yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] surya467:
i dont knw if this is an Idea, but this is how a modder did it in symbian.

We needed cer signing by a site called opda so that we could sign any app with third party certificate and install the app.

Now that site stop giving certificates so the new phones couldnt get them because they require IMEI number for the signing.

so, this one guy used an AV, he planted a selfsign certificate as a quarantine file within the AV setup (.sis) with all permissions(not sure how he did it all) , so wen we install the AV , we had to just restore the quarantine. Now since its an AV it gave root access to the system and the certificate was planted in the system, which seemed like a quarantine.

Thats how we can install any app , signed or unsigned.

i was thinking, since there is an AV for WP as well...if it was possible to mod the xap , because the AV does have access to the file system. Now i dont know where i have reached with this, Can there be a way to get access to root?
[Nokia Lumia 800] takuhii:
I'm not a coder nor a DEV, but I need to "unlock" my WP7 Nokia Lumia to install a homebrew app for backing up SMS.

Is there a way I can "unlock" my phone for free without having to Hard Reset it, as surely a hard reset will remove all my data??

Any help would be greatly appreciated. I need copies of my SMS for legal reasons...
[Nokia Lumia 800] deviantenator:
if the homebrew doesn't require any interop services from WP system,i guess you can try student unlock. it is limited to install 3 homebrew application.

sorry for my english.
[Nokia Lumia 800] takuhii:
Wouldn't a student unlock require a .EDU email address?
[Nokia Lumia 800] surya467:
mate...PM me..asap..i will help u..
[Nokia Lumia 800] nbedford:
any unlock for lumia 610?
[Nokia Lumia 800] surya467:
U can do dev unlock..

PM me i can help u :)
[Nokia Lumia 800] djtonka:
I have try 15 different variants of firmware from navifirm and no success. Still DLOAD for L610 :/
[Nokia Lumia 800] nbedford:
Ok, its good to know someone is investigating, i guess there are many more firmwares to try :(

ps. I know about normal dev unlock, but qualcomm bootloader would be great to find
[Nokia Lumia 800] surya467:
iv been scanning navifirm everyday for a new firmware, to find a qualcomm.! :/

too bad nothing! :(
[Nokia Lumia 800] inket:
More bad news. Remember the fake Microsoft certificate ?
[Nokia Lumia 800] giodelgado:
noobish question:

will I be able to do this on my T-Mobile (US) Lumia 710?
[Nokia Lumia 800] inket:
This is a dev thread.

http://xdaforums.com/showthread.php?t=1626317
[Nokia Lumia 800] surya467:
i got an easier tuto for windows.

takes less than 10 mins.
[Nokia Lumia 800] rescbr:
@surya467: Could you please stop posting on this DEV thread if you are not posting DEV-related posts? The last 13 posts on this thread were completely off-topic.

People, if you are not posting about exploits or methods to help unlock the Lumia 800, please go over to the Q&A thread.

Thanks.
[Nokia Lumia 800] inket:
Guys, did you see the new Camera Extras app ? I'm not sure how it does it, maybe by modifying the registry, but it adds camera options to the default Camera app.

Maybe (this is a long stretch) we can exploit that.
[Nokia Lumia 800] xpc21:
According to Nokia Conversations, Camera EXtras is now avaiable in US and China Market.

http://conversations.nokia.com/2012/06/20/new-nokia-apps-zynga-games-to-make-your-lumia-even-better/
[Nokia Lumia 800] ChrisKringel:
The settings for the Camera Extras App have been present quite a while now. I think they are called from the App without access to the registry.
[Nokia Lumia 800] inket:
Why does Camera Extras use InteropServices, then ?
[Nokia Lumia 800] surya467:
http://xdaforums.com/showthread.php?t=1733039

THIS ANY HELP!
[Nokia Lumia 800] rescbr:
Unfortunately I think it's very difficult to someone release a Qualcomm/Engineer bootloader by mistake nowadays, unless someone leaks it =(

Also, notice the new bootloader (12w22).
[Nokia Lumia 800] inket:
Can someone compare the new bootloader with the old one, notice what's changed and come up with exploits to the old bootloader from that ?

I personally think Nokia owes us a Qualcomm bootloader after that Microsoft announcement that basically made our new phones obsolete. We should tell them.
[Nokia Lumia 800] surya467:
this is a qualocomm as well..i had look :(

bdw ders no change from with the previous and current loaders
[Nokia Lumia 800] FelluRan:
Ok, so i flashed the Full unlocked with some apps ROM, now how do i register with windows live id? Cheers in advance
[Nokia Lumia 800] trenbeth:
Now that biktor_gj is not actively working on a Lumia full root, shall we start a new developer thread for this effort? The current thread requires biktor_gj to edit the original post.

Would someone like to start of a brand new thread, using the content from this thread?
[Nokia Lumia 800] surya467:
well there seems no need unless we have a lead..

anyone finds a qualcomm firmware for HW rev 2.4 or if anyone can use the camera extra app to exploit interop unlock..then can we have a new thread..or it will be as dead as ever :/
[Nokia Lumia 800] trenbeth:
I have HW rev .2.3, and I have not seen a way to flash the Qualcomm bootloader. Has such a thing been mentioned in this thread?

Is it possible to have an open session 'Ask any developer question (even stupid ones!) and we will try our best to answer them!'?

Perhaps have that session on IRC?
[Nokia Lumia 800] surya467:
y do i see something different on this osbl?

http://nds2.fds-fire.nokia.com/p/d/...801_12w07_2_prod_generic_user_area_erase.esco

http://nds2.fds-fire.nokia.com/p/d/...33/RM819_059N711_1600.2489.8107.12072_008.dcp

http://nds2.fds-fire.nokia.com/p/d/...59N711_1600.2489.8107.12072_008_signature.bin

http://nds2.fds-fire.nokia.com/p/d/fds_fire/1201/1012/6514876581/RM-801_label_2d_V1.xml

http://nds2.fds-fire.nokia.com/p/d/...35/RM819_059N711_1600.2489.8107.12072_008.vpl

http://nds2.fds-fire.nokia.com/p/d/...ntConfig_Vodafone_UK_NL_IT_IE_PT_AU_NZ_v2.qcn

http://nds2.fds-fire.nokia.com/p/d/fds_fire/1202/0609/6514934588/106902v1.pcx

http://nds2.fds-fire.nokia.com/p/d/...14/NB62_819_vanilla_20120220_from_vanilla.QCN

http://nds2.fds-fire.nokia.com/p/d/...92/RM801_12w07_2_prod_generic_nokia_osbl.esco

http://nds2.fds-fire.nokia.com/p/d/...19523203/RM801_12w07_2_prod_generic_adsp.esco

http://nds2.fds-fire.nokia.com/p/d/...19523096/RM801_12w07_2_prod_generic_amss.esco

http://nds2.fds-fire.nokia.com/p/d/fds_fire/1204/1815/7019523224/RM819_12072_prod_318_02_boot.esco
[Nokia Lumia 800] cdbase:
nothing new just a damn DLOAD mode, is anyone working on tiff exploit or sim apps hack ???
[Nokia Lumia 800] trenbeth:
As an ad-hoc team, we are propably quite disorganized. I am trying to frame the issue:

a. There are two types of bootloader files for the Lumia 800, the Qualcomm one, and the restricted Nokia DLOAD one.

b. The bootloader files are probably specific to the hardware revision of the Lumia phones. We currently have HW revisions .2.3 and 2.4.

c. The aim is to replace the restricted DLOAD bootloader with the Qualcomm bootloader file for the Lumia 800.

d. Some Lumia 800 phones, with HW Rev 2.3, came with the Qualcomm boot loader, so we have a copy of that bootloader. (CAN WE HAVE A LINK TO THAT BOOTLOADER?)

e. The issue is to figure out a way to replace the DLOAD bootloader with the Qualcomm bootloader, currently only for the HW .2.3 revision.

f. DLOAD Lumia 800 phones are currently accessible through the MTP/MPTz protocol. The MPTz protocol has not been reverse-engineered yet.

There is no project to help with the development of such a tool.

There are some captures of the MPTz communication given in this thread. They have not been analysed yet. (WHAT IS THE LINK TO THOSE FILES?)

g. It might be possible to exploit some weaknesses in the phone software in order to write the Qualcomm bootloader. We are missing some suitable shell code for testing. There are at least two ways with potential for exploiting.
[Nokia Lumia 800] surya467:
well i think it should be a priority to concentrate on an INTEROP unlock.

Full unlock can be focused later..maybe with a weak software.
[Nokia Lumia 800] biktor_gj:
@surya467: That OSBL is Nokia DLOAD, sorry...

@trenbeth: You can find some of the things you're looking for here: http://www.mediafire.com/?a1a1i186a8i2j

br,
[Nokia Lumia 800] ChrisKringel:
I didn't find any reference to the registry in the app. In theory, we could add our DLLs in the diagnostics app as I pointed out here. The major problem is that we cannot alter any XAP without invalidating its certificate.
[Nokia Lumia 800] trenbeth:
Thanks for the reply.

Can you specify which file from above is the Qualcomm bootloader that can work for the Lumia 800 HW Rev .2.3? As far as I know, there is no such Qualcomm bootloader for the Lumia 800 HW Rev. .2.4.

Then, the task is to get somehow admin access to the Lumia (with DLOAD), and copy the Qualcomm bootloader to the first partition.
[Nokia Lumia 800] vadash:
coul this help us, once is finished??

http://www.xda-developers.com/windo...run-exe-code-natively-on-stock-unlocked-roms/
[Nokia Lumia 800] ChrisKringel:
Well, as soon as we can implement our own root certificates we can try to inject a DLL into the diagnostics app.
[Nokia Lumia 800] inket:
Is trying to edit the registry with Remote Registry Editor mentioned here (slide 38) is a dead end ?
[Nokia Lumia 800] rescbr:
Windows Phones only expose the MTPz protocol through USB. To use the Remote Tools you would need RNDIS/RAPI. This is enabled by using this software, which unfortunately needs full unlock: http://xdaforums.com/showthread.php?t=1521763
[Nokia Lumia 800] inket:
But how does the guys at Nokia/Microsoft do it ? Surely not by using WMDCLauncher.
[Nokia Lumia 800] rescbr:
Well, they have engineering phones with engineering software... They can sign any code they want.

I remember going to a Nokia booth on TechEd and seeing an early Lumia 800 prototype (which the owner denied it was a Nokia phone, despite it being clearly marked as prototype on a Nokia booth ;)). I fiddled with it for a while, and it had some software not intended for retail.

Also, Microsoft has "special" Windows Phones with software that allow VNC-style access for demos in events.
[Nokia Lumia 800] Bph&co:
Hi,

Could this be enabled on unlocked 710 and used for OS level debugging ? To

monitor a process crash, virtual memory addresses, registers, etc ?

In the link it said something about using IDA as debugger, possible ?

BR
[Nokia Lumia 800] ChrisKringel:
IIRC the leaked Nokia Service Presentation mentioned that you can boot a Lumia into RAPI mode. Not sure if this applies to internal models, though.
[Nokia Lumia 800] rescbr:
If it is a full unlocked ROM, I don't see why it shouldn't work.

IDA should work with the WinCE debugger too.
[Nokia Lumia 800] Chynkinese:
I may or may not have one of those. If you've followed my thread you could probably tell me more about my phone that I know myself lol. I've taken a picture of the phone. There's a series of numbers/letters across the bottom of it that are kind of interesting...

https://www.box.com/s/9da615a7eb06242e7833
[Nokia Lumia 800] ChrisKringel:
That's interesting. Does it still have the stock ROM or did you reflash it? Does it have developers apps on it (they start most likely with "z").
[Nokia Lumia 800] trenbeth:
Is there a Qualcomm bootloader (what we call "OSBL";) for the Lumia 800 (hw rev .2.3);

Can you point to the file at http://www.mediafire.com/?a1a1i186a8i2j that is the bootloader file for hw revision .2.3?

These might be simple questions, however they help a lot to have the answers.
[Nokia Lumia 800] Chynkinese:
I've been trying to flash it but I've been unsuccessful thus far. It does have the developer's apps.
[Nokia Lumia 800] sub078:
Please can someone answer me? My lumia is QUALCOMM so is unlocked but I cant install Qualcomm driver.... I've tried this guide http://xdaforums.com/showthread.php?t=1669498 but NOTHING!!! Plese HELP!
[Nokia Lumia 800] sub078:
Pleaseee help can flash any ROM! :(
[Nokia Lumia 800] sub078:
Ok.... roll back to Android! Thanks all guys :D
[Nokia Lumia 800] lucifer3006:
Anyone can share the dump of the first partition (sdb1) from Lumia 710?
[Nokia Lumia 800] sub078:
Hey guys...... pleaseee give support to italian users! :D PLEASEEEEe
[Nokia Lumia 800] ChrisKringel:
This is not a support thread, this is a thread for developers with information regarding the bootloader.
[Nokia Lumia 800] sub078:
ok... sorry... but can give some help here? cant install qualcomm drivers! :( I cant flash nothing! PLEASEEEE this is what i get!

NO WAY to install it! PLEASEE HELP!
[Nokia Lumia 800] donpromillo:
Somebody tried to update the custom rom to tango 8773 and Nokia OEM with tethering?

Hi

has somebody of you successfully updated the custom rom for Lumia 800 to tango? I tried it after successfully flashed this rom to my Qualcomm-enabled nokia. The first update (8112) was done successful and all worked ok after the update. The second (8773) was also successfully installed, but after installation the marketplace doesn't work any longer. Trying to install a app from marketplace stopped with error 0x805a0190.

Both updates I got via Zune and the cable trick.

The Nokia-OEM update (with tethering) doesn't come with Zune, even I tried it more then 20 times. So I decided to update with cab-sender method. I got a error, that the area isn't writable

================================================

START OF ULDR \ UPDATEAPP ERROR MESSAGES

ERROR: ReservedUpdate::NonFlashReadWriteHelper(): IOCTL_RESERVE_WRITE failed for reserve region MODEM (Error: 0x00000000
ERROR: E_CANT_WRITE_RESERVE_REGION : There was an Error while writing to Reserve Region

I read in other posts (not nokia related) that using ultrashots method of unlocking the device/rom needs to wait for an update that comes from chef cook of the rom to be able to update to tango. Has somebody of you hints to overcome this?

Regards

DonPromillo
[Nokia Lumia 800] FelluRan:
Try The NCS method where you replace The refurbishment files with your product number in The filename, worked like à charm for me when nothing else worked, you can find it in The "Quick flash debrand guide" on The latter pages.

Regards. Dolan
[Nokia Lumia 800] donpromillo:
Hi Dolan

Thanks for your reply. Are you able to update to tango based on your method? What rom file did u use to flash? The one mentioned in the guide?

Regards
[Nokia Lumia 800] sub078:
Someone can help with qualcomm driver ? Win seven 64 bit don't recognize it! :'( Mother of God....... pleaseeeee help! :D
[Nokia Lumia 800] rescbr:
I remember looking on the stock ROM files and there are some registry entries enabling write protection in some parts of the NAND mostly concerned with AMSS, but this protection was not found on the ULDR, although there is presence of this "MODEM Reserve Region Driver" on the ULDR.

---------- Post added at 11:42 PM ---------- Previous post was at 11:03 PM ----------

Something curious I discovered reading the RGU files now...

It seems that the USB driver supports OTG if the registry is correct. On the schematics, the pin used for OTG detection is connected to the chipset.

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\UsbFn]
"Prefix"="UFN"
"Dll"="usbfnmdd.dll"
"Pdd"="qualcomm_usbfn.dll"
"MiniPddDll"="qualcomm_mini_usbfn.dll"
"Irq"=dword:33 ; HAL_PIC_USB_HS_IRQ = d'51
"Index"=dword:1
"Priority256"=dword:65
"MemBase"=dword:a3600000[B]; OTG/ USBFN/ USB HCD[/B]
"MemLen"=dword:200;
"DisableClientPhysicalBuffers"=dword:0 ; Set to 1 to disable some perf optimizations
"Order"=dword:19
"IClass"=multi_sz:"{E2BDC372-598F-4619-BC50-54B3F7848D35}=%b","{6F40791D-300E-44E4-BC38-E0E63CA8375C}=%b","{4619249B-6362-4520-B700-984C8E7BC7A4}=%b"
"BusIoctl"=dword:2a0048
"HostChargerCurrent"=dword:1F4 ;Current level requested from host to support USB charging
"IsochDescriptors"=dword:50 ;number of ISOCH descriptors needed min is (ISOCH max xfr) / (ISOCH max packet)
"OsMode"=dword:0 ; 0 for Main OS, 1 for SLDR
[Nokia Lumia 800] broncogr:
Thread cleaned.

Some people need to watch their attitude ...

Consider this a final warning on the subject
[Nokia Lumia 800] ChrisKringel:
Not every ROM is upgradable via official CABs. Most of the time you have to rely on the Chefs to release updates for their ROMs.
[Nokia Lumia 800] donpromillo:
Hello ChrisKringel,

thanks so far, even if it is not satisfying, because biktor_gj left this community. So I will try to learn to cook my own rom.

Regards

DonPromillo
[Nokia Lumia 800] donpromillo:
So by now I'm able to build a rom based on the australian country_variant from navifirm, which is:

OS 8107 (mango)

Firmware 12070

full unlocked (using Ultrashots packages)

able to upgrade to Tango (8773)

able to upgrade OEM packages by Nokia (12220 inkluding tethering)

just one open point: marketplace install apps and search does not work - getting error 805a0190

So far as I research, this seems to be related to beta-OS versions, so my source from navifirm seems "infected" with a "beta"-flag

Did someone of you have a hint, where the difference between "release product" and "beta" is stored. I read an artikel here about the same error in WM 6.5, which could be fixed by a registry value. unfortunable, that value does not exist in WP7.

thanks

donpromillo
[Nokia Lumia 800] Nofear99:
I have Lumia 800 with dload drivers can i unlock bootloader for qualcom drivers????

I have Lumia 800 with dload drivers can i unlock bootloader for qualcom drivers plz help for unlock bootloader lumia 800

from dload to qualcom
[Nokia Lumia 800] heishanxiaoyao:
The AdvanceBox Flashing log:

:o
[Nokia Lumia 800] ReMyDiamond:
There Have been any improvements for Dload Lumia 800 ?

Thanks
[Nokia Lumia 800] surya467:
Network_Setup_v2.5.0.0

so anyone wanna play with it?

not patched.
[Nokia Lumia 800] kR105!:
I got a Nokia Lumia 710 with locked bootloader (Nokia DLOAD), but i downgraded it to the Qualcomm one and i were playing the past week with it and the Little Kernel (The latest repo, not the one that appear at the OP) and so far i got the kernel boot log from it, i got the partition scheme with partition names, some info about the platform (MSM board model that nokia based on, etc) and the satisfaction of having something else running on my Lumia!

I opened it and traced & found the UART points, it outputs +1.5V at the tx pin so this week i will be ordering a device to read that signals (I have only a +5V UART reader) and maybe i will get very useful info from it, of course i will post all here :) My goal is get running at least the Android kernel on it, it will be a challenge but i need to try it to feed my geeckyness.

I will keep you updated!
[Nokia Lumia 800] cdbase:
fantastic move out there , someone should try this or sum soldering with lumia 800 cuz IT still remain locked :/
[Nokia Lumia 800] surya467:
Ok..now a frnd of mine wrote sumtin dat made me think.

I dont knw if its old on new.

But you can try this xap on dev unlocked phone.

Edit : sorry my bad..Only grants read access no write access.
[Nokia Lumia 800] chessdragon136:
Another possible avenue (although unlikely) is the release of the beta version of Nokia counters..

http://betalabs.nokia.com/trials/counters

counters is a program that allows monitoring of voice, sms and data and allows to implement caps on usage. I assume that by nature it must have special privileges to access that data - and you never know, being a beta currently it may have exploits.

Sadly I don't know enough to know where to start at analyzing..
[Nokia Lumia 800] Rexmundi000:
Does anyone know what the other partitions do? I know 9 is what you flash for a rom, but how about the other 8? Also the backup of 9 that I have is like 7.5GB, why when I flash the file is only 300meg? Does it format and start new or does it just write over certain files?
[Nokia Lumia 800] surya467:
Lumia 800 dload dead!! ??
[Nokia Lumia 800] donpromillo:
Because it seems, there are no new ideas to get a solution for nokia dload bootloaders, I want to bring a old one in new flavor:

As discussed here and here the MS Cert Chain is (was) vulnerable. I personally mean that "is still" vulnerable on non patched systems (like WP7 Roms before May 2012). After reading a lot of blogs and MSFT explanations regarding the Vulnerability I'm sure: Everyone, who owns a Terminal Server Certifcate through Windows Activation Service got also a Code Signing Cert which is able to sign code as Microsoft. This could made us able to implement all the code needed to make any WP7 Phone unlocked, because we can sign it with a certificate trusted by WP7.

So, if somebody here administers a Terminal Server 2008, activated before May 2012 and not being patched with MS Updates after May 2012 ( or has a systemstate backup from the Server before the patches were applied) will be able to export this Certificate (or the system state backup ) and provide it here, the way to the goal is smoothed.

I deeply know about the risks publishing such a certificate, so I would ask only to provide it to trustworthy members of this forum in secret/private channels.

Regards

Donpromillo
[Nokia Lumia 800] cdbase:
thats another good idea pm me if u find that terminal i would really like to help u out :D
[Nokia Lumia 800] inket:
http://technet.microsoft.com/en-us/security/advisory/2718704 was updated a long time ago. Windows Phone is "non-affected".
[Nokia Lumia 800] donpromillo:
hello inket

You are right, wp7 isn't vulnarable in the way that the Trojan flame used to attack systems. Even if WP7 was vulnarable, you execute the code in the chamber with lowest privileges and would need an extra exploid to gain higher privileges.

But that is not the way I would use a code signing cert from Microsoft. I suggest to edit or build patch packages and sign them. Then use cabsender method to insert the edited patches. If the package is properly signed, Zune update process should accept the package and in this way you can reach also chambers with highest privileges or even bootloader partition.

Regards

Donpromillo
[Nokia Lumia 800] surya467:
mate i so hope you get this right!!

Cuz we need the BABE of a phone unlocked!
[Nokia Lumia 800] donpromillo:
This is what MSFT has found so far (read more here), so my hope is to get such a Terminal Services activation license.

Then we can see what's possible with it

Regards
[Nokia Lumia 800] trenbeth:
If such a working TS private key gets leaked, it would be all over the internet.

Just follow the security mailing lists and websites.

What we need is to have a chat on IRC where all dev questions are welcome.

Without that, I see we are a disconnected group of people with partial levels of knowledge.
[Nokia Lumia 800] cdbase:
yep IRC , also NOKIA people got multiple acc on XDA so we should give them less information on how to lock us down

he's not looking for a key but a pre-activated TS be4 update left untouched since then
[Nokia Lumia 800] Jaxbot:
I've considered trying this for a while now, but I could never get my hands on the key that the trojan was signed with. If someone happens to know where to find it, it's worth a shot, I suppose.
[Nokia Lumia 800] donpromillo:
Hi Jaxbot,

Not necessary to get exactly the cert from Trojan, every Ts activation cert could help, if it was createt before 5/12.The difference between the cert used by flame and any activation cert is, that this cert was prepared by a md5 collission, so it was usable to attack vista and win 7 too, not only XP. For our aim not necessary and difficult to achieve

Regards