yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] donpromillo:
Hi

Pleaze, look at the attached pictures.

Did somebody of you have this seen , when connected the lumia in restoremode (camera button pressed on reboot until vibration) :

How can I access the UldrStorage? If I connect the phone in restoremode in Linux, the phone reboots 10 seconds after the restoremode was entered and the phone is connected to USB port. The device in lsusb is shown as Nokia Lumia 800 and the serial of the device is recognized.

In Windows the phone did not reboot, instead the device is as shown in the pictures.

I've a unlockable (qualcomm bootloader) Lumia.

Regards

DonPromillo
[Nokia Lumia 800] spgi:
Just do not fit! So you can not extract the unlocked bootloader and embedded in other Nokia?

Extracted bootloader generally is signed!

One time we embed it with mtty, telnet, putty ....

There be solution, do not see it!

Sorry for not so good English
[Nokia Lumia 800] biktor_gj:
Not that simple, bootloader isnt flashed with the signature, the sig is just for checking before writing... (this is not an Xperia :))

About UldrStorage: is accessible in locked phones too, but doesnt let write abything to it. It shows 4gb available. If someone else wants to check you night need to enable legacy mode in zune driver to make it show on windows
[Nokia Lumia 800] donpromillo:
Thanks for information. According to a pdf about the architecture of WP7 I read meanwhile, Uldr contains XIP(executable-in-place) RAMIMAGE of the Update Loader version of the System Update Loader and is locked while OS is running. It Become readable/writable when in update mode. (see attached picture)

So even we could only read the content, it could be helpful to discover the update process and/or the restore mechanism of a zune backup. Or is Uldr only synonym for Sldr in OSBuilder (but that isn't 4Gb AFAIK) ?

regards
[Nokia Lumia 800] lenarass:
after trying to flash my lumia 800 it doesnt turn on.. what should i do ?
[Nokia Lumia 800] ChrisKringel:
You should post in the Q&A thread.

Did someone took a look into the OEM_7X30_ULDR files in the latest update? Maybe there is something useful in there.
[Nokia Lumia 800] Konner920:
panic and get it replaced
[Nokia Lumia 800] biktor_gj:
Interesting fact: if you pick a *flashclean.ffu, hex replace the Nokia OSBL with qualcomm, and flash it with UpdateWP, it will accept the file as good, start the process, erase the flash for 2 hours, and after reaching the 100% it will say the file is damaged and will reboot the phone with the OS partition destroyed :)

At least it didnt touch the osbl and I could restore it with nss...
[Nokia Lumia 800] rescbr:
This remembered of some Windows Mobile 7 PPTs I found some time ago which give an idea how the underlying WinCE BSP, Kernel and ImageUpdate works.

http://www.sendspace.com/file/5gbdwf
[Nokia Lumia 800] ultrashot:
SLDR = ULDR in WP7.

SLDR is a special kind of XIP with special drivers/libraries inside that handle update process.
[Nokia Lumia 800] aleeyt:
Restore nokia lumia 710

Hi guys. Someone tell me how to restore nokia lumia 710. Firmware threw the whole disk instead of the ninth section. If the phone how to restore? Is there any option to just flash the firmware of its stock as it is on the Motorola? For example through the analog rsd
[Nokia Lumia 800] _Madmatt:
Is it that hard to read?? This thread is for DEV ONLY. The Q&A is in the general section. Please post your question there. It's difficult enough to follow this thread...

But to answer you, no your phone is bricked. If it's not written in the 9th partition you probably have over-written your bootloader. Does the phone react when you plug it in? If no, you can only get a new phone. Switch it for warranty reasons but don't tell you messed with it. "It suddenly stopped working"...
[Nokia Lumia 800] donpromillo:
So I extracted the content of Sldr (especially MSXIPKERNEL_uldr). Is it possible to rebuild the modules (dll's) from the packages so one can analyze the dlls?

Regards
[Nokia Lumia 800] Sinate:
reserved
[Nokia Lumia 800] Briefcase:
I don't get why people keep on posting in the wrong thread(s) and why they keep f*cking up their devices over and over again. If people just took a little more time to read around the subject they would realise that this method is easily done wrong without the proper knowledge about what dd is and does and how the partition table on the lumia is configured.

I would double check every step before messing around with a device that has a price tag of a few hunderd dollars. I also see people suggesting to just interchange the destroyed phones at a Nokia care point. That's just wrong, you f*cked up, so take the responsibility and see this as a lesson for future hacks like this...

READ, LEARN, UNDERSTAND, OVERTHINK and only then APPLY.

my 2 cents
[Nokia Lumia 800] Sinate:
calm down

reserved
[Nokia Lumia 800] biktor_gj:
So you people don't f*g know HOW TO READ?

1. This is A DEVELOPMENT THREAD

2. Of course you're stuck. YOU DIDN'T EVEN READ THE INSTRUCTIONS. DID YOU SEE THAT 9 AT THE END OF THE COMMAND??

3. Now YOU MESSED UP THE RADIO, DSP AND WINMO LOADER.

4. Given the fact that YOU'RE PROBABLY NOT READING THIS EITHER, I don't know why will I bother... But anyway: Write this to partition 3 which is what you broke.

http://www.mediafire.com/download.php?q8t098r3p4wflpw

Fixed already? Good. Now, instead of writing the OS PARTITION where the loader should be, WRITE IT TO SDD9 .

For god sake...
[Nokia Lumia 800] biktor_gj:
+1 with that... If we could find what is the file in charge of reading the FFUs we could try to find some exploit...

One thing that's bugging me... The file is loaded into RAM. There are 512 Mb of RAM available for the entire system (adsp, amss, gpu, system etc). What happens if you throw a FFU bigger than 480-512 Mb?

Given that there's some fault already with that since UpdateWP does not seem to verify the update (otherwise my test ffu would have failed the signature when starting isntead of deleting the whole flash), we might be able to do something with it...
[Nokia Lumia 800] Briefcase:
My thoughts exactly. And i'm quoting the whole message again so that it is extra visible ;-). Message should be clear now. Back to development!

Questions about the existing method? CLICK HERE.
[Nokia Lumia 800] biktor_gj:
You're welcome. And by the way, it's not ego, I have 154 private messages of people like you asking the same over and over again. I'm tired.

Could a mod please clean everything non development related from this thread(my psots included)?
[Nokia Lumia 800] Sinate:
I'm sorry if i made a mistake, it was my fault sure but i fixed with my own backup but again thank, i fixed this point and about the part sdd9 on /dev/

By the way some people don't need to scream like that, just because somebody made a mistake, it's human that all, don't need a fast conclusion, i know what i'm doing and i read your thread, just that you forget some point that need to be repeat (not for me) i'm going to delete my post right now.

The good new is that i fix the problem before some answer.

sorry for my post also, i'm not talking about you (ego) but about a post just before you.
[Nokia Lumia 800] donpromillo:
I read the windows phone architect guide once more and I think, there are some remarkable sentences:

"ULDR is updatable and is secured in other ways, such as having restrictions on running code not in ROM and via a hardware flash lock"

"The ULDR supports the following boot modes:

Service Mode

Service Mode provides functionality through MTPz to download Full Flash Update (FFU) images, update device settings or backup and restore a device."

I know, the document is outdated, but if MTPz is (still) used, then the protocol is (at least in parts) uncovered (http://kbhomes.github.com/2012/02/13/mtpz-implementation.html and if I read it the right way, it was possible to retrieve the RSA key and the cert the MTPz-device communicates with the pc.

But my knowledge about this is as small as an ant. Perhaps someone with more of this is able to communicate this way with phone in service-mode?

regards
[Nokia Lumia 800] ultrashot:
one word: recmod. osb has this function available.
[Nokia Lumia 800] Sinate:
biktor_gj

Fix your backup files sdx, i found some of them are corrupted and include stuff that don't need to be here.
[Nokia Lumia 800] donpromillo:
More Info:

I started to USB-Sniff a backup again, and here is what I see:

This is just before the phone reboots. If you read the blog of the linked page in my previous post, you'll see, that there is a small difference to the MTPz handshake described in that blog.

I do not know, if my usb-sniffer cuts off the bytes (only trial mode), but I guess, cause the paket should have 512 byte. Seems very worthy to investigate, particulary because sajid anwar (blog.owner ) was able to complete decrypt the MPTz-traffic and shares his knowledge in the blog and the source-code he uses to decrypt.

I'll try to get a usb-sniff of the part the phone reboots into service-mode to see if it is MTPz tomorrow (oh, today in the evening. http://xdaforums.com/images/icons/icon6.gif)

Regards
[Nokia Lumia 800] biktor_gj:
Donpromillo, your backup starts the same as the "offline" firmware update using updatewp.exe. in fact, updatewp refuses to flash unless you give it an internet connection before beginning, just like the backup procedure does. Im sniffing the entire erase/flash (ffu) cycle with usblyzer (the only thing that seems to work in windows 7&8). In an hour or two(when it finishes) Ill upload it so you can take a look to compare it with your data. After the initial check, Ive disabled internet connection to see if it fails in another way or it still says the file is damaged (what it will probably say since my file has the osbl replaced with no crc or hashes fixed...)

The ffu header with the signature and the hash blob is sent to the device when it says it's partitioning the nand (which, by the way, doesn't seem to do)

Will post back when I get more info...

Anyone has good information on how the ffus are packed? Are there hashes for every part, for some of them, or is it just one for the entire file?
[Nokia Lumia 800] Briefcase:
Partitioning the NAND would be a bit crazy, because that would also erase the bootloader (also located on the NAND right?). If it fails a simple zune update could brick the phone. Does NCS also use the same MTPz-variant protocol to flash? I assume it does not?
[Nokia Lumia 800] biktor_gj:
Well, I asume it's more for partitioning the OS partition (to fill the nand, for some devices which may ave a integrated/external sd card or whatever..) Thankfully it doesn't get as far as erasing the OSBL and then failing to flash because the file is corrupt or the signature doesn't match...

NCS does the firmware update like NSS, using the Nokia OSBL instead of the uLDR which uses the mtp...

I also saw traces of dhcp in the raw data... It's a lot to read and analyze...

Attached:

ULZ files.zip:

* FFU update with updateWP, failing when checking the file after it has erased the OS & data partitions

* Nokia OSBL firmware update (the recovery) after having erased the flash.

And updatewp's own log, it's in spanish (native language) but easy enough to read (or use translate.google.com)

Those .ulz files are opened with USBlyzer. They have a fully functional trial version. Sorry for using proprietary software but it was the only fully working solution I found that worked (and don't want to be messing around passing all this through ethernet to sniff it with linux wireshark): http://www.usblyzer.com/
[Nokia Lumia 800] crnkoj:
guys i dont want to spam, but i cant find it elsewhere, i have a 2.3 hw lumia with 12070, that was never flashed with ncs (at least to my knowledge) and the vol up +power button combo dont work, but if i try to flash an older (11414 firmware) with NCS to it, it finds a qualcomm cdma technologies MSM device and cannot get the driver for it, picture of it http://dl.dropbox.com/u/24268926/lumiancs.jpg , if i then take the phone and connect it to a linux device and do a dmesg i get this http://pastebin.ca/2143265 , it does seem to me that it actually has the qualcomm and not the nokia dload bootloader, or am i mistaken and if i am not, what am i doing wrong or why will it not boot up into the nand mode after using that combo?

thanks
[Nokia Lumia 800] trenbeth:
Your pastebin does not show that Linux found the storage devices on the phone.

You should get something like http://xdaforums.com/showpost.php?p=24620604&postcount=38

What Linux are you using? Can you try with a mainstream distribution like Ubuntu? Avoid, if possible, the use of VMWare when running Linux.
[Nokia Lumia 800] crnkoj:
Thanks for the quick reply, yes i checked that thread thoroughly before, but didnt see anything remotely similar to my issue.

Im actually running gentoo natively on several pcs. I dont think the "wrongly detected" phone mode is a linux issue but more like the phone seems to get stuck in some mode? because i really cannot get it to boot anything (qualcomm or dload) with the two button combo. i will try with a bootable ubuntu livecd, but im doubt it will help. Is there any way to get the phone to do the "short vibration", if the two button combo doesnt work (i tried soft resetting, hard resetting, ncs with older firmware - i dont want to try with newer) and it always make a "normally long vibration" like if i just turn it on. I think heatclif had the same issue in the first few posts of this thread?

I thought aswell that if the qualcomm cdma MSM is found it means it has the old bootloader, but something doesnt load properly.
[Nokia Lumia 800] biktor_gj:
Thats the diagnostics interface, but it seems like you have the usb mass storage capped. You can try with QPST's eMMC Download module. You can try to switch from diag to download with that...though not too sure since it didnt happen to me...
[Nokia Lumia 800] crnkoj:
Thanks for the info, i have to admit though, i have no idea where to get what you suggest or how to use it =/ If anyone could point me in the right direction, i would be quite happy and thankful.

I assume therein lies a much bigger danger of bricking the phone?
[Nokia Lumia 800] trenbeth:
Google says http://www.x-drivers.com/catalog/flash/mobile_phones/companies/qualcomm/models/qpst/12051.html

I have not used these tools. The idea is to try the tools in order to get as much information as possible. The tricky part is when you decide write changes back to the phone. If you get a breakthrough, you are half-way from converting a DLOAD phone to a standard mass-storage version.
[Nokia Lumia 800] LordMayros:
complete removal of the lock on the windows bootloader version eagerly waiting for the publication of
[Nokia Lumia 800] crnkoj:
ok thanks, ill look into it when i get some more time (some time next week), still if anyone has more knowledge with this tool, is there any tutorial or anything specific to look/care for?

Edit: so i tried to get this working, but cannot get the driver for it, i need a driver for "USB\VID_05C6&PID_9006&REV_0000, USB\VID_05C6&PID_9006" but none of the drivers i found has it in, and i dont know which string to modify with it.

Edit2: hmm so i managed to get it to recognize it as qualcomm MSM-9002 modem by modding the qcmdm.inf with the VID and PID from above, but QPST still doesnt find the phone connected...

Do you guys have an irc channel maybe?
[Nokia Lumia 800] Sinate:
I wonder why nobody use a hexa editor to check the entry.

You can see that during the flash/update the internal hardware/software connection send a random generate code with the 0x2x

Check the MSM7x30 and check the kernel source based on the same chip (HTC inside) https://github.com/CyanogenMod/htc-kernel-msm7x30
[Nokia Lumia 800] ombadboy:
could you please attach the firmware that you flashed? (11414)
[Nokia Lumia 800] ChrisKringel:
Maybe its something in the Care Point Firmwares that prevents some of us from entering that mode.
[Nokia Lumia 800] surya467:
so means i am stuck! :/

tried everything above and still not managed it!

i managed wine on ubuntu , so i can install zune, probably trying to get hold of drivers there...still no luck...

sad..

i can only wait for your updates OP :/
[Nokia Lumia 800] Heathcliff74:
I tried to connect on another computer. There it showed me NOKIA DLOAD. I did not get that on my main computer. I looked at deviceid's and it showed me USB\VID_0421&PID_05EE. That is the same ID I had on my main-machine except it didn't recognize it as NOKIA DLOAD. So nothing new actually.

As far as I understand, NOKIA DLOAD is not what we want. We want our PC to recognize the phone as QUALCOMM Mass Storage device.

Are you using Nokia Data Package Manager for that "refurbish"??

What ROM did you select to flash??

I'm starting to think this is not possible on my NOKIA :(

Heathcliff74
[Nokia Lumia 800] ombadboy:
Mine does recognize it as QUALCOMM.. Now I am not sure why.. (I got installed Windows 8 preview, if that makes any difference).. Haven't installed anything 'exotic' for it to detect it as such..

Here's my Lumia details:

OS version: 7.10.8107.79

Firmware revision no. 1600.2487.8107.12070

Hardware rev no.: 112.1402.2.2.3

Bootloader vers: 7.35.0.0

Chip SOC vers: 0.7.4.2.1

edit: actually this time I didnt even have to press power on.. Just plugged in USB cable, pressed vol up + down.. and BAM..

edit2: here's an attachment of my device manager

edit3: also added a screenshot from disk management
[Nokia Lumia 800] Heathcliff74:
I got the exact same revision numbers. Can you post revision numbers from the diagnosis app too?

I don't think Win8 makes any difference. I should at least be able to see an unrecognized device with the ID's of the QUALCOMM device. But I don't get that.

At work I have a Virtual Machine with Win8 on it. I will try it there and see if it makes a difference.

Thanks,

Heathcliff74
[Nokia Lumia 800] ombadboy:
nm got them.. here they are:

Diagnostics App version: 1.9.4.0

Firmware rev: same as before

Radio HW Revision 8255

Radio SW Revision 1.6.00.24

ROM Lang: 0809

ROM Version: 7.0.8107.0

OEM Device Name RM-801 EU 222

Mobile Operator: 000-GB

Device HW Revision 112.1402.2.3

also, its in Zune mode, and not serial mode
[Nokia Lumia 800] Heathcliff74:
Menu (3 dots at bottom) / About ;)

Also, could you please make another screenshot of the qualcomm device, but first in device manager click menu view / devices by connection.

And could you also please open the properties of the qualcomm, then details, then choose hardwareid's and tell me what it shows?

I'm gonna look if there is a way to flash an old bootloader on my NOKIA.

Thanks!

Heathcliff74
[Nokia Lumia 800] cdbase:
mine Device HW Revision is 112.1402.2.4

not 2.3 at the end as yours

people who managed this to work please post you hw revision

EDIT. I THINK THIS WORKS WITH 2.3 HW ONLY please tell ur HW Rev no. to be 100% sure
[Nokia Lumia 800] ombadboy:
i put the info from diagnostis in prev post..

here they are the screenshots you requested..
[Nokia Lumia 800] voluptuary:
Here are my stats:

PC OS: Windows 7 x64

OS Version: 7.10.8107.79

Firmware: 1600.2487.8107.12070

Hardware: 112.1402.2.3

Radio SW: 1.6.00.24

Radio HW: 8255

Bootloader: 7.35.0.0

SOC Version: 0.74.2.1

ROM Lang: 0809

ROM Version: 7.0.8107.0

OEM Device Name: RM-801 EU 269

Mobile Operator: 000-33

Turned phone off, waited a few seconds to be sure it was fully powered down. Pressed vol-up + vol-down and plugged into PC. No logo showed up on screen but Windows asked me to format a drive.
[Nokia Lumia 800] Etzolin:
This doesn't work for me. My hardware revision is 2.4, running firmware 12070. Tried using both Mac OS X Lion and Ubuntu 11.10, only thing wich is recognized is 'Nokia DLOAD'.
[Nokia Lumia 800] ceesheim:
hi , I looked at it with cliff yesterday but do you have the unlocked osbl only as dump or do you also have it as a "xxxxxx_nokia_osbl.esco" from nokia ?
[Nokia Lumia 800] lugi93:
Works here with Windows 7 Prof (Updated via Zune)..Shows up as Qualcomm

OS version: 7.10.8107.79

Firmware revision no. 1600.2487.8107.12070

Hardware rev no.: 112.1402.2.3

Bootloader vers: 7.35.0.0

Chip SOC vers: 0.7.4.2.1
[Nokia Lumia 800] biktor_gj:
I only have the dumped osbl, and the signatures don't seem to get stored on the flash, sorry...
[Nokia Lumia 800] ceesheim:
it seems like the signatures are generic ( on the nokia flash osbl the sighnature is 6 days older !!!! then the osbl it self )

so maybe we could use that signature
[Nokia Lumia 800] Tyler DeLarge:
is there the jailbreak for this phone?
[Nokia Lumia 800] surya467:
hold ur horses for a few days..mayb an interop
[Nokia Lumia 800] Tyler DeLarge:
i don' t speak english very good and i don' t understand what you say!

yes, no or shortly?

thank you and sorry
[Nokia Lumia 800] _Madmatt:
No, not yet. Interop unlock may be coming soon. I think in your language it should be "non" or "no" or something like that. The only Italian word I know is "pizza" so forgive me :D
[Nokia Lumia 800] surya467:
this maybe the firmware we are looking for, but he says he TRIED flashing which gives him qualcomm, for HW rev. 2.3, and we are already on 2.4.
[Nokia Lumia 800] bleh815:
You didnt try the driver i had posted earlier in this thread, did you? For me QPST is working fine on windows 7 both with lumia 710 and 800.
[Nokia Lumia 800] crnkoj:
Hmm, sorry I didn't find it earlier, thanks for the link. I'll try later today.

Edit: I tried it and had to modify the driver USB\VID_05C6&PID_9006&REV_0000&MI_00

USB\VID_05C6&PID_9006&MI_00 to erase the &MI_00 part, than it recognised it (had to go into test mode on win7 aswell), now i get this, the phone is apparently recognised as Qualcomm HS-USB Diagnostics 9006 , but qpst doesnt see it when connected, here a picture of it all http://dl.dropbox.com/u/24268926/lumiaQPST.jpg

any ideas ?

Edit2: thanks for the help guys, i somehow managed to get the 11414 firmware flashed with nss with "refurbish". phone restarted at least 10 times and than it started flashing, after this i can use the vol up + power button combo (it gives a short vibration unlike the long one before), but it now says Nokia DLOAD when i do it and connect to the linux pc, guess im out of luck =/ Might be the previous owner actually used NCS for flashing the 12070 update ...

thanks again all for the help.
[Nokia Lumia 800] crnkoj:
It's just the firmware for the country code for my phone from navifirm+, I'll try to set up a link later, so you can play around. I do think there is a "bug" with my phone though, as it won't short vibrate when I press vol up + power (tried it on my gf's lumia 800, that has 2.3 and 12070 and it immediately made the short vibrate and went black screen, I didn't have a pc to test if it went into qualcomm or nokia dload though - but I assume it went into qualcomm, since it's one of the first batches and was never ncs flashed.

Edit: here is the link http://dl.dropbox.com/u/24268926/059L7F7.7z
[Nokia Lumia 800] ombadboy:
Cheers.. Ill have a look at it and report back..
[Nokia Lumia 800] GeBoe:
Hey guys, can't you make an .exe for windows, so we can easily root our windows phones? Regards.

Sent from my Windows Phone 7.5 using Board Express
[Nokia Lumia 800] beidl:
So, I tried reconstructing the SplashScreen.dll and other GFX driver files (from XIP), but either I miss something or I just absolutely suck at using OSBuilder.

Must be useful for getting the right memory addresses and GPIOs for LK.

Could someone tell me how to get this done?
[Nokia Lumia 800] biktor_gj:
My friend, that is hard as hell without haret sniffing data while you power cycle the screen..
[Nokia Lumia 800] surya467:
mine is a 2.4, made no difference