yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] donpromillo:
Now I'm a little bit confused. I sniffed the network traffic from my pc when backup of my wp7 runs (phone is in Airplan-mode, only PC is connect to network, wp7easybackup as backupprogram).

2 things I see so far:

1. if my pc is fresh rebooted, then the only traffic to ms is retrieving revocation lists, but this request are made after the phone reboots in backup mode and before the icon with the phone and the pc is shown and the backup itself has started. In the whole session there was no https traffic, all request are plain http. No traffic is sniffed before the WP7EasyBackup boots the phone. On the other hand, if I disable all network connections (phone and pc), I get the error, that update servers could not be connected, before the phone reboots

2. If I repeat the backup process without rebooting the pc, no crl-requests are send and no other traffic other then local network and broadcast are sniffed.

Can somebody confirm this? If it is true, then there is no private key certificate from MS involved, and then the encryption parameters (either private key or secret) must be on the phone.

Regards

DonPromillo
[Nokia Lumia 800] ombadboy:
I am not sure if that would work, maybe someone could give it a shot, but ultrashot posted a small little app that bypasses the Live activation problem
[Nokia Lumia 800] ultrashot:
it was tested before posting and it definitely works
[Nokia Lumia 800] ombadboy:
Was talking about the app ;) Was talking about the method with QPST, but if that also works then that's grand!
[Nokia Lumia 800] biktor_gj:
HeathCliff, Im trying (hard) to run native executables in system mode. Im trying to make haret run in system mode to be able to run telnetd and do some hardware digging. So far I was able to autorun it when the phone boots, got to replace the search button to be another start button (i think you can get four or five touch buttons if you want) but I cant find a way to run the damn thing with permissions. I know you were looking into it to code into your root tools, but I was wondering, do you know anyway to patch it somehow on the registry, or on policies db, just to make it work, at least once? I need to find mddi regs and gpio config for this phone...
[Nokia Lumia 800] Faruk88:
Maybe you already have the Qualcomm bootloader and that's why the update process failed?

I have the RM-809 from Rogers, and I'm running the Indian RM-803 ROM. Now I have the Qualcomm bootloader, so I'm no longer able to update through NCS.

Any updates on what voluptuary mentioned on the previous page?
[Nokia Lumia 800] ombadboy:
I could give it a shot, but I cant even get my partitions backed up.. Tried dd /dev/sdX1,2,3,4 to a folder of my liking, but for some reason nothing is 'stored' in those folders..

Also, another concern I have is that I've noticed people cant flash using NCS after custom ROM, whereas was this possible on normal ROM (with Qualcomm bootloader) beforehand?
[Nokia Lumia 800] Briefcase:
As far as I know, NCS refuses to flash phones with the Qualcomm loader, it only flashs if your phone has Nokia DLOAD. Not entirely sure though.
[Nokia Lumia 800] ombadboy:
That is true, but was that true even before we put the custom bootloaders?

Because IF one had a Qualcomm bootloader and then flashed and got a NOKIA DLOAD, then most probably it was done using NCS. Unless the only way to 'lock' you Qualcomm bootloader is by actually flashing a NOKIA DLOAD ROM using QPST for the first time, and then NCS would work thereafter
[Nokia Lumia 800] Briefcase:
We do not even have custom boot loaders at the moment because we do not have a valid private key to create the required associated certificate, but I may be wrong. The Qualcomm loader also requires a certificate, but for the Lumia 710 Nokia has (presumably by error) put the Qualcomm Loader + associated certificate on their firmware repository. Someone got the hands on that before Nokia removed it. So if you got a 710 you can flash the Qualcomm Loader on your phone.

It may be the fact that we overwrite the OS partition with dd that changes something so that NCS refuses to flash. Because indeed it can update from Qualcomm to Nokia DLOAD BL. Or maybe the supplied Qualcomm Loader is an very early version that never got on a production phone and therefor NCS does not support this version?
[Nokia Lumia 800] ombadboy:
sorry what I meant was custom ROMS.. Exacltly what I was saying before.. Something happens when we flash using dd, which doesnt allow NCS to flash anymore, whereas before any custom flashing (using dd) was made, NCS could flash a Lumia (with Qualcomm bootloader) to any ROM without any issues..
[Nokia Lumia 800] beidl:
I've found something interesting in the registry which could help us with LK.

Take a look at HKEY_LOCAL_MACHINE\Drivers\Display\Primary\<MaybeThePanelName>.

It has the configuration for VSync and HSync of the display. Might be useful.
[Nokia Lumia 800] biktor_gj:
Nice to see you're on it too :)

(Note this is for lumia 800 only) So far, about the lcd, the lumia 800 uses a Samsung display, codenamed 'Pyrenees'. Its an amoled display, it uses some gpios for enabling or disabling it, but the thing is it has some kind of power regulator that needs to be initialized, and communication is done over MDDI, for which I cannot find the addresses. Reset commands and init sequence can be ported from the N9 kernel source, but since the N9 uses an omap cpu, it communicates in another way with the lcd (DSS). Thats the main reason why I need to get haret running in system mode, to be able to sniff that out. Im also checking on winmo drivers for clues, but without any idea of assembler (even less arm assembler) that is hard to say the least. I think I figured out (at least in part) why I cant start a kernel from LK (machtypes messed out and badly declared memory base and addresses). If I enable MDDI on LK it doesnt even start for now.

On hklm/drivers/display/primary, it only shows it uses ddi.dll (i guess direct draw interface) and resolutions which dont make sense (640x480)

However, on hklm/drivers/touch, you can find parts of the settings for the actual lcd, along with the settings to change the behaviour of the soft keys (back, win, search)

Each time I look at this phone, I feel ashamed for Nokia. And sorry for all the fired developers too. For what Ive seen on codeaurora, it seems like the lumia was going to be the N9. There are references of commits by people inside Nokia fixing things both in LK and the msm kernel for the Searay (lumia). Each day I work with this thing, I hate Stephen Elop a little more...
[Nokia Lumia 800] beidl:
Ok, I think I've looked at the wrong place...

When I take a look at HKEY_LOCAL_MACHINE\Drivers\Display\Settings\ILCDC I can see the right V/HSync configs (it shows the right resolution in VisibleDisplayHeight and Width).

I'll try these values tomorrow and see if I can get further in progress (I guess the ILCDC tree name MIGHT indicate that the 710's screen is connected through the LCDC interface... :D I've always guessed it thanks to some nice papers and documents that I've found on the interwebs... ;))

Edit: The only thing bugging me is that its ID is shown as a 4.3" display... I guess that means digging deeper.

Edit2: I'll try the values from the tree I mentioned earlier, the treename says INONE_COOPER7430, might be the panel name, and it shows the right values (what the hell was I reading at the beginning of this post).

When I once misconfigured my hackintoshes display sync and lines settings, not even the backlight would turn on, so this might be the key to get the display at least somewhat working.

If you get some information about running haret with full system privileges, tell me, I'd need it as well. ^^
[Nokia Lumia 800] biktor_gj:
On lumia 800:

HLKM\Drivers\Display\Settings:

Debug -> Empty

EBI2 -> ID=2.2in QVGA Toshiba/Rodem2 (240x320) <-- Could this be msm7630surf's MDDI Toshiba display shown in LK?

LCDC -> ID=4.3in WVGA Optrex

ILCDCgordon -> VGA Sharp Gordon (640x480) <-- Could this be msm7630surf's default Sharp display shown in LK?

Since 710's LCD is different, and it has hardware buttons instead of using part of the LCD and the touchscreen as soft buttons, maybe the implementation is 'cleaner' in the 710 and uses that code... god knows what the did in there..

The second problem with 800's lcd is that it's not 800x48, but 865x480, so, even if we get to power it up, we'll still need to patch a lot of stuff so it doesn't end up showing things under the covered part of the screen... will keep digging!

Anyway, you might want to take a look at n9's source code just in case...

http://harmattan-dev.nokia.com/pool/harmattan/free/k/kernel/

And also. Desire HD's source (also based on msm7630):

http://dl4.htc.com/RomCode/Source_and_Binaries/ace30-gb-mr-2.6.35-f654f7b.tar.gz

Last but not least, codeaurora sources:

https://www.codeaurora.org/gitweb/q...it;h=43e90f352509a1715366a871001d43050f2e859c (just one of the reasons why I think the original N9 is the lumia...)
[Nokia Lumia 800] beidl:
I've got the same entries, might be true to every msm8x55/msm7x30 chipset based WP7 phone.

As long as the 800 does not have the tree HKLM\Drivers\Display\Primary\INONE_COOPER7430, I can be 99.9% sure that it's the correct config for the 710.

It may be the cheaper looking phone, but I hope it's more hackable :D
[Nokia Lumia 800] Faruk88:
Are you guys digging out this information by hooking up your phones in mass storage mode and searching through the registry on your PCs?

If so, let me know if there's anything useful I might be able to dig up for you guys, as a Lumia 710 user. I have no experience with this stuff but I'll be willing to get my hands a little dirty if it means I can contribute anything. (This is my primary phone though, so I'd prefer not to flash anything at this point since I'd like to keep it in working order)

If I understand correctly, it seems you guys are more focused on getting Linux running than developing custom WP ROMs, right?
[Nokia Lumia 800] Briefcase:
They are trying to develop a boot loader using the standard qualcomm sources. This way we I assume they can left out the 'certificate checking before flashing'-mechanism. Once that's done we can load whatever we like to our phones. For example a customized WP7.5 ROM(*) or even Android. Android will only be possible if android itself has the required drivers available, so that's one step further away from WP7.5 custom roms. As the Lumia series use pretty standard hardware i guess once we have the unlocked boot loader a andriod rom for the lumia series is not far ahead though.

They now face the problem of getting the display and buttons to work with the qualcomm sources. This requires specific settings which are unknow. We have to revive these settins from the Nokia altered Qualcomm and/or Nokia DLOAD loader but that requires some serious ARM disassembly skills. Alternative way is looking in the WP7 registry (dumped from the phone) and see if that gives us any useful information. Once the display and buttons are working, debugging becomes a lot easier (because we can actually see what happens/where it's stuck) and from then on I guess it's not that hard to complete the loader for our experts here ;-).

Please note that the unlocked loader is just one part of the puzzle. We also need a method for getting the thing onto our devices. Lumia owners with the Nokia Qualcomm loader are in luck because that allows overwriting the loader by dd-ing over another partition. Owners of Nokia DLOAD bootloaders are in luck if they own a 710 because we captured the Nokia Qualcomm loader from the Nokia repository along with a valid certificate and so anyone can flash this loader. Lumia 800 owners with DLOAD are OUT of luck because we have no way to get the newly created unlocked loader (once ready) onto their phones.

It seems this last mentioned problem for the Lumia 800 is hard to tackle (no recent posts about it). But hey we know they are working hard!

(*) Note custom rom means a flashable format ROM, eg, the onces you can find on the Nokia firmware repository. The method available now (overwriting a partition using dd) is just bypassing the bootloader and not a preferred method.

Note: this is just how I see the current situation, I may be wrong. Please correct.
[Nokia Lumia 800] surya467:
youv explained a lot and makes sense to me too :)

but bit annoying about the 800 DLOAD, sad to see people around with a 710 unlocked and dunno wat to do after they unlock it! o.O

while im actually waiting for it to go head on!
[Nokia Lumia 800] breakneck001:
im with you on that one
[Nokia Lumia 800] rOzzy1987:
Well that's not rare. Once I met a guy who was excited about that his iPhone would be jailbroken that day by his friend. I asked why he would like it to be jailbroken. He said "I don't know yet, it could be useful sometime".

I can assure you that I do know what to do with my 710 :). Since I know C# pretty well but never made games, I will learn XNA deveopment (for free, yay :p).

Oh, and please XDA, create a forum for the 710 already!
[Nokia Lumia 800] vnvman:
Please vote in the new device poll thread then, if you haven't already, I support that too ;)
[Nokia Lumia 800] surya467:
ur right....for ppl who knw wat it is.its a huge advantage...for ppl who dont knw...o.O they DONT KNW! :P
[Nokia Lumia 800] ultrashot:
Latest version of the full unlocked ROM by lucifer3006

For Lumia 710

only

Based on belgium 1600.3030.8773.12120

OS: 7.10.8773.98 aka Tango

24 languages.

full unlock by ultrashot

no Nokia OEM applications built in.

search key remapping

Bazaar

WP7 Root Tools

WPH Tweaks

Some new themes

XAP Deployer

Google and Yandex added as search providers

WiFi "n"-mode

xb0xmod certificate

cab-updatable.

updatability via Zune or official cabs ISN'T GUARANTEED.

Known issues:

Included applications may return after uninstallation even after deleting.

No Live ID - get new from MS or use DppImplant.

ODDT (Diagnostic Tools) not included - download it from attachments.

Always backup all the data on your phone!

Only for Lumia 710.

Author isn't responsible for any damage to your device. Sharing on other sites is possible if you keep author's name.

(C) lucifer3006

Download:

Mediafire

Mirror
[Nokia Lumia 800] beidl:
Awesome, downloading as i type.

How's the progress on running Hare7, or rather running it with full system privileges? Seems like it doesn't want to run on my 710.
[Nokia Lumia 800] djtonka:
how the hell I have to keep pressing POWER at least 10s to out from bootloader if Lumia 710 does not support it?
[Nokia Lumia 800] surya467:
great work!

just pls manage the 800 locked bootloader pls :/

waiting like hell..with these pages on auto refresh.
[Nokia Lumia 800] Faruk88:
I wouldn't count on it any time soon... I don't think anybody here is working on that right now.
[Nokia Lumia 800] djtonka:
Ok I did it by pulling out battery and then HR. But I cant find any of this apps or extra themes etc...I can install many apps but not the ones with fullinterop required...any clue?

---------- Post added at 05:57 PM ---------- Previous post was at 05:50 PM ----------

Are You sure You uploaded correct file? I have nothing from Your list
[Nokia Lumia 800] ultrashot:
1) I am not a developer (his nick is written in the post)

2) I am quite sure file is correct - there are many reports about succesfull installation in russian forums.

3) Check mirror (Narod.ru) link.
[Nokia Lumia 800] djtonka:
Ok L710 fully unlocked :)

Those 2 parts are wrong. I used to narod.ru

---------- Post added at 07:29 PM ---------- Previous post was at 06:40 PM ----------

http://www.youtube.com/watch?v=-rQbFp7yasc
[Nokia Lumia 800] biktor_gj:
CAN WE KEEP THIS FOR DEVELOPMENT ONLY PLEEEEEEEEEEEEEASSSEEEEE?

Gift from our friends at Qualcomm:

Full AMSS firmware + Secboot Sources (Qualcomm loader)! Grab it while it's hot!

http://www.mediafire.com/?ir2h15f663ja6wc
[Nokia Lumia 800] beidl:
epic! Nerd boner engaged!

EDIT: Does it contain any device specific code (like... defines for the 710s panel configuration) or is it for all msm7x30 based devices in general?

That wistron_wvga stuff surely looks interesting...
[Nokia Lumia 800] biktor_gj:
This source is, in theory, for the Hisense TS7008. No specific code for nokias, but is for the same platform, so it should, at least boot. And since nokia osbl should be based on secboot, we should be able to find similarities between both... maybe some unpatched hole too?

Worst case scenario, we could still get to know how it boots and debug a little more easily :)

EDIT:

Did anyone notice this on Nokia's DLOAD enabled SBL?

I0..ANDROID!

Interesting...
[Nokia Lumia 800] murga:
yep I saw it day ago... interesting indeed!
[Nokia Lumia 800] Konner920:
Note to everyone, it's probably easier to just do dd in Linux. I bricked my lumia 710 attempting in windows.
[Nokia Lumia 800] ombadboy:
biktor_gj.. Flashed the UNLOCKED ROM last night for the 800, and I've noticed a couple of bugs, just wanted to let you know ;)

- Some apps just won't uninstall. For some reason, 'pre-installed' apps won't uninstall, as well as some other 3rd party ones. i.e FourSquare shows up twice in my app list, one could be uninstalled, the other one uninstalls, and re-installs on reboot (same as the pre-installed apps).

-A few other apps show up installed twice as well..

-WP7EasyBackup doesn't seem to be working (however my backup was pre-flashing, so that may be the problem. Will look into it in more detail later on)

p.s DPPImplant from ultrashot works like a charm!
[Nokia Lumia 800] biktor_gj:
Don't worry, I will build a new custom rom with full unlock based on Tango as soon as I find a firmware with full language support and not only English+Chinese... anyone knows where to find it? I only found one on navifirm and it was that english & chinese...

About bootloaders.... Anyone noticed this?

/sys_boot/keystore/key.str..Keystore read & decrypt failed!.Random seed init failed!....Security init (%d @ 0x%x)...
Security init status 0x%x...
DETAIL: Keys 0x%08x, 0x%08x, 0x%08x, 0x%08x.....°..â«`.ë³ÿÿê.@-éÛíÿëž.Oâ¦`.ë¬..â¤`.ë.0*ã. *ã..*ãÀ..âŸ`.ëÌ..â.`.ëä..â›`.ë«.Oâ™`.ë..*ãG.*ãš..ë..Pãì.Ÿ.ì Ÿ.ì.Ÿ..0..è.Ÿ.3ÿ/.Jÿÿë_±.ë..*ã‚c.ëVõÿë..Pã..*.....Ä..â…`.ë.
.*ãmc.ëtc.ë.@½èžþÿê.ÿ/á
[B]Security init skipped!..[/B]
======= Secure DLOAD started =======
Version: %d.%d.%d
Compiled: Feb 17 2012, 10:35:39.
====================================

Extracted from one of the latest OSBLs out there...

Anyway of tricking it into that USB HID device it shows sometimes after rebooting from the bootloader?
[Nokia Lumia 800] ombadboy:
You can find all the languages in this thread mate: http://xdaforums.com/showthread.php?t=1579419
[Nokia Lumia 800] ombadboy:
Just out of curiosity (no chef my self), do you extract rom, replace langs and repack? Or is there more work to be done (for lang inclusions that is)
[Nokia Lumia 800] n73gamer:
Guys dont give up! I hope you get the Bootloader unlocked soon for the Lumia 800 with the Nokia DLOAD

A friend of mine made this :D :
[Nokia Lumia 800] Ricehead:
Hey Guys just a little heads up, Zune is telling me i have an update but my phone's

Versions are as follows ;

OS: 7.10.8107.79

F/W Rev no. 1600.2487.8107.12070

H/W Rev no. 112.1402.2.3

Radio: 1.6.00.24

Bootloader: 7.35.0.0

Chip: 0.74.2.1

I will update an reply with any changes to the bootloader value and the result when going into the bootloader mode :)

Edit: This is a Nokia update not MS

The update downloaded really fast, Not a full ROM, I'm guessing. (Could be tweaks to the BL, Maybe they found a loophole before we did ?)

---------- Post added at 11:09 PM ---------- Previous post was at 10:40 PM ----------

Sorry wasn't anything important. Just the 12072 F/w

http://blog.vodafone.com.au/blog/nokia-lumia-800-firmware-12070-25042012/

BL Hasn't changed.
[Nokia Lumia 800] surya467:
yeaa...done this last nite...Theres a thread about this update..

battery performance

charging time fixed

camera addition

volume bug still not fixed
[Nokia Lumia 800] Konner920:
I'm probably either lost or just dumb, but can someone clarify with me if it's possible to even activate WP7 to access windows live services, I have the Lumia 710 and I have the Tango rom flashed.

edit: called microsoft and they gave me a product key.

EDIT2: it wont read on zune.

EDIT: last time I restarted zune and it works now.
[Nokia Lumia 800] biktor_gj:
A little update...

Anyone over here knows assembler?

This function:

ROM:00005C40 ; ---------------------------------------------------------------------------
ROM:00005C40
ROM:00005C40 loc_5C40 ; CODE XREF: ROM:00005A74j
ROM:00005C40 ; ROM:00005A98j ...
ROM:00005C40 ADR R0, aSecurityInitSk ; "Security init skipped!"
ROM:00005C44 BL sub_1DEF8
ROM:00005C48 B loc_5B1C
ROM:00005C48 ; ---------------------------------------------------------------------------

is called from:

ROM:00005A54 ; ---------------------------------------------------------------------------
ROM:00005A54
ROM:00005A54 loc_5A54 ; CODE XREF: ROM:00005A14j
ROM:00005A54 ADD R2, SP, #8
ROM:00005A58 ADD R1, SP, #0xC
ROM:00005A5C ADR R0, aSys_bootKeys_0 ; "/sys_boot/keystore/key.str"
ROM:00005A60 BL sub_B244
ROM:00005A64 MOVS R4, R0
ROM:00005A68 ADREQ R0, aKeystoreReadDe ; "Keystore read & decrypt failed!"
ROM:00005A6C BEQ loc_5A94
ROM:00005A70
ROM:00005A70 loc_5A70 ; CODE XREF: ROM:00005A50j
ROM:00005A70 CMP R4, #1
ROM:00005A74 BNE loc_5C40
ROM:00005A78 ADD R4, SP, #0x10
ROM:00005A7C MOV R0, R4
ROM:00005A80 MOV R1, #0x24 ; '$'
ROM:00005A84 BL sub_5588
ROM:00005A88 CMP R0, #0
ROM:00005A8C BNE loc_5A9C
ROM:00005A90 ADR R0, aRandomSeedInit ; "Random seed init failed!"
ROM:00005A94
ROM:00005A94 loc_5A94 ; CODE XREF: ROM:00005A6Cj
ROM:00005A94 BL sub_1DEF8
ROM:00005A98 B loc_5C40
ROM:00005A9C ; ---------------------------------------------------------------------------

Now, how can we make the key.str reading fail so we can skip the security initialization? Maybe it's nothing, and if security init is skipped it breaks and doesnt even let you flash, but it's another approach to be looked at, no?

Any help out there?

Now to search the nand dumps to try to find that key.str...

EDIT:

Could it have something to do with this?

FUNCTION OSBL_ENCRYPT_KEYSTORE

DESCRIPTION
Encrypt plain key store file.

DEPENDENCIES
Must be done before APPS is released.

RETURN VALUE
None

SIDE EFFECTS
None

===========================================================================*/
static void osbl_encrypt_keystore( bl_shared_data_type *bl_shared_data )
{
#ifdef FEATURE_SDCC_BOOT
if ( FALSE == boot_encrypt_file(PLAIN_KEY_STORE_FILE_NAME, ENCRYPT_KEY_STORE_FILE_NAME) )
OSBL_ERR_FATAL( BL_ERR_OSBL );
#endif
}
[Nokia Lumia 800] ombadboy:
I got some knowledge on MIPS assembly and some RISC, but that's about it.. not any ARM. Could help you with it after my exams are done, if you dont figure it out by then, since it's a hectic period at the moment!
[Nokia Lumia 800] Briefcase:
Good catch, it seems that 'boot_encrypt_file' is not defined in the Hisense source? That's weird right? or have they stripped out everything regarding FEATURE_SDCC_BOOT?
[Nokia Lumia 800] g-gabber:
If the security initialisation was skipped, that means that public-keys were not propetly loaded. Result you will be not able to load any cert for flash files :(
[Nokia Lumia 800] biktor_gj:
What I'd like to know if it security init is skipped, will it refuse to flash anything, or will it put itself in some 'developer mode'?

That 'Security init skipped!' message is a printf, which means its a debug message. You don't read debug messages in production phones unless you're a developer... or someone from Xda :)

Did you actually tried it or is it a guess?
[Nokia Lumia 800] g-gabber:
All things that you can flash are signed, so you will be not able to flash anything.

I guess nokia was in rush to release the wp7 phone so this is the reason why they deliver phones with unprotected bootrom and protected bootrom with debugging stuff. By the way, there is a command which allow to enable tracing via uart and usb, in case of usb it requier an authentication.

I did reversed the DLoad loader.

br g