful on WP7 Mango

Currently running Mango 7.5 on HD7,Interop Unlock successful,no errors,clean install!

Thank you very much!
[Windows Phone 7 Development and Hacking] Bator92:
How did you do that? Did you unlock official Mango? Haw many apps can you install?
[Windows Phone 7 Development and Hacking] anttaz:
Probably custom rom

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] roqstr:
i could imagine he didn't even checked it... try to install advanced config ;)
[Windows Phone 7 Development and Hacking] anttaz:
I on official 7740 and can install unlimited apps, but can not run advanced config, touch explorer and most of registry has no access.

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] anttaz:
Also since 7740 can no longer make registry changes now.

Sent from Ant's 7 Mozart T8698 using XDA Windows Phone 7 App.
[Windows Phone 7 Development and Hacking] Budniu:
HTC 7 Pro unbranded, Chevron unlock (9$). I haven't in the operator list for my country "Dev and Interop Unlock" and device not interop unlock, any ideas ?

Sorry

It's 7740 Mango without HTC Updates.
[Windows Phone 7 Development and Hacking] erebusting:
yea this method is still not working for me either, I cant wait to see a solution soon--would be really nice! =)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Just a heads up.

Mailman was at my door today with a HD7 from @ceesheim.... But I no-one was home then. Note in my mailbox says I can get it at the postal-office on the next workday, from 13:00. AARRG! That would be mondays. I'm at work then, but I can authorize my wife to pick up the package. There's a small chance I can pick it up tomorrow-morning because one window will be open then and maybe they can deliver that package for me. We'll see.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] roqstr:
shame on you :P

sounds like i can go to bed for today, but in 24h i wanna see results ;)

don't take it seriously :)
[Windows Phone 7 Development and Hacking] killerkhatiby009:
Can't wait to see some releases from you! Are you gonna be working on a way to interop unlock without using HTC Connection Setup so that us people with the Arrive/CDMA phones can join in on the fun?
[Windows Phone 7 Development and Hacking] Budniu:
@Heathcliff74. ok wait.
[Windows Phone 7 Development and Hacking] Heathcliff74:
I will always be on the lookout for such opportunities. But chances are slim. There are not many apps that can be exploited. I'm also still looking for more generic exploits of maybe even completely device-independent exploits. But that will be very difficult, because Microsoft's code is much better secured than the OEM's code. If I look at the code from the OEM's I can judge it on how well it is structured (design patterns that are used) or how secure the code is.

Nokia: Very well written. Almost every modern design pattern is used in their code. I haven't seen the code of their drivers, but from the way they call their drivers I think they are very well structured too. But security-wise, well I haven't seen much of their code yet, but I haven't seen any sign of security anywhere.

Samsung: Code-design is okay. Security is not very well.

LG: Code-design is rather good. Also their drivers are well written. Security is hilarious. There's even a high-privileged registry-editor built in their devices!?!

HTC: Apps are very nicely done. Well written. Their drivers look like work of amateurs. Their security is improving steadily over time.

Microsoft code is very well written in every aspect. If Microsoft would have written all code on the phones (including all drivers and apps) I think we would be completely locked down. The initial Chevron WP7 exploit was a big security hole they left there. But after NoDo, I only found exploits that can be used after first having pinched the security layers through holes in the OEM code.

So I hope more white-hat-hackers will go deep into the WP7 security, so we can enjoy more homebrew-goodness, because it ain't getting any easier.

Ciao,

Heathcliff74
[Windows Phone 7 Development and Hacking] jaminroe:
Does anyone know why there ChevronWP7 says tokens are currently on hold until more become available? I don't understand the reason for this... :mad: I'm wanting to put Nokia Drive on my HD7 so badly!!
[Windows Phone 7 Development and Hacking] :
@heathcliff I know this is a windows phone thread but reading your breakdown of each manufactor and how they design and protect their code had me think of how the iPhone code security is compared to wp7 and what sort of exploits they use? I don't suppose you know?

and also does this mean custom roms maybe the future for wp7?