yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] biktor_gj:
Since you guys didn't get to see the edited post ;)

Pasted here:

EDIT: Well, there are a few apps that use interop that come bundled with the phone:

Bluetooth contact transfer

On Device Diagnostics tool (1.0.0)

Nokia Music (though not too sure, it has the DLL inside, but doesn't say anything in WMAppManifest)

And some nokia app that seems to run when you start the phone for the first time (that app that asks you to accept Nokia's license terms? that (if you're looking for the xap, it's called 2ce4cccc05a24a849e82467892a47f1b.xap)

So there are quite a few apps that use interop that come bundled with the phone. The easiest to play with would be the Bluetooth contact transfer or Nokia Music+Videos (+books for what's inside the xap), since they can be played with directly (via sniffing internet connection/ bluetooth). Maybe HeathCliff knows better since he's been investigating it from the very first date. Are you here man? Did you check this out already? :)
[Nokia Lumia 800] surya467:
ok..sooo...this see possible or not possible?
[Nokia Lumia 800] hiemanshu:
I have an India version that came with Network Setup (pre-installed)
[Nokia Lumia 800] surya467:
name the version and product code!
[Nokia Lumia 800] cdbase:
Fantastic idea! worth a shot, any more info ??
[Nokia Lumia 800] hiemanshu:
RM801_059L975_1600.2487.8107.12070 thats the version. I installed it via NCS and it came with Network Setup pre-installed.
[Nokia Lumia 800] surya467:
might have the latest network setup so less chances of interop...but worth a try..

@cdbase - if u could have a try on this!
[Nokia Lumia 800] biktor_gj:
No need to try, just disassemble the boot image and look for the xap. Downloading now, will post back :)

I'm downloading the biggest available boot images from 11414, mostly the unbranded ones, just in case they left it out in some variants.. Look for this reference, just in case: b95840dc-a542-42a6-bee4-7d1a12f62d2c
[Nokia Lumia 800] surya467:
ok ncie work...but i got to go to work..have to wake up in 3 hrs to go..so..cu tomrow
[Nokia Lumia 800] biktor_gj:
Nokia Connection setup 1.1.3.0 included in 12070. Not vulnerable to HeathCliff's InteropUnlock. The program runs fine, shows up in the list, but then says there has been a problem and you need to reboot your phone.

Will keep checking the rest of available older firmwares...
[Nokia Lumia 800] ikinkyxd:
What about making a backup of the qualcomm bootloader and maybe find a way to load the ones with DLOAD in linux so we can transfer the backup to others :) ?
[Nokia Lumia 800] biktor_gj:
Well the backup was the first thing I did... but there's no way to write it if you have nokia dload. But there is a setting on the registry to turn off write protection on the flash, maybe with that, interop unlock and some pieces of the uldr we can write another loader while running...lots of things to do :) and the first step is getting the phone unlocked!
[Nokia Lumia 800] ikinkyxd:
Ahh i see, maybe some of the other findings for can help (samsung and htc) from the WP7 Dev Forum.

else sounds promising that nokia have a few apps with the interop service :)
[Nokia Lumia 800] rescbr:
You would need a hardware (Micro)SIM interface to your computer and a software to emulate a SIM card. There are SIM card emulators based on Silver/GoldWafer cards which uses a PIC + EEPROM and there is also an old CCC software called gsm_emu which uses the PC to emulate a SIM card.

From the viewpoint of the device, the SIM card has access to both AMSS and Windows Phone software, as it is key to the GSM standard.

I assume an exploit would be on

1. Windows Phone STK application; or

2. Windows Phone RIL stack; or

3. AMSS

I think this is doable because I've seen SIM applications crash the STK application host.

ETSI GSM 11.14 shows that the SIM has plenty of power to create havoc =)

This needs more research.
[Nokia Lumia 800] Briefcase:
The Network Setup application is vulnerable, the program accepts any kind of provxml input that is given by it's database. The 'database' consists of a directory with lots of provxml files for various providers (vodafone/etc). Heathcliff's hack consisted of placing a custom provider provxml file (with interop unlock registry hack) into this database folder by creating another app which installed the files in the correct location (via the '..\..\' zip trick).

Although the network setup app accepts the newly created files (they are selectable and you can even apply them), the app itself is NOT resposible for processing the xml. The app simply provides an interface of reading in the provxml by user action. The app talks to the driver (this is why this app requires interop permission) and it's the driver that actually contains a white list of what provxml commands are allowed. Unfortunately the whitelist doesn't contain registery editing provxml actions. Therefor it's actually the provisioning driver that is holding us from successful interop unlocking via this path and not the network setup app itself!.

The first version (1.0.0.0) of the app was released just after the (i think) 11500 and this firmware version already contains the drivers that do check against a whitelist. It may be that in the drivers before fw 11500 this check was not integrated, BUT unfortunately the connection setup checks that your fw is >= 11500, if not it will not start. This check cannot be eliminated because that would require altering the program dlls, and these are all signed. Editing this program means mismatch of signature => the program won't launch.

This is the why the mentioned hack (better: proof of concept hack) by heathcliff is NOT WORKING, as you can see this holds for any kind of 'fw version/network setup app version' combination (edit: in the case of Nokia Lumia serie phones).

I think for the above reasons (driver white list/fw version check) the Network Setup app is a dead end. But i hope i'm wrong. STK idea's sound good, I'm not aware of anyone walking that way.

Note: Heathcliff tried finding a exploit in the provxml driver (eg. finding a way of bypassing the whitelist by supplying some sort of malformed provxml). As the driver is not written in a high level language, it requires analysing ARM assembler which is a pretty though job as you most likely already know ;-). So far no progress on this job.
[Nokia Lumia 800] inket:
Then how did the Network Setup interop unlock work in the first place ?
[Nokia Lumia 800] Briefcase:
It has never interop unlocked any Nokia. It was just a proof of concept that failed (because of the provisioning driver).

For other phone brands (Samsung/HTC) this kind of hack did work because earlier firmwares for these phones did not contain driver checks on the provided provxml. With newer firmware, these drivers also contain a whitelist.
[Nokia Lumia 800] inket:
****, then. You seem to know your stuff, any ideas about possible weak areas of the OS ?
[Nokia Lumia 800] Briefcase:
I'm not one of the hardcore hackers here, I did dig into the network setup app and noticed the possibility of an exploit but once I informed Heathcliff about that he already had his proof of concept finished and was looking into the driver stuff. I'm not hardcore enough to deal with the low level hacking stuff (disamble arm dlls and such). But I do read a lot here at this forum and that's how you pick up on things.

- Bootloader attemps seems to be stuck for now, at least for the phones that have Nokia DLOAD, it's very hard to bypass the certificate required for flashing or to find a exploit that allows for arbitrary code execution. This is really hardcore stuff.

- Network setup attempts are stuck because of the reasons mentioned in my previous post

- There is also some research done by trying to understand the update progress via Zune. This traffic is encrypted but we don't know yet if the keys used for that are static or dynamic (different for each phone). We did found some keys in the Nokia DLOAD bootloader, but we don't know if they are public or private. If public we may only be able to read the content, not to alter (and reencrypt). This proces is in an early stage.

- Just mentioned STK app possibilities (maybe it's possible to run code via an infected sim card if exploits exist in the app ('s driver) that handles these kind of operations). Not even started yet/requires special hardware.

- Other nokia app's that require interop permissions. I think this is unlikely too be successful as these apps do not use configuration files (like Network Setup's 'database') but instead use hardcoded registry keys inside the program. Changing these values would require altering the program=>mismatch in signatuer=>no go.

Nokia and MS clearly did not make our lives easy, but to be fair I actually think this is a good thing too. With a system as secure as this we are also protected from attempts to hack the system for other reasons than we have (software piracy (very bad for a developers point of view!)/malicious software/etc).
[Nokia Lumia 800] iawa:
I know I have updated it via Marketplace but not sure if was on there. Would a factory reset tell me? It is an unlocked Cyan model (hence I think it was on there to help with whatever SIM was installed).
[Nokia Lumia 800] surya467:
so guys anyy work??
[Nokia Lumia 800] trenbeth:
Two questions:

Are we able to get the individual files (like coredll.dll) of WP7 from the filesystem dump (of those Lumias with Qualcomm bootloader)? If so, how do we get them?

I discovered that if you connect the Lumia 800 by USB to the PC, and have Zune running, then the Lumia can use the Internet connection of the PC through USB. Is this a known feature?
[Nokia Lumia 800] ap3rus:
Yes, for every Windows Phone, not just Lumia.

http://www.microsoft.com/windowsphone/en-us/howto/wp7/start/connecting-how-and-when.aspx
[Nokia Lumia 800] iawa:
Kind of annoying it just doesn't work the other way OTB too!
[Nokia Lumia 800] inket:
This might be interesting: http://www.youtube.com/watch?v=XQFkhZ0Y3dw

http://www.slideshare.net/securityninja/securitybsides-london-windows-phone-7
[Nokia Lumia 800] biktor_gj:
Hey everyone,

I was hoping to be able to crack Nokia's osbl, but time already run out and wasn't able to get it. So sorry, guys, but I had to return both Lumias. It's been a fun month, and at least I helped getting custom roms for at least some of you.

I'll be uploading here all the files I have on my computer so anyone can mirror them or use them for whatever you might need. If I can help you with something else (development related please) feel free to drop me a PM.

Once again big thank you to Ultrashot, Beidl, Xsacha, cdbase, ceesheim, HeathCliff & everyone that helped out with this. Now back to my (almost) forgotten Galaxy S2 & to try Boot 2 Gecko and see what progress has been done since the last time I checked :)
[Nokia Lumia 800] surya467:
ohh manh!

:/

it was awesome having u around..thanks for everything, i wish it would be possible for the other 800's as well.

as we knw we still have 900 and 610 as well.

hope someone can do somthing about this.
[Nokia Lumia 800] inket:
Yeah, thanks for everything biktor_gj.
[Nokia Lumia 800] dy_domyoung:
i think i may cry, thank you anyways biktor_gj, hopefully some one will carry on your work and find a way for all lumia's to be fully unlocked.

Fair well
[Nokia Lumia 800] vadash:
Its really sad to read this, but all the effort is apreciated, thanks for all ;)
[Nokia Lumia 800] beidl:
Sad to read this. I salute you, dude! You did a great job and allowed the few lucky users to enjoy their devices more than before.

If some day we will both have the same/similar devices again, maybe we can do some bootloader experiments! :p

Have fun, and most importantly: Thank you!
[Nokia Lumia 800] g-gabber:
Some information from my side, nokia implemened own protocol used by Nokia Care Suite to read informations about the phone, imei, sn, model, type etc. This protocol is based on JSON. I managed to find the handler, and reverse it. I also recognized that nokia use jsoncpp open source. Lucky this is an open source project, and they have Bugs Tracker here. There is a very interesting report called "Crash on specific partial Json string. - ID: 3495702". This "partial Json string" is:

"0, \"test_string\", 2, [ 2006, 1, 1, 12, 28, 57 ] ] }\n"

I tested this with nokia implementation, and this is true the process which is responsible for JSON message handling was crashed after sending this string. No clue if we can exploit it, maybe some one can it check more deep.

br g
[Nokia Lumia 800] Bph&co:
Hi,

NCSD v 1.9, send "ControlLogging" with arg "ON", do the crash test, then send

the same with arg "OFF". Not sure if you crash the exe clean up code will

close the file(probably not), but since they update with append(), data should

be in the FS(if not too much buffering).

File(ncsdapp_log.txt) is in the last partition, the user part, you can find it with

simple binary search in the partition also.

Edit: check attached example

BR
[Nokia Lumia 800] Bph&co:
It seems this string causes some kind of crash in the current NCSD json implementation. It is not the whole string, but the lack of left curly bracket most probably. After testing with some variants of the string, the result is always the same:

Enter:CNcsd::RecvData
Leave:CNcsd::RecvData
CNcsd::Receiver Recv Data [4 bytes]: "0, 8"
Enter:CNcsd::HandleJsonMessage
Enter:CNcsd::Process
Parsing succeeded

- result is for "0, 888888888888888888888888888888"

The logging stops, also the handler stops responding. I guess is not possible

to trap the exception via modding of the nscd executable, we need proper OS

crash dump to see what really happens. Maybe ultrashot and co have a clue

how to enable this in the custom rom ?

BR
[Nokia Lumia 800] rescbr:
Have anyone seen this?

http://blogs.technet.com/b/srd/arch...added-to-the-untrusted-certificate-store.aspx
[Nokia Lumia 800] inket:
We could maybe try to reverse engineer the marketplace transaction with that fake certificate. Possible ?
[Nokia Lumia 800] jbbandos:
Or we could try signing a Qualcomm boot loader with that certificate and flash in on a Lumia 800. It should work...
[Nokia Lumia 800] inket:
I think the flashing process requires a firmware signed by Nokia, not Microsoft. Zune updates may be another story.
[Nokia Lumia 800] Tyler DeLarge:
hhahahaha pizza and Nutella :D
[Nokia Lumia 800] whitealien:
@Tyler DeLarge - What he means is that probably someone is secretly working on interop unlocker for Lumia 800 :o

Btw, I'm getting "Nokia DLOAD":

OS Version: 7.10.8107.79

Firmware: 1600.2487.8107.12070

Device HW Revision 112.1402.2.3

So my guess is that it is not related to the HW, but more like to some specific Firmware or the way you flash it. I upgraded through Zune to 12070, French ROM version.
[Nokia Lumia 800] _Madmatt:
Oops, I didn't even know Nutella was Italian :o I eat it every day though :)

On topic: where can I find the needed tools to try this out a little bit without bricking my device? I'd like to help, but I don't really know where to start :)

---------- Post added at 02:21 PM ---------- Previous post was at 02:20 PM ----------

No, it's no secret ;) In this thread, we're searching to make an unlocked bootloader. If we get this, we can get interop unlock ;)
[Nokia Lumia 800] Tyler DeLarge:
ahahah :D

so if I take lumia and xperia, you say that I'll be excited? :)
[Nokia Lumia 800] beidl:
I've just compiled the LK Android bootloader for my Lumia 710...

EDIT: just the Terminal window
[Nokia Lumia 800] _Madmatt:
Well, your xperias bootloader won't work on the Lumia... And the excitement is gone ;p

That's great! Is the 710 bootloader not the same as the 800? They are very similar in hardware though...
[Nokia Lumia 800] biktor_gj:
Haha, I've been doing the same for the 800, unfortunately, theres no support for msm8255 and qsd8k doesnt even try to boot, comes back to disk mode by itself...

Edit:wow! They use the same cpu! Then something is not building correctly...
[Nokia Lumia 800] Tyler DeLarge:
ops, i wanted to say if I buy lumia and sell xperias

is this a good idea?
[Nokia Lumia 800] _Madmatt:
Indeed 710 and 800 use same CPU. Almost all hardware is identical ;) 710 is a good device, it just doesn't look as good =)
[Nokia Lumia 800] beidl:
Just set up a GitHub repo for this including compile guide:

https://github.com/beidl/lk_umia

msm8255 support is defined inside the msm7x30 target (target/msm7630_surf/init.c)

I'd love to see framebuffer support for debugging, but I'm unexperienced in this stuff.

Also, we should get rid of the creation of the partitions (system, userdata etc.) (just kill off the struct) and do it in a way which is compatible to our devices.

Maybe LK has support for mounting images, that would be more appropriate.

At least fastboot is working :) Haven't tried booting a kernel though (What are the needed kernel and base addresses...?)
[Nokia Lumia 800] biktor_gj:
It looks like I had downloaded an old version of LK from code aurora and msm7630 platform didn't even exist...

Anyway, I get to compile it, it gets to attempt to start, but doesn't get usb up or anything. How are you compiling it?
[Nokia Lumia 800] beidl:
It's all in the README.

I also had to try it a few times, I don't know when or how, but 3 minutes later I checked the dmesg, saw the attached device and tried fastboot devices. And it worked.

So maybe you would have to wait a few minutes. Or try plugging the USB cable in immediately after the boot loader "should" be up OR try it a few moments later.

I can also attach the emmcboot file if you want.

Some thoughts about booting Android:

I guess we could try the method these Boot Manager developers use.

Their way of multibooting Android distros is pretty simple:

Create img's for the respective partitions (system, userdata, etc.) and modify the kernel arguments to mount these.

I'll take a deeper look at how they did it, for now, we should get the framebuffer working.

(Maybe it's not the framebuffer but initializing the display?)
[Nokia Lumia 800] Briefcase:
You guys are doing great work. But as i'm not such an expert in this low level stuff i'm trying to get the bigger picture.

So apparently Nokia has based the bootloader of the Lumia series on the Qualcomm boot loader (not that surprising as the device cpu is of this company). This bootloader of Qualcomm supports some emergency mode (VOL UP + VOL DOWN + POWER) which let's us access the whole NAND flash inside our phones.

It appears that as of now there are two versions of this boot loader:

* Version one which was found on the phone of the topic starter. Nokia did not alter too much to the original qualcomm source. Nokia just added signature checking so that only correctly signed ROMS could be flashed [and also only correctly signed roms are able to start, but i'm not sure about that]

* Version two which is found on other phones [Heathcliff] to which nokia has made some more modifications. It seems like they have removed the 'emergency mode' and replaced that with their own 'Nokia DLOAD' variant which does NOT allow access to the whole NAND. Ofcourse also the signature checking is in place in this version.

Version one is believed to be available on hardware revisions 2.3 of the phones while hardware revisions 2.4 have version two. It could also be that the difference between these two bootloaders is because of a different flashing technique; version one may be delivered by Nokia Care Suite flashing while version two comes with updates installed through zune. Either way both versions of the bootloaders are seen with the latest 12070 firmware.

What you guys are now trying to do is compile the bootloader from the original Qualcomm sources. This way we avoid the signature checking and that allows us to flash custom roms. Am I right so far?

What i'd don't understand yet is, since we have access to the full NAND flash, if it is possible to interop unlock just by altering some rom files which contain provxml that is executed at every boot. Previously this was not possible because ROM files, once the OS is booted, are read only.

Thank you very much all for your hard work!
[Nokia Lumia 800] biktor_gj:
Can't manage to make it boot, I'll try when I'm not working and connected through ssh...

The LCD won't powerup unless it's correctly defined on panel.c. I have disabled the init functions for the display and the nand, just in case it was getting stucked there before firing up the usb or attempting to autoboot to some random partition. Could you please post your appsboot.mbn so I can test it on the lumia 800? maybe my toolchain is too old, I'm not building it completely good, or it's getting messed up somewhere or needs some more coding to make it boot on the 800 than the 700...

EDIT: about HW revs, I'm trying to get, at least for a little time a .4 HW rev phone to check if osbl is from Nokia or Qualcomm. Had it on my hands but without a computer near... I noticed that camera+power didn't work as in mine, but vol up+power did the same short vibration..
[Nokia Lumia 800] beidl:
I guess you should try the EMMCBOOT.MBN instead of the appsboot.mbn ^^

Attached emmcboot

EDIT: Oh, I used the toolchain the HP Touchpad guys use, which seems to work brilliantly.
[Nokia Lumia 800] cdbase:
this is a little bit to much for what we know already ,

some people pm me with their hardware revisions and what

could be seen there is that either 2.3 and 2.4 work with that qualcom mode and even some people with 2.3 couldn't manage it to work so i think

this could be the flashing method , i input ##634# for diagnosis

then used cab update method to update form 11412 to 12070 and entire app

stayed on the phone with 1.0.0.0 ver when i flash using ncs there

is no app left on the phone so i think that some firmwares(lower ones)

leave qualcom mode for you and it doesnt depend on firmw rev

but on flashing method

edit. i have 2.4 hw and sometimes in dev manager i can see nokia DLOAD but sometimes it gives ' human interface device '
[Nokia Lumia 800] biktor_gj:
about appsboot... my bad, forgot to add EMMC_BOOT=1 ;)

Still not booting my builds, we definitely have a different toolchain from codesourcery (well, former codesourcery). I'll download what you're using at home and try again :)

btw, tested, your emmcboot works with my lumia :)

Would be nice to find some specs of the LCD... I assume it's Samsung since it's AMOLED, but not sure, touchscreen is atmel and supported by linux :)

http://www.techrepublic.com/photos/...?seq=15&tag=content;siu-container#photopaging
[Nokia Lumia 800] beidl:
We need some experienced devs for this, both for the 800 and 710, since they use different displays (one of the very few key spec differences).

I hope we can have a single emmcboot file for both devices.
[Nokia Lumia 800] biktor_gj:
If NAND is initialized before the panel (which right now is not but could be done, it's a matter of reading the product code on the 5th partition of the flash

I got it booting, it was the toolchain :)
[Nokia Lumia 800] beidl:
Perfect! :)

I'm already investigating the display stuff..
[Nokia Lumia 800] frenk_91:
Can we use the Windows Phone Developer Registration tool for modifies some registry key???
[Nokia Lumia 800] beka909:
can anyone make certificate with flashable bootloader to make qualcomm ?
[Nokia Lumia 800] donpromillo:
Hi,

As far as I read the blog the right way, we are late, cause the vulnerability had been closed by MSFT. So what's needed is somebody, who activates a Terminal Server some weeks ago. This activation seems to create a certificate, that's usage isn't restricted, so it can be used to sign other software. So the question is: How to get this special cert.

Or do I get wrong
[Nokia Lumia 800] inket:
You got it right. We need to find this fake certificate (since we can no longer create it?) and find a use for it.

Microsoft is probably going to release an update for WP that makes it revoke this certificate, so I suggest nobody installs it. We might be able to find something interesting.

--

- http://technet.microsoft.com/en-us/security/advisory/2718704

- http://www.cso.com.au/article/426654/flame_nightmare_stolen_microsoft_certs_spoof_microsoft_update/

WP is vulnerable, guys. Should we head to the WP Dev & Hacking forums, as it's got more to do with WP than Nokia Lumias ?