yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] termitor:
It will be great to have intertop unlock for DVP.

If there are need some details from this device or testing I can do it.

I have dev account on AppHub and my device is registered there.
[Windows Phone 7 Development and Hacking] wizar:
Did you full unlock Omnia W ???

Can you install and run the example, Opera Mini or WP7 Tools Root ????

I managed to only partially unlocked (I can only install apps outside the Marketplace).
[Windows Phone 7 Development and Hacking] Martee2:
Any news about HTC phones?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@wizar: Please read the first post, jeez. It says quite plainly that it's not a full unlock, just [dev- and] interop-unlock. You can install WP7 Root Tools, and even run it - it just won't work because it's built for the drivers in Samsung gen1 phones, and the gen2 drivers are different (and more locked down, apparently).
[Windows Phone 7 Development and Hacking] dragonide:
I think you meant 2nd gen HTC ...

and no, there aren't any news :/
[Windows Phone 7 Development and Hacking] erc2003:
I made the whole process and Windowbrak can install themes and applications XAP, but I can not use the editor and recording, samsung themes and other issues, why did this happen?

excuse my bad English
[Windows Phone 7 Development and Hacking] Jaxbot:
Isn't it interesting how people can write, but not read? =D

Just a brief update for everyone: I'm making some progress on something, but hit a stupid problem, one that doesn't even have to do with the operating system. If I get around it, I might have something, or I might not. This is highly vague, but it's my way of saying I haven't given up, just been too busy to explain myself ;)
[Windows Phone 7 Development and Hacking] wizar:
I follow about the release of second-generation devices, but a few days did not look here ... Suddenly I see a post written by lrbh, from which I concluded that something in this topic has changed. I asked him a question ... which has become a problem for you. I'm terribly sorry. OK?
[Windows Phone 7 Development and Hacking] ryotgz:
Thanks for the update. Greatly appreciated!
[Windows Phone 7 Development and Hacking] ChrisKringel:
Im just curious: Is this approach you're talking about diffrent than the provisioning method?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@Jaxbot: %DEITY% knows I'm busy enough right now, but if you want to bounce thoughts and ideas about this problem you've hit off me, feel free to send me a PM. You've done some great work and a "stupid problem" shouldn't be allowed to get in the way! I've knocked over a few of those myself recently...

Did you know that the CE DB API documentation on MSDN is *wrong*? Yeah, that was a fun discovery... and MS may claim that CEDB is deprecated and all, but the phone still uses it for some of its critical databases!
[Windows Phone 7 Development and Hacking] Jaxbot:
I'll tell everyone later. Have to test some stuff, but a lightbulb turned on.
[Windows Phone 7 Development and Hacking] Jaxbot:
MSDN wrong? Doesn't surprise me ;)

I solved the stupid problem, though, and I think I'm pretty close. My new stupid problem is the fact that my Nokia 800 won't run the Network Setup application, claiming I need a firmware update. Anyone have some ideas? I've got today off (sick), so it'd be nice to get some stuff done ;)
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Well, you could check the CABs thread, and see if anybody has a newer firmware for your Lumia. That would also give you a good chance to create a restore point... ;-)

I don't know much about the Network Setup app; I keep meaning to investigate it, but there's so many other things to do too. I really should though; it took me less than two days of dissecting the HTC Connection Setup app to find the exploit that Heathcliff74 used in his HtcInteropUnlock XAP (I did a proof-of-concept myself, but it only worked on the "v0" drivers; his worked on "v1" as well).
[Windows Phone 7 Development and Hacking] Martee2:
I meant 1st generation (HTC 7 Trophy)
[Windows Phone 7 Development and Hacking] Jaxbot:
Well, I know my exploit works, as I've tested it on my Sammy. But I don't know if there's something different about Nokia, which is what I need to confirm.

No, this isn't what Heathcliff already tried. It's something new..ish. I'll explain later.
[Windows Phone 7 Development and Hacking] Briefcase:
The latest Lumia 800 fw is 1600.2483.8106.11500 (which you get when installing via Zune) and 1600.2483.8106.11501 (if installed via Nokia Care Suite). Both firmwares are identical, Nokia only differs the number to differentiate from both methods.

Please note that the 11500 firmware hasn't been captured yet in Heathcliff's thread, so you might wanna run wireshark aside to capture the cab file as well when updating via Zune.
[Windows Phone 7 Development and Hacking] Jaxbot:
My device is open market (I think) and has firmware 1600.2475.7720.11414, with no Zune updates to be installed.

I'll try Nokia care and see if I can update my firmware, and if that fixes the network setup problem.
[Windows Phone 7 Development and Hacking] Briefcase:
If i remember correctly there were users with unbranded phones who did get the update via Zune. So you should be able to get it that way too. Microsoft started distributed the update on Jan, 19th. In their blog they announced it would roll out as normal, in stages, with the last stage delivery approximately two weeks afther the 19th. That would be yesterday if they were strict ;-).

You could always try the disconnect trick to get it, that works for lots of people. Nonetheless, the Nokia Care Suite solution is fine too ofcourse ;-).

Good luck.

Edit: the previous version of the Nokia Network Setup App also required the (in that time) latest firmware update (which was the 1600.2479.7740.11451 fw you mentioned) before it would run. The app has just been updated, so it seems they do that with every firmware.

So:

- Original nokia fw: 1600.2475.7720.11414 (with 7720 OS version)

- First nokia fw update: 1600.2479.7740.11451 (with 7740 OS version) [~7th Dec 2011]

- Second Nokia fw update: 1600.2483.8106.11501 (Nokia Care Suite) or 1600.2483.8106.11500 (Zune) (with 8107.79 os version) [11500 and 11501 dont differ] [19th Jan 2012]
[Windows Phone 7 Development and Hacking] Jaxbot:
Trying the disconnect trick... Nokia Care Suite never connects to the server properly, think my install is broken, but if someone has a link to a working download of it, feel free to PM me *cough*
[Windows Phone 7 Development and Hacking] Briefcase:
It's a known fact that Nokia Care Suite won't connect to the servers (dunno why exactly). We use Nokia Data Package Manager to download the firmware than place the fw in the appropriate folder where NCS can find it. That should work.

Jaxbot, see this post (and the thread) for details. As you have an unbranded phone allready, just download the fw for the correct product code and forget about renaming files.
[Windows Phone 7 Development and Hacking] voluptuary:
the disconnect trick worked for me. I had to turn on airplane mode and try quite a few times to get it to pop up but it worked eventually. Mine was a dev gift phone from Nokia, so probably the same one you have.
[Windows Phone 7 Development and Hacking] ChrisKringel:
I have a developer unlocked Lumia 800 unbranded with fw 11500 and os 8107.79. If you need someone to test something drop me a PM ;-)
[Windows Phone 7 Development and Hacking] dragonide:
Jaxbot, could this new idea of your, the one you are experimenting now, be applied to Nokia devices only ? Are HTC devices excluded from the start ?
[Windows Phone 7 Development and Hacking] Jaxbot:
Well, bad news, folks. Stayed up late last night flashing my Lumia to the latest firmware, preparing everything, and you know what? It turns out there's even more security in the Lumia's drivers than I thought, and my exploit ultimately failed.

I'm not going to discuss what it was that I tried, since it might be useful other places (HTC perhaps), but in the short scheme of things, my idea for finally getting my Nokia interop unlocked was crushed.

I'll keep working at it.

Any other bright ideas?

And before anyone asks, no, I didn't try what Heathcliff already did for Nokia devices, which obviously doesn't work. But if someone can point me to where I can find the exact restrictions in the provisioning drivers, that would be appreciated.
[Windows Phone 7 Development and Hacking] ChrisKringel:
Dang, bad news :-/ I guess a helpful thing would be to get ur hands on the provisioning driver so that we can check how the provxml files are restricted. I guess this will not be possible by using the HTTP-server-app because of file restrictions?

I'll try to look through the update packages as some contain provXML-files as well. For instance to copy files to other Directories. Maybe we could inject something into the autostart. However I don't see how this could be useful since we still have no regsitry access...

I just stumbled across this provxml file

<?xml version="1.0" encoding="UTF-8" ?>
<wap-provisioningdoc>
<characteristic type="SecurityPolicy">
<parm name="4141" value="0"/>
<parm name="4142" value="4096"/>
<parm name="4143" value="4096"/>
<parm name="4119" value="0"/>
</characteristic>
</wap-provisioningdoc>

in the file NOKIA_RM801_PROVISIONING.cab.pkg. As I am very new to provisioning could someone explain me what this operation does?
[Windows Phone 7 Development and Hacking] Jaxbot:
That just sets some security policies... I'd have to look up what they do, though. Which update cab is that from?
[Windows Phone 7 Development and Hacking] fletcher1989:
Dang....That is all im waiting for is a Lumia Interop Unlock. These phones seem to have more security in them than an iphone lol.
[Windows Phone 7 Development and Hacking] Jaxbot:
For real. I can copy files onto the phone, and have limited access to the provisioning system. You'd think at least ONE of those would be enough *eye roll*
[Windows Phone 7 Development and Hacking] ChrisKringel:
Here you go:

http://download.windowsupdate.com/msdownload/update/software/dflt/2011/11/pr101_oemupdate.cab.pks_efdd12ba9cd430877dd102ba1151455494f99946.cab

(link)

The file is named "NOKIA_RM801_PROVISIONING.cab.pkg". Someone also mentioned that registry acces is done through the OddtDriver.dll which can be found in the "NOKIA_RM801_OEMMOAPPS_NOKIA_SERVICETOOLS_PROD.cab"-package.
[Windows Phone 7 Development and Hacking] Jaxbot:
Alright, will take a look at that when I get some time later, thanks.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
That's actually really interesting - I didn't know it was possible to set security policies using provxml. There's been considerable effort put into trying to subvert the policy system on WP7, and (custom ROMs aside) the only person who claims to have pulled it off isn't sharing even vague info as to how.

The normal Webserver apps can't download ROM modules, because they aren't really "files" and can't be opened with the file management APIs. Back in the WinMo days somebody came up with a clever hack for getting a read-only view of them (use LoadLibrary to map it into your process virtual memory space, then do a memory dump right out of the process's code pages). It's probalby still possible to do that on WP7 (though you may need substantial permissions to do it) but I don't think anybody has done so yet. Even the HtcRoot webserver can't download ROM modules (ROM files yes, but not modules).

---------- Post added at 11:22 AM ---------- Previous post was at 11:20 AM ----------

@Jaxbot: Well, there's hope for it working on HTC, certainly. Lots of people with Titans and Radars who want interop-unlock!

I can't really offer "Any other bright ideas" when I don't even know what you were looking into, though, unless I get some sudden inspiration.
[Windows Phone 7 Development and Hacking] Briefcase:
Jaxbot, how did you update the Nokia to the latest fw? 11500/11501? if via zune, did you manage to capture the update cab of that update?

Thnx.
[Windows Phone 7 Development and Hacking] edangel:
wow...thanks a lot..!!its working fine with my samsung omnia w diagnosis version 1021.. :D :D
[Windows Phone 7 Development and Hacking] dragonide:
Hell , yea !
[Windows Phone 7 Development and Hacking] Tornado54:
Hi guys. I tried installing this on my Samsung Focus and I followed all the instructions but later on when I used Tom's XAP Installer to install a XAP file it says "Please make sure your device is unlocked and connected to PC/Zune"

Wonder what i am doing wrong? My OS verysion is 7.10.7720.68.

Thanks for your help.

Edit: Got it working.. thanks guys :) I hadn't used the application deployment tool.. stupid stupid me.
[Windows Phone 7 Development and Hacking] Jaxbot:
I did it through the store tool, so no Zune cab, sorry.

I'll play with HTC, see what happens.

As for security policies, these are different. They do stuff like this:

http://msdn.microsoft.com/en-us/library/bb416355.aspx

See \HKLM\Security\Policies, they're in HEX values.
[Windows Phone 7 Development and Hacking] ryotgz:
I'll keep my fingers crossed :P
[Windows Phone 7 Development and Hacking] Jaxbot:
The biggest question, though, is if it's worth it to interop unlock HTC (assuming this works), because this would be easily patched in an update, and I would hate to have a perfectly good exploit patched before we know what it's really capable of.
[Windows Phone 7 Development and Hacking] drupad2drupad:
Isn't this the case with every other exploit? We as end users need to make sure not to update and over-ride the patch!
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Ahh, thanks for the links on the policies. A little disappointing, but I didn't exact that it would be so simple to change the loader/verifier policies anyhow.

I wonder how many of those policies are still useful on WP7? A number of them, like "allow unsigned CABs" and anything about "privileged" processes, aren't really relevant anymore (though they have analogues on WP7 that might benefit). Others, like allowing unsigned programs, seem unlikely (that's now blocked by LVMOD, the loader/verifier module, which is a new component). Some, like turning off HTML email, seem kind of silly, but may still work...
[Windows Phone 7 Development and Hacking] Heathcliff74:
Most important policies from that list have indeed been replaced by the PolicyEngine.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Thanks, Heathcliff74. No surprise, but good to know. I wish the new policies were as easy to get at as the registry...

BTW, congrats on reaching 2^10 posts. :-)
[Windows Phone 7 Development and Hacking] Heathcliff74:
LOL! I do post too much :p
[Windows Phone 7 Development and Hacking] Briefcase:
How comes new components in the native wp7 sdk like for example PolicyEngine are not documented at MSDN? For Windows CE there is a lot more documentation, is that because development for WP7 isn't allowed to run native code anyway, so they have just released documentation for api's they provide via the WP7(.1) sdk. How about OEM's that need to built drivers (which requires native code). I assume they do have more documentation than just the WP7.1 sdk right?
[Windows Phone 7 Development and Hacking] Heathcliff74:
The policyengine will always remain undocumented. I'm sure of that. Even OEM's do not have documentation about that. They will have more documentation, for sure. But not about direct access to the policy engine. The only way they have control over the policies is at the time they cook the rom. They do that with policy-configuration-files. They are still present in the Windows folder on a live OS. But at runtime, even their drivers don't access the policyengine.

Heathcliff74
[Windows Phone 7 Development and Hacking] Briefcase:
Ah i see, sounds reasonable. From what i've read here http://windowsphonehacker.com/artic...nlock_native_exe_applications_on_wp7-09-09-11 the only way to avoid this is by patching the dll's. And because it are ROM files this can only be done when cooking your own rom (which requires a hacked/altered bootloader). Is this policyengine also responsible for checking certificates of signed files that you know of? i.e. is there a policy that specifies 'each and every file has to be signed with this and that certificate before i allow to run it'. I read on this forum too that GoodDayToDie is trying to add his own certificate to allow code to run which is signed by his certificate. Does this mean that there is not one single certificate for signing executables/libraries but that each oem could have it's own? I was in the understanding that there was only one. Thnx again.
[Windows Phone 7 Development and Hacking] SolBallads:
@Jaxbot

My friend please dont give up on Lumia!!!

I can't wait for the day I'm gonna read that you finally unlocked it :)

I'm sure that I'm speaking on behalf of most Lumia Users out there when I say that I'm confident that you will succeed!

GODSPEED!!
[Windows Phone 7 Development and Hacking] Heathcliff74:
There are quite a few certs that are allowed. Look at \Windows\ciroots.p7b for example.

All binaries that are loaded into memory run through the LoaderVerifier to allow access to chambers and resources. The LoaderVerifier queries the PolicyEngine for that purpose. This also contains rules for rom-files.

Taskhost has its own additional policylist. Relevant info is stored in pacman.edb. There are all the signatures of installed binaries stored.

GoodDayToDie tries to add his cert in the CI store. Something I did a long time ago, but in the end it didn't work, because you need to add policies for that too. More info here.

Heathcliff74
[Windows Phone 7 Development and Hacking] Briefcase:
Massive thanks for the clear explanation :-)
[Windows Phone 7 Development and Hacking] dragonide:
2nd generation HTC phones don't have any choice.

If an update would come to fix the exploit, we could choose not to update and keep our devices interop unlocked. We can't say if the the '300 value' (for the interop unlock) would be kept during a future update (and by doing so without breaking the interop unlock as already happens for 1st gen HTC), with the only side effect to force new users to downgrade to apply your exploit.

This scenario doens't look so bad to me ...
[Windows Phone 7 Development and Hacking] Jaxbot:
There are more policies, they just aren't on MSDN.

As for all this talk, the point is this: It has nothing to do with updating, because yes, end users are responsible for whether they update or not. But take Nokia as an example. Nokia devices would be easily interop unlocked, had the provxml exploit not been found over a year ago. They know about it, though, which is why it's patched.

Any new exploits follow the same rule, so we have to be careful in deciding whether it's "worth it" to publish. Heathcliff knows where I'm coming from.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Yeah, it appears that adding a cert really only requires registry access (you can do it with the Crypto APIs too, but I think you need quite high permissions to add to the root or Code Integrity stores). For purposes of getting native code running, that was a lot easier than beating the policy system.

I wonder: the original ChevronWP7 Unlocker was blocked by patching the unlock feature to only allow the Microsoft cert when talking to the server. Did they actually make it *only* use the MS cert (or at least have a chain of trust up to Microsoft), or does it simply require that it not be a cert in the user store? With Microsoft showing fairly little commitment to official cheap unlocks (Chevron Labs taking forever to arrive, then selling out in three months and no talk of getting more), and the risk of something like WindowBreak stopping working, it might be worth checking if there's some way to re-unlock using "ChevronV2" if the phone ever gets re-locked after WindowBreak et al are patched.
[Windows Phone 7 Development and Hacking] Jaxbot:
From what I know, it just has to be a trusted cert.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Chevron was blocked, because the root of the cert is now not checked against the "root" store, but only to the "CA" store.

You do not only need to have privileges to the registry. You also need to have the headers figured out. This has been implemented in WP7 Root Tools for quite a while already (see screenshots in opening post).

The whole point of adding certs to the stores it to make them trusted.

Heathcliff74
[Windows Phone 7 Development and Hacking] Jaxbot:
That's what I'm saying. It has to be trusted in the CA store. Adding it to the MY store trusts it for Internet Explorer browsing and some other things, but it is not trusted for critical tasks, such as device unlocking.

So yes, adding it to the store will make it trusted. That's the only criteria, afaik, meaning that, if we added our own cert to the CA store, it wouldn't question Chevron/etc's usage.
[Windows Phone 7 Development and Hacking] i_mendes:
Regarding the camera settings translations:

If I copy the xml file with portuguese translation on 7004 version, and then do all the updates to 8107 throug Zune, that file stays on the phone after those updates?

Thank you all.
[Windows Phone 7 Development and Hacking] Jaxbot:
Hey GDTD,

If your goal is to allow unlocking in the future, in case of a relock, why not just change the developer portal to a different server that always outputs the correct developer unlock state? The server would be trusted if it's common name matches its domain, so if it's a legitimate SSL server, it should work fine.
[Windows Phone 7 Development and Hacking] myfocusw7:
Is the new upate safe for already window breaked devices?

I know that You shouldnot be upgrading Zune if you havent unlocked yet but what about already unlocked ones?
[Windows Phone 7 Development and Hacking] Jaxbot:
Uhm... Wrong thread?

Especially considering I saw this over on my site not too long ago =P
[Windows Phone 7 Development and Hacking] myfocusw7:
Yup wrong thread:o

I was going to post in the other thread about the issue(hadn't checked the site) but now that You have replied there so I suppose bumping that thread wouldnot go anything great:p
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@Jaxbot: Good idea about changing the portal (rather than using a proxy like ChevronWP7 Unlocker did). That, plus the ability to install a cert, should allow people to re-unlock their phones and possible even go straight to interop-unlock when they do. Worth checking out...

I have so many projects right now, though, that it'll take a while. General improvements to HtcRoot, Xap Install on stock ROM, Adding features to HtcRoot Webserver, Execute homebrew native EXEs, Modify the policy database. ChevronV2 will have to take a breather.

Hmmm... maybe I should PM the original devs; they're in a better place to start this project from. Of course, they might also be under some agreement to not do that (though after MS limited the ChevronWP7 Labs unlocker as well... screw that crap).
[Windows Phone 7 Development and Hacking] Jaxbot:
You could even use the Device Registration tool in the SDK to do this. I'll try my idea and see if it works.

I'll plus one the idea of XAP install on stock ROMs, though =P Even with root access, I can't find the right API for non-Marketplace apps.