yashsingh1/xdaforums huggingface dataset:
[Windows Phone 7 Development and Hacking] GoodDayToDie:
New approach to WindowBreak that may work for some HTC

I've got an idea. I haven't had time to test it yet, but it should work. This will only work on HTC phones that, *if dev-unlocked,* would be able to use interop-unlock (Firmware version *.*.4XXXX.* and below, able to use Connection Setup). However, it will work on phones which are *not yet* dev-unlocked.

People have already tried using a proxy to replace requested XAPs that are installed to the phone over WiFi. The substitution works - the XAPs are not downloaded over a secure connection - but the apps won't install because they lack signatures, and a non-dev-unlocked phone won't install unsigned apps.

So, consider this: take a Marketplace XAP, complete with its embedded signature. On its way to the phone, intercept it with a proxy. Instead of replacing it with a homebrew app, modify the XAP file. Add to the archive the relevant contents of the HTC Interop Unlock XAP - that is, the ..\..\..\..\CSWM7_Sample folder, and its contents. Then, send the modified XAP on to the phone, which installs it as a signed Marketplace app... with a rider that will get placed in the filesystem and can be used to unlock.

The steps for doing this will be a little complex, but not too bad: install a proxy server (on your PC, probably) and route the phone's Internet connection through it. The proxy will monitor for *.XAP files downloaded from the Microsoft server. It will modify the XAP file automatically. The user's steps will be:

1) Download the proxy software and run it.

2) Route the phone's connection through the proxy (probably by connecting the phone to Zune on PC using USB, and using the proxy for the app that routes that connection).

3) Using the Zune software, download and install any app (free/trial/whatever) from the Marketplace onto the phone.

4) Run Heathcliff74's instructions for HTC Interop Unlock (open Connection Setup, select custom network, country is "Interop Unlock", etc.)

I'm pretty sure this will work. At the very least, it's worth trying. None of the signed files were tampered with, and the XAP as a whole is probably not signed (if it were, the signature would need to be sent separately, since adding the signature into the XAP would modify the hash upon which the signature is based). It's possible that there's a check which will interfere, but I doubt it. Somebody want to give this a shot?
[Windows Phone 7 Development and Hacking] drupad2drupad:
It migth be off-topic but relevant info:

HTC Update has changed it's firmware including the bootloader. I am not sure how far it changes the exploits or makes them easier (I wish!)
[Windows Phone 7 Development and Hacking] meandu229:
Do you know of any software which will allow me to edit the xap before allowing it through to the phone.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
If you're stuck at the point of "what proxy software can I use?" then this might not be the right project for you to undertake... but it couldn't hurt, and you'd learn a lot. I believe the prior attempt used Fiddler, but it might have been Squid.

Internet proxies allow various types of "man in the middle" filtering. When a connection that matches a filter rule (such as a response over HTTP that comes from a certain server and contains a certain filename) is detected, the proxy server can interrupt the connection and run some other software. In this case, that software would download the original XAP, modify it, and hand it back to the proxy. The proxy would then allow the connection to resume, passing the modified response instead of the original one.

Writing the modification function would be something you'd have to do yourself. Look up the interface that your choice of proxy provides - it might be a plug-in, or it might be an external program that the proxy launches, or it might be something else. Re-writing the response shouldn't be a problem though; that's pretty typical behavior or proxy (other things they are used for include filtering out certain sites or types of content, monitoring the network for certain traffic, and anonymizing traffic such that the server doesn't know who the client is, only what proxy they used).
[Windows Phone 7 Development and Hacking] meandu229:
Cheers for the info, Ill try look into it this weekend if no-one else has a chance, im a professional developer but dont get my hands dirty in much other than wpf with .net.
[Windows Phone 7 Development and Hacking] LayneRobinson:
If you're handy with .Net, you can find plenty of example code for making your own proxy (i.e. http://www.mentalis.org/soft/projects/proxy/) and then you can pop in your own code at the appropriate place.
[Windows Phone 7 Development and Hacking] Jaxbot:
I'll give it a shot; this would be a very worthy experiment and would make some things sooo much easier. Plus, I have all the tools and experience, so I'll give it 5 once I get home this evening. Good thinking!
[Windows Phone 7 Development and Hacking] andy123456:
And what should i do now with my device? Cant deploy any xaps after

unlocking:(
[Windows Phone 7 Development and Hacking] roqstr:
the given unlock-method in this topic is kinda like interop-unlock: you need a developer- or chevron-unlocked phone to use it!

//edit: wait, can't find a statement here about that. please somebody correct me if i'm wrong saying that a already unlocked phone is needed.
[Windows Phone 7 Development and Hacking] andy123456:
the windowbreak project is to unlock the device or isnt? by reading this thread

or viewing the video from windowbreak.com, its clear. or didnt i understood

something?

Edit: i mean http://windowsphonehacker.com
[Windows Phone 7 Development and Hacking] Jaxbot:
An update for GDTD: I tried it, and from my intentional findings, it didn't work as planned.. still need to play around a bit more. Any idea where the XAPs are stored pre-extraction?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
You mean, stored on the phone's filesystem? \Applications Data\Phone Tools\Install\<GUID>. It's very brief though; the manifest is unpacked from the app, then the mainfest and the entire XAP are copied to that folder, and I believe from there they are unpacked directly into the \Applications\Install\<GUID>\Install folder. After that, though, the manifest and XAP are deleted.

Using my Root Webserver (and hitting Refresh a lot), I was able to watch as the files were added to the folder under Application Data, and then were removed. I was also able to download the XAP by timing it right, and used a file comparison tool to verify it was the same one that I'd installed. Note, however, that this was a sideloaded XAP. I can't promise that Marketplace XAPs follow the same procedure.
[Windows Phone 7 Development and Hacking] Jaxbot:
I know that's where sideloads go, but that's under Phone Tools, which is specifically for development. I'm pretty sure Marketplace does it differently.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@roqstr: You should read the original post again, more clearly. This hack neither requires installing a XAP, nor being able to do so. It's dev-unlock and interop-unlock in one step. That's kind of the whole point, really; interop-unlocking an already dev-unlocked Samsung phone was achieved some time before this project was launched. This is a way to avoid needing to get an AppHub account or pay for a ChevronWP7 Labs token (back when they were available... <insert grumbling here>).
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Hmm... that's disappointing. What happened; did the app just not install, or did it not unpack the files, or what? It's possible that the signature applies to everything in the XAP except for the DRM file, or that there's something like a file-sie check on the XAP. I'd suggest downloading the Marketplace XAP and making the modification manually (being careful not to modify any other files/folders/timestamps/whatever)and having the proxy substitute that into the response, just to be sure it's not due to a bug in the way the file is modified.
[Windows Phone 7 Development and Hacking] Jaxbot:
Hm, I'll try some different experiments and get back to you on that. There *is* a file size check on the XAP, I know that, but you can get around this by editing the plain text XML from the server that gives the size. I think it's just a check to make sure the download isn't corrupted or incomplete.
[Windows Phone 7 Development and Hacking] Jaxbot:
Wow. It actually worked. Changed some stuff around, added folders and files into a Marketplace XAP and then had Fiddler replace it when downloading. .. trick works, XAP installs, etc. Beautiful... just beautiful. *sob* I can really make something out of this :p

Nice call!

P.S. apparently i was wrong about the size check. Was pretty sure I wasn't, though. Not sure what happened, but it works right now, so I'll just not complain.
[Windows Phone 7 Development and Hacking] Briefcase:
Good news! I'm out of thanks for today so will give some tomorrow haha.

If I understand correctly, with this we can place files on the phone's filesystem without the need of any kind of unlock (Developer/Interop Unlock/Full Unlock). So that means it's basically a backup if Microsoft fixes the exploit Window Break uses to get files to the phone?

We still have to find ways to unlock the phone as this 'only' allows us to place files to most of the phones file system (I assume restrictions to \Windows are still active?). So we now have a second way of transferring provxml files to the phone without the need for developer unlock. Other (phone specific) hacks are still required to alter the registry in order to unlock.

Great work guys, you are the best :-).
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@Jaxbot: Fantastic!! I can't wait to see this shared for others to use. Thanks so much for making it happen. I just wish I'd thought of it earlier... all those people who've been waiting on a way to dev-unlock their phones, but a lot of them probably installed the HTC firmware updates. :-( Weird that the filesize check doesn't seem to be enforced (maybe it's just informative; the little "X megabytes" notification at the bottom of the Marketplace view for an app?) but hey, I'll take it! Great job on this.

@Briefcase: Sadly, it's not quite like that. The way this hack works is fundamentally the same as the way that both the existing Interop Unlock (and similar) XAPs work, and the way WindowBreak works; they all rely on the way the phone handles ZIP archives (which is the same whether the extension is .ZIP or .XAP). This is just a new way to exploit the same behavior on the phone, one that doesn't require dev-unlock (the way the current HTC Interop Unlock does) and doesn't require recognized file extensions (the way WindowBreak does). It's an incremental improvement, not an all-new hack. The same single point of failure still applies.

It's certainly a nice improvement, though! Additionally, it can even be used on phones which don't have interop-unlock hacks yet. For example, my OEM Marketplace XAPs use the same trick with putting files on the phone, and using this hack it'll be possible to do that on Nokia or Dell phones, even though we can't currently use a hack to unlock them. Additionally, it has possibilities for restoring data from an old phone to a new one...
[Windows Phone 7 Development and Hacking] meandu229:
Good work GDTD and jax, looking forward to trying this out on my titan to get my introp unlock on the go, Great work once again

thinking about it this wont work on gen 2 htc will it for introp
[Windows Phone 7 Development and Hacking] Jaxbot:
There are a couple cool things this hack can do; I'll probably build a nice wrapper at some point, but in the meantime, this will be a nice pawn to go with some of my.. other.. pawns ;)

I just wish Microsoft weren't all up in our business. I feel guilty talking about this in public. >:l
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@meandu229: No, it won't work (for dev-/interop-unlock) on any phone with recent firmware. Tests so far have shown that although the Titan uses a similar firmware version numbering scheme, its version numbers don't mean the same thing. I don't think any Titan firmware version is compatible with the Connection Setup -> provxml hack.
[Windows Phone 7 Development and Hacking] dragonide:
It is already confirmed this would not work with the new HTC firmware ?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
@Dragonide: It works exactly the same way as the current HTC Interop Unlock. The difference is that instead of sideloading a XAP to place the files on the device, it piggybacks those files on a Marketplace XAP.

We don't currently know of any provisioning files that will work on a second-gen HTC phone. If we did, there would already be an interop-unlock XAP for HTC's "v2" drivers, both gen1 and gen2.
[Windows Phone 7 Development and Hacking] Jaxbot:
By the way, if anyone has the diagnostics application from the Titan/Radar, or an HD7 ROM with similar characteristics, do send it my way. Want to check something and I don't have any 2nd gen HTC devices. Also, if anyone has an extra 2nd gen HTC and wants to send it my way.. :P :D
[Windows Phone 7 Development and Hacking] andy123456:
Can anyone answer my question please?

os version: 7.10.8107.79

firmware: 2424.10.10.6

radio: 2424.10.11.1

bootloader: 4.11.0.3

diagnosis tool: 0210

windowbreak successfully saved in gprs manager, but no luck after rebooting

the device and trying to deploy with various deployers.

device is synched with zune (not as guest) and screen is unlocked.
[Windows Phone 7 Development and Hacking] andy123456:
nobody know an answer for my prob?
[Windows Phone 7 Development and Hacking] shinkstor:
Hey everyone, I am pretty sure I have found an exploit to run arbitrary unsigned code on wp7, but I just need some help. Does anyone know how I could configure my computer to redirect traffic not using the hosts file? For example, if I wanted to redirect http://www.google.com/images/srpr/logo3w.png to localhost, but keep www.google.com still working? Is there some sort of program to aid me in this?
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Yeah, you'd have to use a proxy. That's more-or-less what I was discussing a couple pages ago.

Care to let us know what you're thinking of? PM is fine if you don't want to share it publicly. At a guess, you're thinking of one of two things that are already known to not work, but if it *is* possible, I'd love to help make it happen.

Speaking of that proxy thing Jaxbot, any chance of getting a packaged version of that for people to use? Let me know if you'd like a hand with any portion of it.
[Windows Phone 7 Development and Hacking] Jaxbot:
I'm working on something right now. Well, actually, I'm busy right now, but I have something handy that'll be out in a bit, once it's ready. Hold on that.

Skrinkstor, please PM me.
[Windows Phone 7 Development and Hacking] darthveda:
which device?
[Windows Phone 7 Development and Hacking] Sourojit258:
Hi, I am new to WP7 from Android and a lot confused with various threads over xda. My question is. Can I install wp7 root tools, If i am student unlocked? as a fact i am getting error. But i am able to install other xaps(only 3 by rule). Guess i dont have root access.

I have also tried all tools available till date including windowsbreak, nothing new appears in gprs manager. Ya, i know its mentioned that they wont work on new firmwares.

My device is Omnia W. details are as followed:

OS Version: 7.10.8107.79

firmware rev n.o: 2424.12.01.1

Hardware rev n.o: 23.15.0.8

radio soft version: 0424.12.11

radio hardwre vrsn: 0.0.0.800

Bootloader version: 6.1.2.0

Chip SOC versn: 0.74.2.1

Diagnosis ver:1109

Student unlock is no fun atall, just that i can install few simple app. So can the student unlock be used to any advantage for having root access? Or any other things I can do for getting super user privilages.. Then please redirect me to the correct thread.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
You need interop-unlock in order to install WP7 Root Tools. Currently all the interop-unlock hacks for Samsung phones use the same basic hack, so if WindowBreak doesn't work, the others won't either.

Did your phone come with that firmware installed? If not, you can roll back to before the firmware update by having Zune restore the backup on your phone. This should let you interop-unlock, after which you can install efectively unlimited apps and use WP7 Root Tools.
[Windows Phone 7 Development and Hacking] Sourojit258:
@GoodDayToDie: NO my Omnia W didnt come with this update. I bought it last month i.e march 2012..and the one it came with was also not working with Windows break.

The i guess there is no option now. Is there any option to restore someone else's old backup? Ya, but again Omnia W i not that popular yet and is a recent handset, so i guess it will be hard to get. So I have to wait long.

I am totally noob in wp7 and feel android was much easier. Still, I am ready to offer any help needed in testing with this device.
[Windows Phone 7 Development and Hacking] tooly26:
you have to find and older firmware 4 your device...than windowbreak must work...

Sent from my OMNIA7 using Board Express
[Windows Phone 7 Development and Hacking] Jaxbot:
Bad news, kids.

The Marketplace hack that GDTD suggested and that I was using doesn't actually work. As I had originally thought, the signature (checksum?) of the XAPs are checked when the XAP is installed. For some odd reason, this rule doesn't apply to my full unlocked Focus, but does apply to my Lumia (and my Focus prior to being full unlocked, as I recall this being a problem when I experimented with this a long time ago).

This basically ruins the entire exploit, unless someone comes up with a creative idea. Ughhhhhh.
[Windows Phone 7 Development and Hacking] GoodDayToDie:
Nope, restoring an update from another phone is currently totally impossible. They're encrypted with device-specific keys.

Is there an earlier firmware available that you could flash to your phone to get it back to a WindowBreak-compatible version?
[Windows Phone 7 Development and Hacking] Sourojit258:
Ya i got that later, that it wont be pos to restore others backup.

At least with me, my previous version with which the phone was shipped, was not compatible with windows break, so restoring wont help me.

Are the firmware files of wp7 available separately? where to look for it..
[Windows Phone 7 Development and Hacking] GoodDayToDie:
The stock ROMs for HTC phones are available on the XDA wiki (link at the top of the page). I don't know if they're available for the Omnia W yet or not, though.

You could try finding out what firmware version your phone "should" have and just searching the web for "Omnia W <VERSION> ROM" or some such.

I'm surprised that you got an update but the old version wasn't compatible. Was it a firmware update, or just an OS update? Also, are you sure you weren't using an "updated" version of the Diagnostics app? They've pushed an update over the Marketplace that cripples the GPRS mode; you need to uninstall the app from the list and then re-install it from the dialer if you even installed that app update.
[Windows Phone 7 Development and Hacking] Sourojit258:
Ya, i am sure the last one was not compatible. Trying to break it was the first thing i did after buying and returning home. I am not sure about the update though, as at that time i didnt had any basic knowledge of wp7.

About diagnostics, before update it was 1109 and after update also the same.. Yesterday I updated it from the Marketplace. But later again i was trying another hack method, which said to uninstall first then again install from keypad, doing that i got back to 1109. I guess now you can figure out things going out with me. can you just mention <version> which will work with the hack. Will search like wise.

Offtopic: Btw now i was searching for omnia W on xda and found lot of threads, its becoming so confusing and unorganized, but 1 commendable thing is, I have seen you reply every where. Thats very generous.

found only 1 result for search of firmware, on xda but thread is closed thought the link is working. Its 7720.. my present one is 8107.

http://xdaforums.com/showthread.php?t=1476422
[Windows Phone 7 Development and Hacking] Jaxbot:
That's not why. The XAP is signed.
[Windows Phone 7 Development and Hacking] Heathcliff74:
Oh you mean you first unlock and then use a provxml tool to copy?
[Windows Phone 7 Development and Hacking] Jaxbot:
I could do that, but I just used the diagnostics application to copy files into \windows.

Basically, what I'm trying to see is if Nokia/HTC blacklist the file transaction CSP, and if not, how copying into \windows will help us.
[Windows Phone 7 Development and Hacking] voluptuary:
So you can't deploy to just Windows or Windows and it's sub-directories? If you can deploy to sub-directories what if you put a reg file in Windows/StartUp?
[Windows Phone 7 Development and Hacking] Heathcliff74:
I see. Well, both brands have "FileOperation" not whitelisted. So, not an option.

Heathcliff74
[Windows Phone 7 Development and Hacking] Jaxbot:
I'm not sure putting a reg file there would help, since no application handles reg files for writing (otherwise we could just email ourselves reg files and click on them).

And no, we can't just deploy into Windows or any sub directories. /There may be a work around, though, but I need to research it more/.

Never mind.
[Windows Phone 7 Development and Hacking] voluptuary:
ok well how about the shortcuts in windows/startup? do those shortcuts all point to a place that you can't deploy files to? Cuz what im thinking is overwrite one of the targets of one of those shortcuts with something of your own that would then be executed.
[Windows Phone 7 Development and Hacking] slysy:
Thanks for posting this. Is this easily reversible (can I relock the phone)? Is there somewhere I can find a list of the best WP7 homebrew apps?
[Windows Phone 7 Development and Hacking] Jaxbot:
You could relock the phone, but there's really no reason to. This isn't like jailbreaking an iPhone; no employees are going to stop you from grabbing cheap white earbuds =P

As for the best homebrew apps, check the signatures of the people who posted in this thread. There's a good start ;)
[Windows Phone 7 Development and Hacking] shinkstor:
How does one see the whitelist for the operations? Also if .reg files couldn't be read, then why would they be in the phone anyway? There is one labled "AlternateBoot.reg" but I have yet to mess with it since it seems important. I'm thinking it probably is used for booting into format or download mode... Maybe it will write to the registry when that happens... I guess it's pointless if you still need provxml exploits though.
[Windows Phone 7 Development and Hacking] Jaxbot:
I mean, there is nothing that will shell execute and parse the reg files. The system probably has some sort of internal method to running that file through the parser. Interesting, though. It seems to be used as.. some sort of safe mode? Not sure what that file is for, but I'll play around with it.
[Windows Phone 7 Development and Hacking] Leapo:
I can confirm this. No matter how many times I re-run WindowBreak, 3G never comes back after a reboot. :(

Edit: And I can't deploy the 3G fix either, it fails with the error code "0x81030120"
[Windows Phone 7 Development and Hacking] suua:
Working great man!!!!! thanks a lot !
[Windows Phone 7 Development and Hacking] Jaxbot:
Hmm your device isn't really being interop unlocked then. What model is it?
[Windows Phone 7 Development and Hacking] Leapo:
Just a regular Samsung Focus, 1.3
[Windows Phone 7 Development and Hacking] Jaxbot:
Has it been previously unlocked with anything?
[Windows Phone 7 Development and Hacking] Leapo:
It was Chevron unlocked first
[Windows Phone 7 Development and Hacking] Jaxbot:
Then WindowBreak isn't really working, and I can't say why. What OS version?