yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] xsacha:
OS version: 7.10.8107.79

Firmware rev: 1600.2483.8107.11501

SoC version: 0.74.2.1

Bootloader version: 7.35.0.0

I'm in Zune mode. I'll try this serial mode. Edit: Serial is same. I just get 'Nokia USB connectivity' instead (in Windows). Shows nothing on Linux.
[Nokia Lumia 800] heishanxiaoyao:
Maybe you can look here:

http://www.puppylinux.com/

:p
[Nokia Lumia 800] cdbase:
ok guys so this is only available for 7720.11414 or lower(11412) firmware and since you have 11501 this is not available so downgrade guys and woooow !! we're almost there :D
[Nokia Lumia 800] ombadboy:
Oh no, so this wotn work for 1207 firmware?
[Nokia Lumia 800] beidl:
Great discovery, works great on my Lumia 710 (tried it with Ubuntu 11.10).

OS version: 7.10.8107.79

Firmware version: 1600.3015.8107.12070

Bootloader version: 7.33.0.0
[Nokia Lumia 800] biktor_gj:
Okay, I kept digging a little deeper, and this is what I know so far (if you want copies of dumps, files etc, just ask for them :))

First of all... Thank you Nokia!

LUMIA 800 FLASH FILE SYSTEM LAYOUT:

Partition Begin End Blocks ID

/dev/sdb1 * 1 1000 500 4d Initial Bootloader - SECBOOT

/dev/sdb2 1001 4000 1500 46 Second stage loader? - OSBL, also looks like it has the download mode and seems to init LCD, enable USB etc.

/dev/sdb3 4001 304000 150000 c W95 FAT32 (LBA) - Writable partition with EMMCBOOT, AMSS etc.

EMMCBoot is responsible for loading Windows Kernel (nk.exe). I got a copy of Samsung Galaxy i9001's emmcboot.mbn, and putted it in there. It tries to start, but seems to crash (expected). But hey! it tries to boot it (it even vibrates for 1/10 of a second), so getting something else (did anyone say...android?)running on this phone should be easier than in lots of other phones... Does anyone have u-boot ports for Qualcomm 8255?

/dev/sdb4 304001 31037579 15366789+ 5 Extended partition which holds the OS

/dev/sdb5 304006 304133 64 ef EFI (FAT-12/16/32) - Linux detects it as an EFI partition, but it's just 64Kb size, and seems to have some markers, not sure yet what it is, but could be anything from IMEI and simlock to an actual efi partiton for WinCE...

EDIT AGAIN: this partition contains phone serial number and product code, and possibly imei and simlock. For sure its not an efi partition :p

/dev/sdb6 304134 310277 3072 58 3Mb size

/dev/sdb7 393216 399359 3072 4a 3Mb size

/dev/sdb8 399360 405503 3072 4b 3Mb size

These three partitions have similar start and end data on their partitions, no idea what they are, since I haven't been able to see if it's even a file system. All the documentation I see seems to tell Windows Mobile uses exFAT for the filesystem, but can't seem to find its header anywhere on the flash... still looking. It could even be where WinMo stores application installers for first boot on the device (but could be perfectly wrong)

All of them start with the following header (hex):

7D 8D 27 82 D7 40 F8 90 53 22 82 43 6D EC 6F 69 49

/dev/sdb9 524288 31156362 15316037+ 48

This las partition is 15Gb size, and contains all the Operating System and all the data on the phone.

Anyone know about how does Windows Phone manage filesystems on NAND? Some help would be really appreciated...

EDIT: A little bit more... The file system for the 15Gb partition has _wmstore header, still incompatible with some kitchens, but still looking...

Here's part of the header:

_wmstore

!zLH?k

_wmpart_B

_wmpart_S

_wmpart_S

_wmpart_N

_wmpart_U

_wmpart_D

_wmpart_I

_wmpart_P

_wmpart_U

PSBdX

GFCB

SRPX

Once we can mount this thing and inject some files we'll have interop unlock :)
[Nokia Lumia 800] rwmanos:
can we flash a rom through that ?
[Nokia Lumia 800] biktor_gj:
You can dump and write back whatever you want to the flash, so if anyone finds some application to read wmstore dumps and build them back I can check it...

tl;dr: you can do custom roms and whatever you want with it,but need some app to manage it first
[Nokia Lumia 800] surya467:
this is awesome! +1 for u for this!! i am gonna install ubuntu in next 2 hrs and downgrde my lumia...since im on updated, it doesnt have options fro zune serial modes! :///

crap wer da hell was linux!! :P hahah

anyways...keep it up..hope to see this baby rock!
[Nokia Lumia 800] antonis9891:
Keep it up guys!

It's one of the very few positive signs about lumia windows phone development.
[Nokia Lumia 800] ombadboy:
Apparently there's no need to downgrade. beidl said he managed to get it working using 12070 firmware
[Nokia Lumia 800] cdbase:
but on lumia 710 man on lumia 800 diagnostic app is updated on those firmware and is lack of serial mode
[Nokia Lumia 800] biktor_gj:
It seems it has more to do with firmware version than Serial/Zune menu availability on Diagnostics app. I haven't updated my Lumia, so I can't know for sure. Try powering down the phone and holding vol+, vol- & power. If windows detects a USB disk and tells you it's not formatted, it probably works for you (you can check it by going to Control Panel -> Administrative tools -> Computer Management -> Disk Management)

AGAIN, BE CAREFUL, YOU CAN BRICK YOUR PHONE.
[Nokia Lumia 800] Jaxbot:
Interesting about the OSBL...

I'll go try the RM-819 update and see what happens. Any luck for you?
[Nokia Lumia 800] Jaxbot:
"Can't initialize as vpl package does not contain any esco files"

That answers that question.
[Nokia Lumia 800] xsacha:
Since Nokia provided raw files, there must be a raw flasher that works.

Anyone know one that works?

I wonder if we could get Phoenix working with them, that'd be perfect.
[Nokia Lumia 800] ceesheim:
me noob :) and I don't have a nokia , but did you try to zip up the files and then rename to .esco ?
[Nokia Lumia 800] suzughia:
Just my 2 cents but have you tried to flash your Lumia RM-801 in dead flash mode creating RM-817 dir in Product Folder and selecting "RM-817" with "open product" in NCS with "no connection"?

Reference thread for more info is "How to flash a dead Lumia 800 RM-801" http://xdaforums.com/showthread.php?t=1457341
[Nokia Lumia 800] cdbase:
Im only flashing like this , i also have no luck flashing Qualcomm osbl I'm looking for a way to do this could you remember from what firmware is that file dumped ??

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] xsacha:
My NCS has 'RM-801' already so I don't need to use RM-817.

I didn't try dead flash but I think it would have the same .esco requirement?
[Nokia Lumia 800] suzughia:
I think so that the signature are not bypassed also if flashed in "dead usb", sorry for my post I've must thinked first.
[Nokia Lumia 800] cdbase:
xsacha's found rm-819 firmware won't even flash without changing stuff i think

they released two versions of that update cuz first was compiled bad or something like that check on navi firm that you have two firmwares on that product code im trying to make mbn work in many ways :D found nothing share any news u got
[Nokia Lumia 800] rescbr:
I was poking some Wezen files with some fine tools and I found that there are 6 possible operating modes for a Nokia WP7. It seems that it is possible to change the mode by asking FuseService, which is the one who does the hard work on the NCS.

VID_045E&PID_04EC: WindowsPhone7ProductOperatingMode.Normal
VID_0421&PID_05EF: WindowsPhone7ProductOperatingMode.Ncsd
VID_05C6&PID_QCOM: WindowsPhone7ProductOperatingMode.FTM
VID_0421&PID_05EE: WindowsPhone7ProductOperatingMode.OSBL
VID_0421&PID_5F4 : WindowsPhone7ProductOperatingMode.WinDIAG
VID_0421&PID_05ED: WindowsPhone7ProductOperatingMode.CareFTM

I will do more poking on FuseService to see if it talks, i just looked at it and it is very interesting :D (and then I remembered why I hate C++/COM/ATL binaries)
[Nokia Lumia 800] cdbase:
so this should be qualcomM as _QCOM :

VID_05C6&PID_QCOM: WindowsPhone7ProductOperatingMode.FTM
[Nokia Lumia 800] Jaxbot:
Hm, the whole thing is written in .NET, so it sounds very feasible to write a wrapper to make these calls. Not sure if it will help, but I suppose it's worth a shot.
[Nokia Lumia 800] plumlovsky:
Can this help? Features:
[Nokia Lumia 800] cdbase:
if you have a BOX ,but this is not what he was exactly talking about but maybe someone has it and could use ATF to check if we can force flash files with wrong .cert

and skip osbl is just used to partial flash without touching OsBL
[Nokia Lumia 800] ceesheim:
seems like you can "skip cert flash" so this could be real interesting :)

I don't think you need that "box" for all things
[Nokia Lumia 800] Jaxbot:
I shouldn't need a box, and it doesn't make sense to need one, but that's all the software seems to talk about when I try to use it. Not sure why it wants one, all the Windows Phone stuff should be done directly.
[Nokia Lumia 800] cdbase:
many if not all functions are box related so forget this ,it is not our clue at all

what we're looking for now is a way to mess with osbl so forget that atf which is not useful now and mislead tha thread.
[Nokia Lumia 800] Jaxbot:
Does anyone have the slightest clue what I just did?

That's FTM mode, FYI. (Factory Test Mode?)
[Nokia Lumia 800] cdbase:
try to make a call for the osbl mode i think it will just boot normally but

it'll be good to check , Im very interested in what other modes are!!!

Thanks Jax! :)

edit.amaric yea a movie hahaha i check that every 15 min :D

happy ending is just a matter of time now :)
[Nokia Lumia 800] amaric:
Someone should make a movie about this thread. It is really interesting to follow it. I hope it will have happy ending. :)
[Nokia Lumia 800] Jaxbot:
Just so people know, none of the OperatingModes give me Qualcomm, which is expected. I either get it as a Windows Phone, or as either PID_05EE or PID_05ED. WinDIAG doesn't do anything useful, aside from making it impossible to communicate using the tools we have. Probably meant for, well, diagnostics tools.
[Nokia Lumia 800] faenil:
Hmmm on my Lumia I get no usb device on Ubuntu 12.04..

I hear a short vibration, plug the usb, the screen stays black and nothing happens on ubuntu (no new devices on /dev either)

after 30 seconds a long vibration, and after 30 more seconds a second long vibration, and WP boots
[Nokia Lumia 800] biktor_gj:
Thats probably Nokia DLOAD...try running lsusb from the terninal...
[Nokia Lumia 800] agolding:
Im getting the same thing. that's with hardware revision 2.3, any ideas?
[Nokia Lumia 800] cdbase:
maybe it's time to look into cab update files also I would not be so sure that it doesen't mess with osbl, maybe there we can find

something useful im starting research.

Second thing is that qualcomm mode was brought with first phones which had

11414 max for 2.3 hw while on 2.4 hw we have 11501 as the lowest firmware

so our osbl got updated (2.4) while in factory :/

and for those with 2.3 who can't manage this to work

so what we can see is that in osbl updated firmwares

we can find an updated file while in lower ones there is no such file

this means they locked the feature cuz older osbl was already

on teh phone and thats why it's not there,

but there must be a way to GET BACK TO FUTURE :D ,I ONCE AGAIN AM ASKING IF SOMEONE WITH WORKING qualcomm can Please make a restore point and upload it .thanks
[Nokia Lumia 800] Jaxbot:
Windows Phone hacking 101: You can't restore another device's backup.
[Nokia Lumia 800] cdbase:
but u can use other device settings/files and implement them over yours
[Nokia Lumia 800] ceesheim:
then you are the first who can extract a backup file :)
[Nokia Lumia 800] ombadboy:
I thought that this would not work.. ANyway am up for creating a restore point IF there is a way to remove personal info!
[Nokia Lumia 800] faenil:
after short vibration I get:

Bus 002 Device 013: ID 0421:05ee Nokia Mobile Phones

after 30secs, there's a long vibration, and it turns to:

Bus 002 Device 014: ID 045e:041e Microsoft Corp.

after 30secs, there's a long vibration, and it turns to:

Bus 002 Device 015: ID 045e:04ec Microsoft Corp. Windows Phone (Zune)

and WP boots...

HW rev 2.3, fw12070 updated (once) via Zune
[Nokia Lumia 800] cdbase:
sorry I was mistaken after one more pipe I thought that only rename zip method is

needed. :P
[Nokia Lumia 800] d3m0n1:
There is a way. Create backup1, do a hard reset, create backup2, restore backup1, upload backup2.

Br

d3m0n
[Nokia Lumia 800] X3n0n:
Be careful not to delete Backup 1 while creating Backup 2.
[Nokia Lumia 800] Jaxbot:
This is all true, but again, you can't use another device's backup.
[Nokia Lumia 800] donpromillo:
Just an idea: In the zune backup folder C:\Users\xxxx\AppData\Local\Microsoft\Windows Phone Update\0096b358 - cf04f399 - xxxxxxxx - xxxxxxxx\Properties is a file named properties.xml and it contains a pointer to a certificate in users private certification store. My guess is, that this cert is used to crypt the backup. Unfortunatly, this certs private key is marked as not exportable, so you can't directly send this cert to try a restore on other pc with this reimported cert. But perhaps this cert can be moved with the user-migration-wizard in windows , which moves the complete userprofile and so the complete certification store too.

I'd try this, but haven't a second phone to restore the backup.

regards

donpromillo

Edit: The export of the certs private key is possible with this tool: jailbreak. I now have this cert and can restore it on every pc. But ever not yet a second phone :-(
[Nokia Lumia 800] speculumrotae:
I have debranded my lumia 800 with ncs, I´ve downgraded too, before the process I had branded 12070 orange 2.4 hw with Dload.

After the process 11501 debranded spanish with Dload too.

Perhaps 2.4 hw it´s the problem, new phones come with new loader. Phone is two weeks old.

Im not sure if Ncs changes the loader anyway.
[Nokia Lumia 800] xsacha:
There's about 100 posts in here asking why it isn't working for them and describing what happens when they try it. No need, I already showed why this happens several pages back.

This will not work if:

* Your device came with 11500 or higher firmware (eg. most 2.4 hw).

OR

* You flashed 11500 or higher firmware (flashed means via NCS).

This is because both of these overwrite the Qualcomm bootloader with the Nokia DLOAD one. The only way to get back to the Qualcomm one is to flash it but we don't know how to flash it yet.

Also, backups won't help us at all because they do not include bootloader.

End of Story.
[Nokia Lumia 800] ap3rus:
I believe everything is not so tragically straightforward, we just need to keep search.
[Nokia Lumia 800] xsacha:
Which part are you confused about?

You need to flash the qualcomm_osbl.mbn on to your device somehow and then you will have the Qualcomm bootloader (ala 'disk mode').

It's not some magic here, it's quite straightforward. I've opened the bootloaders in hex editor and know what I'm talking about :). Everything you see being done is quite blatant in the bootloader but not in the nokia_osbl.mbn which overwrites it.
[Nokia Lumia 800] djtonka:
You mean Qualcomm CDMA Technologies MSM?
[Nokia Lumia 800] biktor_gj:
One thing, did anyone have time to check what does the other recovery mode?

Camera+Power drops me (on both phones, locked and unlocked) with with an open usb port declared as Windows Phone, and with a picture of a phone and a laptop on lumia's screen

I dont kniw if thats for zune updates but it seems so.

When I get back home Ill try to capture usb traffic from connection and firmware upgrade in NCS. If it can change the bootloader from windows phone, or it can reboot to some ram address it's worth checking out...will report with what I find.
[Nokia Lumia 800] speculumrotae:
NCS detects it like flash mode, but reboot the phone after few seconds.
[Nokia Lumia 800] ap3rus:
I'm talking about Fuse service and changing operating mode; looking to the nokia care suite at first sight, it's written in .NET without any obfuscation, just use Reflector and search, i'm going to do it on weekend ;)
[Nokia Lumia 800] biktor_gj:
We should take a look at FTM modes...
[Nokia Lumia 800] cdbase:
Read carefully what jaxbot said , he already done it and basically Ftm is- factory test mode and don't give Qualcomm like the rest of those modes ,TRUE is somewhere else there's no time to loose on sth that someone already checked

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] ap3rus:
Anyway it's just so interesting for me to try every mode :)
[Nokia Lumia 800] ombadboy:
I think thats possible using ATF Box no?
[Nokia Lumia 800] cdbase:
so be kind to tell me from which firmware /country variant/cyan ,black ,white/ product code if you knw that , is that qualcomm_osbl file this could make it easier :)
[Nokia Lumia 800] ChrisKringel:
I did some Research with Jaxbot yesterday. In a nutshell: It is possible to DD the sdb9 Partition that contains every data on the phone. This file can be dumped into its contents with nb7split and OSBuilder. By using an .hv editor it is possible to eidt the registry. The missing piece is to recombine the dumped files into an disc dump that can be rewritten to the lumia. It seems like the next Version of OSBuilder supports this.
[Nokia Lumia 800] biktor_gj:
Thats what Ive veen doing with ultrashot, the problem seems to be with the kernel not booting after restore.. going to try with a fresh firm now

Edit: given that you already dumped the contents, my rom ended with maxunsignedapp set to the maximum value (2147483647) . According to ultrashot, OSBuilder doesnt do that by itself, could you check how it is in your rom?
[Nokia Lumia 800] rescbr:
It should not need the box hardware. Unfortunately the ATF software is packed with Themida. I haven't tried to unpack it yet.

But what ATF does, NCS (or even Zune) should do too.
[Nokia Lumia 800] ChrisKringel:
It was set to something like 7fffff (binary only 1s)... Dream Spark unlocked... How did you repack your edited contents?

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] cdbase:
If someone need those here you have qualcomm_xxx.dll drivers :
[Nokia Lumia 800] biktor_gj:
I repacked using OSBuilder (beta)

ANNOUNCEMENT: IT'S STILL BOOTING, BUT THE FIRST CUSTOM ROM FOR THE LUMIA IS FLASHED AND BOOTING ON MY (bootloader unlocked) LUMIA!

Now if the thing decides to finish 'installing applications' and finally starts I'll check if its Interop Unlocked!

Wouldn't it be fantastic for a Friday to have Interop Unlock? :)

I'll be back in a moment!... or two, god knows how much time this thing is going to need... or maybe it's not even finishing because something was lost within OS Builder, but hey, I'll tell you when I know something more...
[Nokia Lumia 800] sHaHiN786:
Sweet work! Crossing fingers! :D
[Nokia Lumia 800] ChrisKringel:
Our Approach was Dumping the device and unlocking the dump in order to prevent the loss of personal data… But I guess it's pretty much the same thing...
[Nokia Lumia 800] amaric:
I think I'm gonna bring down XDA servers with my refreshes :) Can't wait to see how it's going to end.
[Nokia Lumia 800] biktor_gj:
What I found is the nand seems to get dirty, maybe some data gets stalled after repacking. My phone triggered a hard reset by itself when I dumped the new os-new.nb to the flash. I think it got stucked. Rebuilding the rom just in case...
[Nokia Lumia 800] ChrisKringel:
I can also imagine, that something gets packed wrong. OSBuilder is intended for clean roms and not something that has already several gigs of userdata...
[Nokia Lumia 800] biktor_gj:
And it has to deal with a 15Gb file to parse... that's why it complains about arithmetic overflow when dumping the file...

Anyway, I wasn't sure of what it was doing after 15 minutes, so I changed some more reg keys just in case and I'm dumping it back to the phone... cross fingers.. ;)
[Nokia Lumia 800] ChrisKringel:
I'd suggest renaming on of the colors. Would be great if it was possible to interop the phone without losing data.
[Nokia Lumia 800] biktor_gj:
Well, you can always make a backup and then restore via zune. The thing is the dumped OS is about 600Mb, the generated image is 378Mb. I don't know how it will reside on the flash, you could always check where the flash starts to get filled with zeros and clean it up before the first boot... If they had done it right and separated user data from the main OS we wouldn't have this problem...

INTEROP UNLOCK ACHIEVED!

Now time for a nice beeer ;)

I'll put mediafire to work and upload the image I just did. Everyone who has an unlocked bootloader: after you flash this to the phone, DO A HARD RESET, otherwise it will get stucked on 'Installing Applications'
[Nokia Lumia 800] amaric:
congratulations man!!!!
[Nokia Lumia 800] biktor_gj:
Any app out there I can use to check if everything works? heathcliff74's root tools says the device is incompatible...

EDIT: Uploading flash to mediafire... as soon as it's online I'll put the links here
[Nokia Lumia 800] Briefcase:
woohoo congrats, very nice work.

Just by installing those apps (TouchXperience and WP7 Root Tools) you are already proving it to IU because if I remember correctly you cant even sideload those apps if you are not.
[Nokia Lumia 800] murga:
Anyone tried this with Lumia 900?

biktor_gj: this is awesome :)
[Nokia Lumia 800] :
Yes! That's it! Now I'm 100% sure that I'm gonna buy a Lumia 800 next month!

Great job!
[Nokia Lumia 800] shakeyabooti:
Great job....very new to wp7 but lets hope you can get this working for all of us. Congratulations!
[Nokia Lumia 800] xodeus:
Bummer

I've got my device 1 month ago and updated it once, and I can see that I've just lost the possibility to flash this ROM. Can't get the Qualcomm mode by pressing the buttons and all of my versions in Settings are even newer than those you all are talking about here:
[Nokia Lumia 800] biktor_gj:
I'm putting the download links on first post. First two files are already there, whenever the other two are done I'll update the post!
[Nokia Lumia 800] ShotSkydiver:
I was going to ask the same thing, could this work on the 900 as well?
[Nokia Lumia 800] xodeus:
^^ I might think that the bootloader on this phone does not support this mode!
[Nokia Lumia 800] voluptuary:
probably not since newer phones (hw 2.4) have Nokia DLOAD on them by default. I doubt Nokia would put an older bootloader on even newer hardware.
[Nokia Lumia 800] ShotSkydiver:
So, an entirely different method will have to be developed for the 900? ;__;
[Nokia Lumia 800] Heathcliff74:
Hi biktor_gj,

First, let me congratulate you. This is a very important achievement. I can only wish, it would work on all Lumia's. Unfortunately all recent devices, including the Lumia 900, that is just released, do not have the unlocked bootloader.

Interop Unlock is good for a few things; you can do unlimited side-loading. Especially with today's chevronwp7 announcement that the unlock-tokens will be revoked, this is very welcome. Also you can access drivers now.

In the past with driver access you got enough to do all further unlocking, because of elevated privileges of the drivers. Unfortunately, the drivers are more and more protected. With the current Nokia drivers it is still not possible to do further unlocking to run WP7 Root Tools for example.

So the ROM needs more patching. It is possible to modify the policy database or to modify binaries. If you can find policydb.vol and accountdb.vol in your rom, you can extract it and send it to me. I can probably patch it for you, so you can reintegrate it.

For people with NOKIA's with locked bootloader (NOKIA DLOAD device), like I have, I'm still working hard on finding exploits in the drivers. So I will continue that work.

Good luck with this and I hope you can find a solution to flash the old osbl to devices with locked bootloaders!

Ciao,

Heathcliff74

Edit: Did you alter all registry-values that are necessary to keep the device unlocked, like the produrl values, etc? This is important to keep all unlocks working.