yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] donpromillo:
Hi biktor_gj,

I tried to open your usb-sniffs, but it failes, cause my usblyzer is ver 2.0 Build 25 and reports, that your files are older, unsupported version. Which one do u use?

BTW: Did not have the chance (and time) to sniff the second part after reboot yet. There is a difficulty to manage the device change, when the nokia boots into the service mode. USBLyzer doesn't care about the newly created device and I'm not fast enough to change it to sniff that device, so I did not get the first handshake pakets, which are so important to get (possibly) the cert and private key that decrypt the mtpz-session.

Regards

BTW2: Have a crazy thought: What would be, if the encryption of the snapshot made by zune before update, is only the encryption done by mtpz, nothing more. Then it should be as simple as to find the encryption scheme and parameters of that encryption process to decrypt such a backup to original data stream and store into a imgfs-partition. If further a tool exists, that can extract files from that imgfs-partition and rebuild it after changing something (something like OSbuilder, enhanced with a feature to extract and rebuild the "user"-part of dumps), you should be able to change any file in that backup, which does not have a signature. The (offline in backup) stored registry-files shouldn't have a signature, because registry is dynamically merged from different parts at runtime, and changes with any newly installed app. so interop unlock could be possible and also the restore of all settings, app, mails, sms ... all in one. What a dream!
[Nokia Lumia 800] biktor_gj:
Hey, I used version 1.6 which is what I had at hand at the time... anyway I think one of the files is corrupt, so I have to find some time to redo the whole mess on the locked lumia. I'll send you a new file as soon as I find time to do it.

About the backup... If you're doing it with Zune putting the phone in offline mode before doing the backup you'll have a hard time catching those packets. It's easier if you just put it in uLDR mode (camera+power), then connect to the PC, start capturing, and then run updateWP.exe to do the backup for you... What I don't know if it will require to flash a FFU afterwards (since I'm only playing with this I never had anything to save from any phone ;))

The problem with the backup is it is just from the userstore, so if some registry keys are read only... they won't be overwritten when flashing back, unless, maybe, if storage write protect is disabled in wmstore driver, which can't be touched unless you have full unlock... but worth a try anyway :)
[Nokia Lumia 800] _Madmatt:
Are you sure the backup is only userstore? I think I once restored a device and my developer unlock was back with the restore. Also it restores your OS and FW; is this included in the userstore?
[Nokia Lumia 800] biktor_gj:
Sure? not at all, but the last backup I did occupied like 30 mb and the OS is 400Mb. Maybe the modified registry keys are saved too and that's why you got developer unlock back? No idea really...

[OSBL]

Okay, next approach at osbl. Making my way with my tiny little brain I though, is this where it compares the keys?

ROM:0003D074 ; ---------------------------------------------------------------------------
ROM:0003D074
ROM:0003D074 loc_3D074 ; CODE XREF: ROM:0003D050j
ROM:0003D074 MOV R3, #0
ROM:0003D078 MOV R2, #1
ROM:0003D07C MOV R1, #3
ROM:0003D080 STMFA SP, {R0-R3}
ROM:0003D084 MOV R0, LR
ROM:0003D088 MOV R2, R5
ROM:0003D08C MOV R1, R12
ROM:0003D090 MOV R3, R6
ROM:0003D094 STR R7, [SP]
ROM:0003D098 BL sub_66918
ROM:0003D09C CMP R0, #1
ROM:0003D0A0 MOVEQ R0, #0
ROM:0003D0A4 BEQ loc_3D0B8
ROM:0003D0A8 ADR R1, aCcirsassapss_0 ; "CciRsaSsaPssSign - RSA_SIGN returned an"...
ROM:0003D0AC MOV R0, R4
ROM:0003D0B0 BLX sub_787AC
ROM:0003D0B4
ROM:0003D0B4 loc_3D0B4 ; CODE XREF: ROM:0003D044j
ROM:0003D0B4 ; ROM:0003D060j ...
ROM:0003D0B4 MOV R0, #0x20 ; ' '
ROM:0003D0B8
ROM:0003D0B8 loc_3D0B8 ; CODE XREF: ROM:0003D0A4j
ROM:0003D0B8 ADD SP, SP, #0x14
ROM:0003D0BC LDMFD SP!, {R4-R7,PC}
ROM:0003D0C0

Interesting part:

ROM:0003D09C CMP R0, #1

ROM:0003D0A0 MOVEQ R0, #0

ROM:0003D0A4 BEQ loc_3D0B8

If that CMP & MOVEQ are replaced with NOP's, should it directly jump to loc_3D0B8 and keep going like if the RSA signature was nice and pretty, or am I dreaming?
[Nokia Lumia 800] _Madmatt:
It's just strange it restores the OS but does not store the OS in the backup... It won't download the whole OS again, will it? Hmmm, it could be that they indeed only copy the modified registry, or maybe the whole registry, because that isn't very big. Maybe backups are compressed?
[Nokia Lumia 800] rescbr:
I did some static analysis on the Windows Phone 7 Connector for MacOS X with IDA + otool, but the mid-terms started before I could try to make a Zune simulator and try to get data out of the device. MS used libmtp (and lots of custom opcodes), so it shouldn't be too hard to hack a Zune simulator with python + libmtp.

I'm still busy next week but I'm willing to share my files, so PM me if you want to play with x86 asm + objective-c.
[Nokia Lumia 800] donpromillo:
My Backups are always 6,5 GB of data, my phone had 5 gB free memory so there seems a difference to the whole partition size of 15 GB, except the backuped date are compressed and encrypted.

And I managed now the complete sniff. In capture settings one can activate the capture of hotplugged devices, so the complete process from starting backup with WP7easybackup, boot recycle and starting the backupprocess is sniffed. This is the good news, the bad is: Obvoious the protocol of making the backup is mtpz, the way of encryption is a other then described here. No Certificates are involved. So the question: Is someone of you able to analyze the mtp(z) protocol from my usb capture? I'ld pm that files, cause the sniffs contain UIDs of the phone.

Regards
[Nokia Lumia 800] wardoc22:
I don't know if its an issue with the 710 tango full unlock or just me,

but the field test app is not working. Hangs are "Loading..." after pressing ##643#
[Nokia Lumia 800] surya467:
it happens even in the official firmware..
[Nokia Lumia 800] wardoc22:
Lolwut?
[Nokia Lumia 800] surya467:
the field test does not load on STOCK ROM as well...
[Nokia Lumia 800] wardoc22:
Hmm, do you have any idea on why so?

I would love to see my battery drain after doing a registry tweak that made the bightness go down like super low.
[Nokia Lumia 800] Bph&co:
Hi,

It is no problem to patch the Nokia loader and skip all checks, but will need at least

2-3 tries. As there is no way to restore at the moment, it is not possible, i have

already damaged one phone. Maybe there is a way to code C++ application that

can do direct NAND write and insert into the OS via OsBuilder ? If there is a way

to restore the second partition from the OS, its possible to make nice, patched

bootloader that will not require certificates and just ignore writes to the second

partition, so future bootloader updates via NCS will not overwrite it.

BR
[Nokia Lumia 800] biktor_gj:
It works, at least on my lumia with stock rom on 12070.

FTM test mode: ##3282#

Diagnostics: ##634#

CareFTM & FTM: enabled from NSS (for example), both launch USB diagnostics from qualcomm, depending the firmware version, detected as Qualcomm CDMA Technologies MSM (Device ID 319B in version 11412,11414 and I think 11450 too, and Device ID 6000 in 12070, didn't try in others...)

About the USB HID device some people found in some random events... it's triggered when the phone shows the 'Can't start battery is too low' image (that battery logo with a red bar at the bottom). It's usually triggered when the power management gets mad after a flash, or if the battery gets really really low. It's Windows Phone what shows that USB device, btw, but couldn't find any matching IDs for it on the registry (not even those leftovers called 'prototype - remove this' :))

@Bph&co: What I'm desperate to find, is some exploitable buffer overflow (or something like that) that will let us flash something on the flash on a locked lumia. So far I've found three different revisions of Nokia's OSBL, and still comparing them with the limited time I have. I hope some of those versions have some holes that Nokia patched afterwards on the following revisions...

Tried to chainload it from Qualcomm's Secboot on an unlocked phone, but it doesn't start (just goes back to secboot, like if the file was broken, even without touching it)

Obviously patching it would be great as a long term goal to preserve compatibility with NCS (which some people want, I really don't care if I can get it in disk mode I can do whatever I want without depending on Nokia/nss), but it's of no use if we can't first write it on locked phones...

Edit: by the way, did anyone notice an HTC Public Key on the AMSS firnware?:)
[Nokia Lumia 800] *Detection*:
What should FTM test mode: ##3282# show on the Stock 12070 ROM ?

I get

Field Test, Loading.....

And it just sits like that, I can goto settings for 2G and 3G and Limit SMS but thats all
[Nokia Lumia 800] Sinate:
Ok i'm checking for the activation key on the Lumia 800 after flashing the bootloader etc... need to be resign with the correct key to be accepted by the microsoft server, look like the same crypto than the PS Vita with the mtp/nfs.

Anyone find how to fix the activation key yet or keep the right signature without break it ?
[Nokia Lumia 800] wardoc22:
Call microsoft up and talk to an employee.

If they don't give it to you the first time, try it again. Tell them that you bought a windows phone and then whenever you try signing into windows live it asks for an activation code.

If it doesn't work for you the first time, call again and talk with another representitive.

It took me 2 tries to get to talk to one that will give me a code.

Good luck
[Nokia Lumia 800] Bph&co:
Hi,

I think this loader is the least thing we should probe. It's compilied in pure ARM,

no interwork (so not much BX Rx jumps), large available RAM, enourmous public buffers

used in functions, almost no use of stack for local buffers. Maybe is best to check

the actual OS, some known exploits - pdfs/jpegs,etc.

BR
[Nokia Lumia 800] aleeyt:
Guys, lumia 710 has fastboot mode?
[Nokia Lumia 800] beidl:
Not out of the box, only if you give it an Android compatible bootloader.

And that's what I'm working on, or at least I'm trying, but I'm stuck on getting the display to work from within this custom bootloader.
[Nokia Lumia 800] ChrisKringel:
As of today, there are two new FWs on the servers. Did someone already check their bootloaders?
[Nokia Lumia 800] surya467:
your right..i check last night it was not there (cleared the cache)

wat new must be there in 1750!!

downloading!!

EDIT : yea i got it...here it txt if sumone now able to get to it :)
[Nokia Lumia 800] Briefcase:
Search for '800' in Navifirm+; you will see 12140 firmware (finished in 2012, week 14 [revision: 0] probably) there for the RM-801. It's chinese unbranded and contains 12w14 osbl.
[Nokia Lumia 800] surya467:
EDIT :

tethering

export contacts to SIM

advanced network settings for calls and messages

additional option in video mode - the quality of

Xbox animated tiles

new sign on the top bar

pics attached
[Nokia Lumia 800] Briefcase:
Thanks for trying out, think it's better to continue this in a more appropriate thread: http://xdaforums.com/showthread.php?t=1640558 .
[Nokia Lumia 800] aleeyt:
UPD: Guys, we need your help. Who has the RIFF-BOX and Nokia Lumia 710, please make a through him fulldump phone or dump the boot partition. (But you should only through the RIFF-BOX) you'll be very thankful.
[Nokia Lumia 800] load"":
Hi, maybe this could be helpful

All .exe files can be easily open by 7zip as an archives. Maybe there is some useful stuff
[Nokia Lumia 800] EchoesOfOli:
Great work in here guys, bought my brand new Lumia 800 yesterday. But sadly i have NOKIA DLOAD in there :/ Any news about unlocking this nokia's bootloader ? :)
[Nokia Lumia 800] suzughia:
Use the Q&A thread because this is a dev thread.
[Nokia Lumia 800] surya467:
work seems in progress, for anything else follow here

http://xdaforums.com/showthread.php?t=1599401
[Nokia Lumia 800] akshaybz:
This should be sticked my now :P
[Nokia Lumia 800] surya467:
u mean sticky?

doesnt matter..its the most viewed thread anyways..:P
[Nokia Lumia 800] wardoc22:
No need for sticky it is the most viewed thread already anyways.

Lol,but it sho stickied uld be anyways.

---------- Post added at 02:06 PM ---------- Previous post was at 01:32 PM ----------

Calm down lol. I can see your point but you learn from mistakes.

When I first tried to flash my lumia 710, I screwed up and flashed the the wrong partition.

I spent the entire week reading up on flashing and how the partitions are laid out and using DD. Along with a couple of new tutorials in the general sections. I was plenty sure how to do so.

Just remember, people learn from mistakes. ;P
[Nokia Lumia 800] sHaHiN786:
This thread has lost it's purpose, and there's no news of the bootloader getting unlocked, looks like Nokia have outsmarted us. Damn Nokia, looks like I'll have to buy another device to root...i.e. Android or iPhone. Miss the customizing ability too much, it literally hurts my brain. :D
[Nokia Lumia 800] svettipung:
So one can build rom of this for android?

Skickat från min GT-I9100 via Tapatalk 2
[Nokia Lumia 800] surya467:
well i guess u can still hold on mate...guessing the new tango roms may have a breakthrough.

bdw Tango battery isnt as good as 10272
[Nokia Lumia 800] load"":
dear devs, please tell us about unlock progress.

all of us were exhausted to wait, whether there is still a hope?
[Nokia Lumia 800] cdbase:
I thought no one wants to share bootloader info cuz Nokia got their people on xda but i was mistaken i think that this ****ty Dload is going to stay for ages i love the way lumia 800 is but we ****in need bl unlocked thats all

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] suzughia:
I don't take the point of not disclose bootloader info or custom bootloader only because Nokia ppl coul be here on XDA, take for example - off topic - the Xbox scene on a famous hacker site and the presence of MS on the site as it's public and anyone can sign in, the matter is to do not endorse piracy and warez, I think.

Also pls keep this topic "on topic", could a mod clean this? Post awfull info about status on general forum!
[Nokia Lumia 800] whitealien:
AFAIK current status is:

1. You have Qualcomm bootloader - you are free to load whatever you want on your phone;

2. You have NOKIA bootloader - you are screwed (for now)

and yes, REQUEST A STICKY
[Nokia Lumia 800] biktor_gj:
No progress on my side, dont know about others, I have both lumias half bricked right now stucked on bootloops..ir seems 12120 has a problem with older amss versions..
[Nokia Lumia 800] surya467:
oh manh!! :/

no probs..thanks for replying :)

I have a group out there waiting for any signs of interop of full unlock.

we have helped many ppl full unlock the 710 .
[Nokia Lumia 800] cdbase:
Maybe it's time to reach interop on Dload and then hack the bootloader cuz i think nothing will happen soon if we still try to hack bootloader !

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] biktor_gj:
Well, given the way things are, it might be a better approach:

Nokia OSBL -> Signed

uLDR -> Signed

DeviceUpdate (MS cabs) -> Signed

Apps -> Signed

Might be better off starting from the ground...

Btw my locked lumia is dead, been for an hour connected to AC and no signs of life, so no more testing with a locked phone... and I really don't feel like locking the other phone just to try more stuff, one broken phone is enough :)

I don't know how things are going with other Windows Phones, if there's any exploit on DeviceUpdate it might be worth checking... if no one has tried already (I didn't, but besides Beidl & Donpromillo I don't know if anyone else is working on this...)
[Nokia Lumia 800] worraps:
Hi guys

This might be of interest to the 'boffins' here.

It seems some HTC Titans have been unable to update via Zune, giving error code 80070013 / 8007000F.

HTC has releaded a fix for this proble. (a SPL? / SLP?)

"The update will only overwrite the bootloader and not affect the data on the phone."

The fix can be found on the HTC website.

worraps
[Nokia Lumia 800] Ricehead:
Thanks for the heads up, Maybe if its possible to get the HTC bootloader into an Update maybe it will overwrite the current one, but thats saying if the bootloader is even in the right format or of any use to the lumia.

The Bl file is a .nbh, Useful ?

All the files extracted that come with this installer:
[Nokia Lumia 800] tandeh:
happens to me sometimes, you should not let it fully discharge, get tablet charger (e.g. 2.1amp rated) and use your usb cable to charge usually does the trick.
[Nokia Lumia 800] cdbase:
Can someone plz upload aus 12070 for rm-819 with mbn osbl i think Product code was ...n6q8 might be useful but was delated from Nokia servers , I hope for some help thanks ...

Sent from my Lumia 800 using Board Express
[Nokia Lumia 800] suzughia:
For RM-819 product code 059N6Q8 I've downloaded two version,

the first folder contain

106902v1.pcx
NB62_819_vanilla_20120220_from_vanilla.QCN
RM-801_label_2d_V1.xml
RM801_12w07_prod_generic_adsp.esco
RM801_12w07_prod_generic_amss.esco
RM801_12w07_prod_generic_nokia_osbl.esco
RM801_12w07_prod_generic_user_area_erase.esco
RM819_059N6Q8_1600.2487.8107.12070_008.dcp
RM819_059N6Q8_1600.2487.8107.12070_008.vpl
RM819_059N6Q8_1600.2487.8107.12070_008_signature.bin
RM819_12070_prod_304_01_boot.esco

and a second folder that I've append "no-cert" by my own that list

106902v1.pcx
dir.txt
NB62_819_vanilla_20120220_from_vanilla.QCN
RM-801_label_2d_V1.xml
RM801_12w07_prod_generic_nokia_osbl.mbn
RM819_059N6Q8_1600.2487.8107.12070_007.dcp
RM819_059N6Q8_1600.2487.8107.12070_007.vpl
RM819_059N6Q8_1600.2487.8107.12070_007_signature.bin
RM819_12070_prod_304_01_boot.img
RM819_12070_prod_304_01_fat.bin
RM819_12070_prod_304_01_rawprogram0_nokia_skip_DPP.xml

Is one of the two needed by you?

I've also got a RM-801 product code 059J3G0 that list as follow

RM801_059J3G0_1600.2487.8107.12070_002.xml
RM801_059J3G0_1600.2487.8107.12070_002_signature.xml
RM801_12w07_prod_euro1.esco
RM801_12w07_prod_euro1.img
RM801_12w07_prod_euro1_dirs
RM801_12w07_prod_euro1_env.txt
RM801_12w07_prod_euro1_flash.bat
RM801_12w07_prod_euro1_flash.ffu
RM801_12w07_prod_euro1_FlashClean.ffu
RM801_12w07_prod_euro1_flash_fullmodem.ffu
RM801_12w07_prod_euro1_nokia_flash.bat
RM801_12w07_prod_euro1_nokia_rawprogram0.xml
RM801_12w07_prod_euro1_nokia_rawprogram0_skip_DPP.xml
RM801_12w07_prod_euro1_oem.sku.xml
RM801_12w07_prod_euro1_partition.xml
RM801_12w07_prod_euro1_rawprogram0.xml
RM801_12w07_prod_euro1_rawprogram0_skip_DPP.xml
[Nokia Lumia 800] cdbase:
Man this is just perfect !!! thanks alot i need 059n6q8 with mbn loader (first folder is an updated ver which appears on nokia server)

as you see without cert. and also second rm-801 might be very usefull

looks interesting please upload it if you can so every dev here might

look inside those :) ONCE AGAIN THANKS :))))
[Nokia Lumia 800] suzughia:
I've uploaded RM-819_059N6Q8_1600.2487.8107.12070_-_No.Cert.

The RM-801_059J3G0_1600.2487.8107.12070 one is 1,8gb can someone provide ftp access or something like?

Thanks.
[Nokia Lumia 800] Briefcase:
Maybe you could ask here, http://blog.xdafileserver.nl/ask . It says it's for 'your (own) ROMs' only but maybe he is willing to make a (temporarly) exception.

Edit: http://xdafil.es/index.php?path=Lumia800/Dev/12120/ is this the same rom? think so. In that case it's has already been discussed here, read onwards from here: http://xdaforums.com/showpost.php?p=25129388&postcount=644 . But hey maybe you've got some new idea's. Good luck
[Nokia Lumia 800] surya467:
059J3G0 has been tried or no?

i guess the one without cer should have a break through.. :/

Oh pls oh plss be IT!!! _/\_ :P
[Nokia Lumia 800] biktor_gj:
Thank you surya467 for the call, didn't see the posts :)

Those files are what Nokia use to lock the unlocked Lumias. It's flashed with vdsemmctool, which is something like DD with control over which partitions are written and where (Windows tool). Couldn't find the tool anywhere, though I think I also have a copy of those files (or some similar). If we had that tool we could avoid using linux/windows dd/ winhex to write the new OSes to the phones more easily...

That OSBL requires signing!

Btw, those files on xdafil.es/12120 are from 12070. Is what I've used to brick my locked Lumia (by messing around with the files, not saying they're corrupt or anything)
[Nokia Lumia 800] surya467:
so no chances to downgrade to qualcomm :/

wat about interop?
[Nokia Lumia 800] biktor_gj:
Did anyone check OSBL's keys?
[Nokia Lumia 800] Briefcase:
We already have a similar tool 'NSS' created by XDA member 'Bph&co', see here: http://xdaforums.com/showpost.php?p=25618426&postcount=11
[Nokia Lumia 800] biktor_gj:
NSSPro requires .esco files with their certificates, just like NCS or any other tool. vsemmc works with binary files, i.e, you can flash just the .mbn file for the osbl, the boot.img file for the OS, without needing to zip/sign the files you want to flash...on any phone with an unlocked bootloader...
[Nokia Lumia 800] ikinkyxd:
What does that help ? if it only works on unlocked bootloaders ?
[Nokia Lumia 800] cdbase:
vdsemmctool is used by nokia devs so i don't we can easily find that biktor_gj

we need someone from the inside :) who can ekhem give it to us
[Nokia Lumia 800] load"":
have you already read this and downloaded that?

it can be helpful I think
[Nokia Lumia 800] ChrisKringel:
Greate document you've found there. Apperantly it is possible to change some registry keys via the PC :D
[Nokia Lumia 800] Bph&co:
Hi,

Quick question to guys that played with the OS bit more already. Is there a

generic way to compile C/C++ dll or exe that is part of the system/OEM ? Maybe

via Visual Studio ? Or this is proprietary only ?

I can go the hard way (ADS 1.2 and WinHex), but was just wondering if there is

maybe easy/faster method.

BR
[Nokia Lumia 800] Briefcase:
Great. Did anyone try slide 38 of the above document? It's called 'Start test - registery tools'. I don't have access to visual studio 2008 and/or a lumia with qualcomm :-). Maybe this even works with DLOAD? Wild guess here.
[Nokia Lumia 800] surya467:
nice work..im keen to check it out..though i hav qualcomm :-/

@g-gabber - ok fine..

if sumone can pls clean this post.

thanks
[Nokia Lumia 800] g-gabber:
About Key Storage. This is what I have reversed:

struct NOK_RSA{
char magic[8]; // NOKIAKEY
unsigned int keyType; // 0x71 - RSA
unsicgned char keyHash[0x14]; // keyID
unsigned int public_exponent;
unsigned int modulus_bit_size;
unsigned char modulus[]; // size = modulus_bit_size / 0x80;
};

struct NOK_ECC{
char magic[8]; // NOKIAKEY
unsigned int keyType; // 0x72, 0x73, 0x74 - ECC
unsigned char keyHash[0x14]; // keyID
unsigned char unk_constant[0x14]; // 16D5AEFAF4155AB4BFF0D82C927A6665AE3355EB
unsigned char ecc_key[0x40]; // the key
};

@surya467 please STOP spamming here!
[Nokia Lumia 800] frenk_91:
This is the Visual studio's remote tools
[Nokia Lumia 800] ultrashot:
VS2008 + WM6 SDK is more than enough. My advices:

1) Use impdef.exe and lib.exe to make a new import library for coredll. Call it "coredll7.lib" and put to the folder with sources. Link it to your project.

2) For XIP dlls: /subsystem:windowsce,7.00

3) Dlls should be LARGEADDRESSAWARE

4) XIP dlls should have either nxsupport enabled in project settings OR nxsupport globally disabled.

If you have any questions, ask me
[Nokia Lumia 800] ChrisKringel:
Thanks a ton. I guess these are the tools used to remote edit the registry, according to the slides? Can you get your hands on the whole setup? I'll try to get my hands on VS2008 as soon as possible.

Did anyone manage to use the Qualcomm tools provided a few posts earlier? I can't get them to recognize my phone. They won't recognize the right port where my Phone is plugged in...