yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] voluptuary:
Well I'm just going on past experience and letting you know what has worked for others in your situation. Network Profile is indeed what you use on the Focus and Omnia 7 to reset carrier settings 'officially' and Wireless Manager is what is to be used of you Have a Focus Flash/S or Omnia W. Honestly failing all those options 9 times out of 10 it's user error so perhaps you might want to start over from the very beginning.
[Windows Phone 7 Development and Hacking] iraqmilner:
With WindowBreak one can download a homebrew app (XAP format) and install it via a deployment tool, correct?
[Windows Phone 7 Development and Hacking] voluptuary:
Yes, this is correct.
[Windows Phone 7 Development and Hacking] iraqmilner:
If we experience an issue with the 3G we can factory restore the unit and return to the normal, 3g working handset? Thanks for the clarification. Thanks awarded :)
[Windows Phone 7 Development and Hacking] voluptuary:
Yes, that is also correct. Nothing done via this 'hack' is permanent, a simple reset and all is well should you have issues.
[Windows Phone 7 Development and Hacking] WinMo_Techie:
Hey Jaxbot, superb work you did there, Thanks a TON !

I have a Samsung Focus and as per your video, this would work on it, but I don't want to reset my phone, too much stuff and apps and emails and what not in there..

Sp please, can oyu tell me, if my phone will not be disturbed and that I can and go ahead and unlock it? with resetting my phone.
[Windows Phone 7 Development and Hacking] DamnageD:
The unlock seems to work fine on my Focus S. It didnt knock out the 3g, although being a newer 4g device, there may be different parameters internally. Is there any other way to verify the interop unlock besides seeing the "windowbreak" in the diagnosis/gprs manager?

I'm installing the SDK now, and I'll see if i can get the root tools to load. Ive got the USB storage hack working, but cant seem to get the file to load.

Still green on this whole WF7.5 hacking, but wth, why not add my $.02 if it helps the community?
[Windows Phone 7 Development and Hacking] ManelScout4Life:
Root tools wont work on the focus s. If it installs thought you'll know for sure if the unlock worked.
[Windows Phone 7 Development and Hacking] prahladvarda:
What do u use to "talk" to COM port??dont tell me to ask google..please tell so that we can know what is going on while we try to flash a rom and we get "dbl write flash failed"..

Sent from my GT-I8350 using Board Express
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
I tryed to grab COM-port "talk" between PC and phone. But no luck becase I have Win7 x64 :(
[Windows Phone 7 Development and Hacking] GoodDayToDie:
The "%s" strings are printf format sequences. That strongly suggests that at some point the string is being passed directly as the format string to printf. This is an exploitable security vulnerability, especially if the %n format sequence is enabled (MS likes to disable it, but maybe on the phone they didn't?) as it can be used to treat other items on the stack as pointers.

I don't have a Samsung phone to test with, but will somebody please see if they can figure out how to process that string? If so, that's a potential exploit vector right there!
[Windows Phone 7 Development and Hacking] prahladvarda:
This may be the beginning..

Sent from my GT-I8350 using Board Express
[Windows Phone 7 Development and Hacking] dazza9075:
Im Willing, just not able, do you have any documentation I can read through that may be useful to apply to this wee project?

also im sure on my Focus S travels i came to this wee tool and was able to execute it, possibly from within the Root menu, or more likely as a command sent to the device via RevTools, i cant be sure, ill look back over my notes over the weekend
[Windows Phone 7 Development and Hacking] duckvader:
im curious about the downgraded using backup method. Will my current messages and apps disappear along with all their data or will they remain and firmware of phone and apps at time of update will be added??
[Windows Phone 7 Development and Hacking] dazza9075:
That depends, your messages will go, but you can use the smsbackup which will take care of that, it doesn't keep mms pictures though so save them to phone and Zune sync it to keep them, As for apps, it keeps the app but personal data goes, I believe that's todo with the version of Zune used to backup though, I think 4.7 backs up data, 4.8 doesn't ar least I've not noticed it work. I have however found a work around for navigon, copy the maps to your documents folder, when you restart you just copy them back ;)
[Windows Phone 7 Development and Hacking] GoodDayToDie:
If you can edit that string, try adding a %d or two, maybe a %n. Attempting to process it should now cause a crash (most likely) or dump a bunch of seemingly-meaningless numbers. With careful experimentation, we may be able to determine enough about the memory environment of whatever software processes that string to compromise it and take it over. %n allows writing an (effectively arbitrary) value to whatever address is positioned on that stack where the next parameter would be. Since the stack is also used for things like stored frame pointers and return addresses, it's full of values that can be useful. Furthermore, it's often possible to have some control over the stack contents by manipulating the provided string.

I've exploited this class of bug before. Granted it was in a university class - you don't see that many of these in the wild - but it's not hard to do once you have %n and some way to get an idea of the memory layout.
[Windows Phone 7 Development and Hacking] Jaxbot:
Isn't that string in the RapiConfig executable, though? How are we supposed to edit that?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Ah - if it's hardcoded and read-only, then never mind. Somebody mentioned the string and a textbox within a few words of each other and got my hopeful that the string was in an editable textbox. As I said, I don't have a Samsung device to try it out.
[Windows Phone 7 Development and Hacking] Jaxbot:
I've got two Focuses I could experiment with, but the ROMs on them have diagnostics removed. Need to reflash one, then see a few things. Mainly curious to see if RapiConfig ever pings that address.
[Windows Phone 7 Development and Hacking] prahladvarda:
Basically, if u r editing it on ur phone u should be interop unlocked and if not u cant even gain access to it on ur phone..and if u r thinking u can be smart and edit it on ur pc, u aint gonna have ur signatures intact after editing..so the point is u should edit it with once again an app which has interop capability like ie mobile once again mostly with provisioning xml..and if u were able to provision an xml successfully, u were not going to edit this in the first place but directly changing the registry..so this whole editing kinda stuff- its not worth a trial i think..correct me if i am wrong..
[Windows Phone 7 Development and Hacking] Jaxbot:
I've got diagnostics working now. But I have no idea what would make RapiConfig try to ping that IP address. Any pointers?
[Windows Phone 7 Development and Hacking] prahladvarda:
logically thinking, there must be a url that RapiConfig needs to access everytime it is called as there is an ip address found..so finding that out may help..this url if not associated ONLY with RapiConfig, then there must be a pointer in RapiConfig to the url that its gonna access..
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
I've posted a URL there http://xdaforums.com/showpost.php?p=36396903&postcount=771

But we don't know values of %s.

What's a contents of \temp\RapiConfigOut.xml? Is it provxml?!

---------- Post added at 12:23 AM ---------- Previous post was at 12:10 AM ----------

I have an idea. First of all we need to check if this URL is ever called.

You need a WiFi network (yours) that you can monitor (Internet sharing via WiFi on laptop for ex.)

1) Turn Airplane mode on.

2) Turn on your network monitoring software.

3) Connect the phone to Wi-Fi.

4) Try to do everything with RapiConfig and watch the monitor log.

RapiConfig is GSM configuring tool so I'm not sure it will use anything through Wi-Fi connection.
[Windows Phone 7 Development and Hacking] Jaxbot:
Way ahead of you; I have fiddler running and the device does nothing when I use RapiConfig. No idea if it bothers with GSM or not. Anyone wanna break it down with IdaPro and figure out what it does?

About RapiConfigOut.xml:

<wap-provisioningdoc><characteristic type="NAPDEF" mwid="1"><characteristic type="Suwon3GAPN" mwid="1"><parm name="BEARER" value="GSM-GPRS"/><parm name="NAP-ADDRTYPE" value="APN"/><parm name="NAP-ADDRESS" value="nate.sktelecom.com"/><characteristic type="NAPAUTHINFO"><parm name="AUTHTYPE" value="PAP"/><parm name="AUTHNAME" value=""/><parm name="AUTHSECRET" value=""/></characteristic><parm name="INTERNET" value="1"/></characteristic></characteristic><characteristic type="NAPDEF" mwid="1"><characteristic type="Suwon3GMMS" mwid="1"><parm name="BEARER" value="GSM-GPRS"/><parm name="NAP-ADDRTYPE" value="APN"/><parm name="NAP-ADDRESS" value="nate.sktelecom.com"/><characteristic type="NAPAUTHINFO"><parm name="AUTHTYPE" value="PAP"/><parm name="AUTHNAME" value=""/><parm name="AUTHSECRET" value=""/></characteristic></characteristic></characteristic><characteristic type="PXLOGICAL" mwid="1"><characteristic type="BillingProxies" mwid="1"><parm name="DOMAIN" value=""/><characteristic type="PXPHYSICAL" mwid="1"><characteristic type="BillingProxy1" mwid="1"><parm name="TO-NAPID" value="Suwon3GAPN"/><parm name="PXADDR" value="168.219.61.250"/><characteristic type="PORT"><parm name="PORTNBR" value="8080"/><parm name="SERVICE" value="80"/></characteristic></characteristic></characteristic></characteristic></characteristic><characteristic type="APPLICATION"><parm name="APPID" value="w4"/><parm name="NAME" value="S3GMMS"/><parm name="ADDR" value="http://165.213.73.234:7082/"/><parm name="TO-NAPID" value="Suwon3GMMS"/><parm name="MS" value="300"/></characteristic></wap-provisioningdoc>
00"/></characteristic></wap-provisioningdoc>

It appears to be exactly what is sent to RapiConfig, or perhaps the app writes to rapi config out and RapiConfig then loads it? I can't remember.
[Windows Phone 7 Development and Hacking] prahladvarda:
I have seen many of my friends windows phones all network operators'(not wifi) ip address will be 165.xxx.xxx.xxx(at least in india and even my operator's got a similar address)..AFAIK the ip address u posted is ur network operator's one..to confirm this its necessary to check the ip address in phones with different operators and with sim card removed..maybe that would help

---------- Post added at 09:43 AM ---------- Previous post was at 09:37 AM ----------

woohhh..it seems that u should write to RapiConfigOut first rather that create a provxml in \provxml
[Windows Phone 7 Development and Hacking] Jaxbot:
It'll just get overwritten
[Windows Phone 7 Development and Hacking] prahladvarda:
So can editing be done only with a provisioning XML?? Or there are other ways to edit??and even if u edit and if it gets overwritten what's the point in editing it??

Sent from my GT-I8350 using Board Express
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
When? Can we overwrite it between "write" and "use"?
[Windows Phone 7 Development and Hacking] Jaxbot:
Probably not, there's no time
[Windows Phone 7 Development and Hacking] prahladvarda:
so no point in editing it i guess..@-W_O_L_F- what about DepotCopy it can be used to copy all files from \Depot to \windows..so if a provisionED xml is being sent to \windows, maybe DepotCopy can be used also in similar way we need to find a way to write files to \Depot like how Jaxbot wrote windowbreak.xml to \provxml..and u told u didn't find where it was called..Maybe its all file format related i think..
[Windows Phone 7 Development and Hacking] Jaxbot:
Not a fan of your pessimism, mister. :P

I do want to experiment with something else, though...
[Windows Phone 7 Development and Hacking] prahladvarda:
hahahahaha i gotcha..and here is a binary log file that i have attached..its what i got when i monitored what was going wrong when i tried to flash a stock old firmware compatible with windowbreak..can u kindly interpret it??
[Windows Phone 7 Development and Hacking] Jaxbot:
Ah but of course, my second language.

:P

I do have some goodish news though, need to figure out some things first though
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
It's binary. Ra000FF is in 5584 :D It's first (32768 bytes) bundle but it's 60% nulls :(
[Windows Phone 7 Development and Hacking] Jaxbot:
Yeah, I have a hex editor to open it with, but not context to understand what it all means. Not sure it's useful at all
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
Bundle start:

View attachment 1641959

Why zeros?

View attachment 1641960

End of bundle

View attachment 1641958

I think that something went wrong. Of course hash sum was invalid.
[Windows Phone 7 Development and Hacking] prahladvarda:
So is it a problem with the rom file??or is it an incompatible rom??in the video on youtube where Omnia w is downgraded the rom used is the same..i used advanced USB monitor(trial) to watch this..maybe that could help..

Sent from my GT-I8350 using Board Express
[Windows Phone 7 Development and Hacking] prahladvarda:
oh then do u say this rom file cant be used to flash a device due to invalid hash sum??and i ve attached installer from what i saved that binary log file..
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
Checksum looks right. This downloader is stupid, it downloads new firmware even it can't be installed on retail device. But phone refuses to burn it to NAND :(
[Windows Phone 7 Development and Hacking] prahladvarda:
I don't think so.. coz I could successfully flash this rom on my Omnia w and downgrade it from os version 7.10.8107.79 to 7.10.7740.16..unlucky me..the flashed firmware was incompatible with windowbreak..

important to note is that post no. 701 and 703 in this thread reveals that its the firmware revision that blocks windowbreak and not the os update though newer firmware is often accompanied with newer OS update..so its more accurate to consider firmware than to consider os updates when we talk regarding patched exploitable loopholes..

my f/w after flashing the above mentioned rom is 2424.11.12.1 and before it was 2424.12.05.1

and why is phone refusing to burn it??are the signatures disrupted??
[Windows Phone 7 Development and Hacking] Jaxbot:
I think I have enough for an interop-unlock at this point, with the requirement that the phone already be dev unlocked. Trying to find a way to make a full jailbreak without those requirements.

So, try these steps on Focus S or Flash and tell me what happens.

Go to Dialer
Type ##634#
--Should open up Diagnostics
In Diagnostics, type 5**6244*3
--Should open up an app launcher thing
Click on Shortcuts
--Should open up a file browser
Click on the options menu and check "Show All Files"
Try your patience and scroll down to see if DepotCopy.exe is in the list
[Windows Phone 7 Development and Hacking] goldenpipes:
nothing...

5**6244*3 does absolutley nothing, diagnosis version 0412

device is apphub unlocked.
[Windows Phone 7 Development and Hacking] Jaxbot:
Yeah, been hearing that lately. Wonder why it works on my device and not others. It's either due to diag version, or worse... the fact my phone is rooted/full unlocked.
[Windows Phone 7 Development and Hacking] goldenpipes:
bummer, I lost my interop due to having my screen break, bought a used phone from ebay and stuck my motherboard on that screen and i had to hard reset to get it to boot, in lieu of that, my computers hard drive crapped out and i lost all my backups so i could restore to 7740 :(
[Windows Phone 7 Development and Hacking] Jaxbot:
Here
[Windows Phone 7 Development and Hacking] Jaxbot:
It couldn't be installed if it were signed, either. Odd though, wonder where it came from.
[Windows Phone 7 Development and Hacking] lukas_ita:
Hi guys, thank you for your hard work! My Omnia W was interop unlocked until last October but I have broken it and I had to send it to assistance. How many hopes are there to see my phone Interop-unlocked again?

Good work :)
[Windows Phone 7 Development and Hacking] dazza9075:
id say the chances for that are the square root of bugger all. Unless development can be made on here. sorry mate.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Hm. As far as my information goes, all versions of the diagnosis app should be able to enter that menu. You have apphub. Can you install this webserver on your device. It should also work without root access. Then download the file \Windows\DiagnosisApp.xap from the device and post here for analysis.

Thanks,

Heathcliff74
[Windows Phone 7 Development and Hacking] goldenpipes:
here you go gents.
[Windows Phone 7 Development and Hacking] Heathcliff74:
The latest xap should do it.
[Windows Phone 7 Development and Hacking] goldenpipes:
see previous post
[Windows Phone 7 Development and Hacking] Heathcliff74:
Heh. I think you missed the fact that my earliest reference to the webserver is actually a clickable link.
[Windows Phone 7 Development and Hacking] Jaxbot:
Alright, calm down kids :P Question is, why does my diagnostics app allow access to the app launcher, but not anyone elses'?

FYI, I have 0628 and firmware 2124.11.9.4 on this particular ROM.
[Windows Phone 7 Development and Hacking] goldenpipes:
7.10.8773.98

2103.11.10.1

Diagnosis version 0923
[Windows Phone 7 Development and Hacking] Heathcliff74:
I'm as calm as I can be :p

If there is a new diagnosis app, I'd like to see it for possibilities. That's why I requested the file.

- Heathcliff74 -
[Windows Phone 7 Development and Hacking] Heathcliff74:
If you need more info to get that file, let me know.
[Windows Phone 7 Development and Hacking] Jaxbot:
When he said "see previous post", he meant for you to look at his previous post.

;)
[Windows Phone 7 Development and Hacking] Heathcliff74:
Oh, LOL. I completely missed, that because he edited his post. First is was a question. Then he posted the xap there. I didnt notice his edit. :D
[Windows Phone 7 Development and Hacking] goldenpipes:
Lol I thought I could be fast enough when I downloaded the fileserver I mistakenly downloaded the source then I was like how do deploy this, the. I looked again and seen the XAP. Goodolsaturdaymorningcoffee.

Sent from my SGH-i937 using Board Express
[Windows Phone 7 Development and Hacking] Heathcliff74:
Dunno exactly what that version is. But what you sent me is not 0412. It is 0923, a version I've seen before on Omnia W devices. Can you try to uninstall the Diagnosis app and open phone dialer and dial: ##634# That will probably install Diagnosis 0923. Then you're up to date again and in the Diagnosis app you can dial: 5**6244*3

Cheers,

Heathcliff74
[Windows Phone 7 Development and Hacking] goldenpipes:
Yeah idk what happened to 0412 I did exactly what u mention uninstalling and doing the ##634# and it gave me 0923.

I know that neither version worked.

Sent from my SGH-i937 using Board Express
[Windows Phone 7 Development and Hacking] Jaxbot:
Does the app launcher code work on it now?

Edit: jk. But try again anyway, just to verify.
[Windows Phone 7 Development and Hacking] goldenpipes:
Still nothing.

Sent from my SGH-i937 using Board Express
[Windows Phone 7 Development and Hacking] Heathcliff74:
I think you must be doing something wrong. The code looks good. And I did sideload the app on my phone and I could open the menu.

- Heathcliff74 -
[Windows Phone 7 Development and Hacking] Jaxbot:
Is your phone rooted or full unlocked? It works fine on my focus, but I'm wondering if the diagnostics app doesn't have the privileges to run the app launcher. Or is the app launcher cooked into the silverlight app itself?
[Windows Phone 7 Development and Hacking] Heathcliff74:
It's SL.
[Windows Phone 7 Development and Hacking] Jaxbot:
Well that's just weird
[Windows Phone 7 Development and Hacking] goldenpipes:
Idk I have roottools 1.0 and I provisioned diagnosis and still nothing.

Step 1 open diagnosis app.

Step 2 enter 5**6244*3

Step 3 scratch head

Sent from my SGH-i937 using Board Express
[Windows Phone 7 Development and Hacking] prahladvarda:
my diag version is 1109..its not working..

and here is something i found

pvk file name: samsung_0180_25cb51f2c734525120b4ed9b9f14d17fc9b0fd10071b979c4c5688dd9b9ec5e2.bin

got this using 18*357#25 in diagnosis..does this help??

edit: i dont think its gonna help..my f/w version is 2424.11.12.1 running 7.10.7740.16..i m student unlocked..

and i was able to sideload webserver without interop services..hell i dont know how to use it for different purposes..please help

if i remove id cap interopservices from dianosis app that jaxbot uploaded i can sideload it..but app crashes if i tap shoortcuts in 5*6244*3..that says its something to do with diagnosis app doesn't it??
[Windows Phone 7 Development and Hacking] goldenpipes:
Mine is

Samsung_0178_36f62f8cc371851142e0b506f5b979d60e29e8aefd4469c30e194470ef50d628.bin

Sent from my SGH-i937 using Board Express
[Windows Phone 7 Development and Hacking] prahladvarda:
so this thing is unique for different devices..so not significant..anyway i ll be happy if somebody tells me how and what to use webserver for..

edit: this diagnosis app that i ve attached managed not to crash when i tapped shortcuts..it has an intact DRM description though..just use phone7deployer to install..@goldenpipes i think u find this useful..before u deploy, add <Capability Name="ID_CAP_INTEROPSERVICES" /> to the capabilities' list if u have interop unlock while testing..
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
PVKKey 3525302758 Always *#99785#
PVKFileName 370874684 Always *#997856#

Those codes were interesting finding when I first time decrypted diagnosis codes.

IMHO:

1) Password for PVK file

2) Name of the PVK file

I don't see a reason to place this information to Diagnosis.
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
Patched version of Diagnosis 1104. I enabled APPSLAUNCHER and UAEDIT. Launcher starts (but I have no Interop Unlock :( ). You need to edit manifest (uncomment introp) and resign xap. I used this tool to deploy: http://xdaforums.com/showthread.php?t=908293

C:\Program Files (x86)\Phone7Market>wp7-deploy.exe <Path>\DiagnosisApp.xap -dsr
[Windows Phone 7 Development and Hacking] Jaxbot:
But can the launcher start Shortcuts?
[Windows Phone 7 Development and Hacking] Heathcliff74:
Not without Interop Unlock
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
Is it possible to deploy patched DiagnosisApp.dll to app folder?

UPD:

I have a question. What will happen if we rewrtite manifest?
[Windows Phone 7 Development and Hacking] Jaxbot:
Deploying a patched DLL won't work, because the OS verifies signatures. Modifying the manifest does nothing; it's only used at install time.
[Windows Phone 7 Development and Hacking] -W_O_L_F-:
How OS recognizes if programm had interop in manifest or not?
[Windows Phone 7 Development and Hacking] Jaxbot:
Pacman database records for each app
[Windows Phone 7 Development and Hacking] prahladvarda:
even wen u r nt connected to internet, u can successfully install diagnosis app from dialer..so (i think)diagnosis app xap is present somewhere in the rom..and when the device is connected to internet for first time, the old diagnosis version gets replaced with the new one in the name of god..and my observation is diagnosis version 1107 can open apps launcher and 1109 cant..my logic is flashing an earlier compiled rom and not connecting to the internet before installing diagnosis may lead us to an older diagnosis..this is all what i think..so i m currently backing up everything on my phone to see whether what i think is right r rong..ll be reporting abt it..

if somebody knows i m wrong, feel free to correct me..
[Windows Phone 7 Development and Hacking] Jaxbot:
It has nothing to do with the internet; DiagnosticsApp.xap is included in every ROM, and gets updated based on the firmware packages installed on the device.