yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] jessenic:
QPST works with my Samsung Omnia 7, just need to change USB mode to DIAG in the Samsung Diagnostics app. I've read that older Nokia ROMs have also USB mode change in nokia diag app, maybe worth a try if you have nokia DLOAD?
[Nokia Lumia 800] biktor_gj:
You can do it by downgrading the firmware on the lumia to something old enough to have Diagnostics App 1.0.0. Then in Diagnostics, go to Settings, and choose serial USB mode. Reboot the phone, and QPST mode will be active. What I'm not finding is compatible drivers...

Any help out there?
[Nokia Lumia 800] revxx14:
Very awesome, sad to see it won't work for the Lumia 900, but I suppose that's just a matter of time. Since it's the flagship Windows Phone devices, people are bound to be working on it.
[Nokia Lumia 800] xorizont:
Try changind mode to serial. Reboot. Turn off your phone and insert usb. Let it turn on. While turning on drivers may be installed. Also let windows to search for drivers in the web.

Changing usb mode to serial may be a solution for flashing the osbl file I provided. Because I couldn't flash my lumia until change mode.

I have latest firmware in diagnostic-setting-usb mode I can change to serial and back to zune
[Nokia Lumia 800] xsacha:
I'm trying to reverse-engineer the .cert format. So far I've got a few of the variables.

I can definitely confirm that the qualcomm .cert is correct, it just doesn't like the Lumia 800s.

Trying to find out why ;)
[Nokia Lumia 800] ombadboy:
Going over the Nokia slides, and found something interesting here..

"Install the QSPT driver to identify the phone is in DLOAD mode. After that you can flash your phone with QPST and vdsemmctool in DLOAD mode.."

Now am not quite sure if they are talking about NOKIA DLOAD or some sort of mode in the Qualcomm bootloader, but if we get ahold of those drivers somehow, then this could be the way to flash the 'locked' bootloaders with something we want..

edit: actually ignore this post, complete bs from my part :)
[Nokia Lumia 800] xorizont:
So, that means that this cert file can help to open Qualcomm mode in other lumia phones?
[Nokia Lumia 800] Giblet-dono:
With a Lumia 800 getting to the battery proves to be hard ;)

And it doesnt drain that fast when the screen is off 100% of the time..

So Im letting it sit till I'm sure it's empty/off..

Thanks for your responses, I'm going to try them both!
[Nokia Lumia 800] lilstevie:
yes, the battery is a bit more difficult to get to, but it could take days for the battery to drain
[Nokia Lumia 800] Ricehead:
I'd just like to congratulate everyone who contributed to this exploit on how far you have come for the Locked bootloaders, The tension of how close you are to getting an unlocked bootloader is unbearable, I have a locked bootloader, I too used NCS, but if you need me too try and flash anything to my phone i'd be more than happy too.

but hey, Maybe someone knows someone on the inside at nokia that can tell us the secret to these certificates and the signing.

GOOD LUCK
[Nokia Lumia 800] xsacha:
I have been documenting the .cert format. This is what I have so far:

It seems there is indeed device-dependent stuff in the header.
[Nokia Lumia 800] suzughia:
We've got lumia 710 bootloader unlock fw 12070 on the thread on lumia 800 general
[Nokia Lumia 800] Jaxbot:
So, what happens if we change the device dependent info to the Lumia 800's identifier? Would that ruin the cert, or would that set us free?
[Nokia Lumia 800] suzughia:
I think that the cert should broke if not Nokia made a Sony-style epicfail :D
[Nokia Lumia 800] lilstevie:
if it didn't break the cert then the certificate would be ineffective
[Nokia Lumia 800] Jaxbot:
The cert is for the mbn file, though, which is why I'm asking. The mbn file wouldn't have changed, so if only the crypto data in the cert file is used for verification of the mbn, then changing the header wouldn't matter.
[Nokia Lumia 800] xsacha:
I tried changing the device-dependent data and got this in NSSPro:

Section:	nokia_osbl.mbn - data container (873000 bytes)

Section:	nokia_osbl.mbn.cert - data container (480 bytes)

Scanning failed. No point to continue.

It gives up on the 'info header'
[Nokia Lumia 800] lilstevie:
From 0x90 to 0xAF (up to the start of the 20 00 00 00.. constant) is a SHA-256 hash of the file
[Nokia Lumia 800] Jaxbot:
Is that error the result of a failed cert check, or a corrupted file?
[Nokia Lumia 800] lilstevie:
that is what happens on certificate validation failure
[Nokia Lumia 800] Jaxbot:
So there's the prevention. But do you put a sha1 hash of a file inside of the file? By adding the hash, the hash would no longer be valid. So what exactly is the hash of?
[Nokia Lumia 800] ceesheim:
maybe is the sha1 from the osbl ?

did they change the size also to the corosponding ?

on changeing the model check the size will be div to
[Nokia Lumia 800] xsacha:
It does this simply because I repacked the .esco. If I repack the same .cert (the working one), it gives this error.

How do I correctly repack a .esco?
[Nokia Lumia 800] lilstevie:
the certificate isn't hashing itself, the information up to this point will be hashed, and signed for the next part, this hash is the hash of the mbn

---------- Post added at 11:58 PM ---------- Previous post was at 11:57 PM ----------

I imagine that an esco has some kind of integrity check as well
[Nokia Lumia 800] ombadboy:
I don't think thats the hash of the file it's self.. If am not mistaken its not possible 'in the real world'. Could it be the hash of the mbn file?
[Nokia Lumia 800] Jaxbot:
Hmm interesting. The esco files are just zip files (duh), but is there any sort of signing on them? I didn't find anything on a quick look, but I'm not too familiar with the PKZIP format
[Nokia Lumia 800] ceesheim:
maybe zip it without compresion ?
[Nokia Lumia 800] Briefcase:
I always wanted to know how you guys derive this kind of information from just a hexadecimal view of the binary data. Could someone elaborate on this? This thread is f*cking awesome to read!! :-).
[Nokia Lumia 800] Ricehead:
A hex editor ?
[Nokia Lumia 800] xsacha:
Not sure how to do it properly. I'm using 'Store' and the final file is 854KB (as before) but it's not working.

Section:	nokia_osbl.mbn - data container (873000 bytes)

Section:	nokia_osbl.mbn.cert - data container (480 bytes)

Section:	nokia_osbl.mbn - info header

Scanning failed. No point to continue.

I think it might have something to do with the access/modify times being added (they were blank before).
[Nokia Lumia 800] Briefcase:
Uhh, yes, of course. But how do you find out from just this hexadecimal view of the file content that the red part is device specific, the brown part contains the date, and for example
[Nokia Lumia 800] Jaxbot:
If the final file is the same size, I have no idea why it wouldn't work... open it up with a hex editor and see if anything is noticeably different that might cause the flasher to trip
[Nokia Lumia 800] lilstevie:
there is certain data which is going to follow certain patterns, when it came to the sha hash, no signing goes without a hash of some kind, so I generated about half a dozen hashes of nokia_osbl.mbn and checked for the same data in nokia_osbl.mbn.cert
[Nokia Lumia 800] xsacha:
The only difference I can see is that the accessed/modified times are no longer blank. They have a timestamp. Could this affect it. If so, how do I add to archive without those?
[Nokia Lumia 800] Briefcase:
Thank you (already out of thanks so will do it this way ;-)). I guess the device specific parts are then discovered by comparing the L800 cert with the L710? But since the mbn are different versions (Nokia DLOAD vs Qualcomm) I do not see how you could extract the device specific places in the cert file as xsache did. For example the hash location you discovered will also be different (as it is a different mbn file).
[Nokia Lumia 800] xsacha:
The device dependent stuff I found was identical for all Lumia 710 and identical (but different to Lumia 710) for all Lumia 800.
[Nokia Lumia 800] ombadboy:
Here's a couple of links for you mate:

http://www.nirsoft.net/utils/bulk_file_changer.html (windows)

http://blog.rootsmith.ca/linux/unix-access-modify-and-change-times/ (unix)
[Nokia Lumia 800] lilstevie:
none of the parts are unique to each device, but they are to the device family, so comparing them to each other will show those parts that are different, and those that are the same
[Nokia Lumia 800] xsacha:
By the way the device-dependent stuff is repeated again just before the certificate (thanks chessdragon136):

---------- Post added at 03:09 PM ---------- Previous post was at 02:40 PM ----------

Sweet! I got the .esco repack working now.

And I changed both device-dependant areas. Still rejected the bootloader though :(

Flash File:	RM801_12w07_prod_generic_nokia_osbl.esco

Sending certificate...Done.

Sending file...Failed.
[Nokia Lumia 800] ceesheim:
also changed filesize to the coresponding ?
[Nokia Lumia 800] xsacha:
Hm? Filesize didn't change.
[Nokia Lumia 800] lilstevie:
try with changing just the first :p if we are lucky nokia may have failed hard and use one for the sigcheck and one that actually does the work.

I expect only a portion of the data is signed
[Nokia Lumia 800] xsacha:
Here is an upload zip containing three .esco's:

* Original Lumia 710 Qualcomm Bootloader (+cert)

* As above with top half of cert modified (device dependant area 1)

* As above with entire cert modified (device dependant area 1 + 2)

All of them fail on Lumia 800.

http://www.mediafire.com/?7q44c0231uaa9cp
[Nokia Lumia 800] ombadboy:
Can you also upload just a repacked unchanged version of the .esco, so someone with a 710 can check if that works. Then we can exclude whether the packing (also) causes a problem or not..
[Nokia Lumia 800] tjramage:
It's a long shot, but I'm guessing you tried flashing them with the Nokia Support Tool as well as NSSPro??

Also, on a separate note - has anyone tried flashing to a firmware (11414) with an older version of the Diagnostics app which allows you to change the USB mode from "Zune" to "Serial"?? Perhaps then you could get it recognised by the QPST tool (linked earlier) and possibly flash and/or extract files that way?

Really exciting reading this thread :)
[Nokia Lumia 800] suzughia:
My diagnostic app can change from Zune to serial but for using QPST you should have Qualcomm baseband - I've already tried it.
[Nokia Lumia 800] tjramage:
Hmmm, ok. That was next on my list of things to try, but I guess I'll leave it then...
[Nokia Lumia 800] xorizont:
So, as we see, my files can really unlock Nokia dload and make it Qualcomm. I'm really glad with it. Now it's important to find the way to unlock Lumia 800s.

Good luck, guys. Thank you for interup-unlock)
[Nokia Lumia 800] biktor_gj:
The question really is... Can QPST put the phone in Download Mode? From within QPST you can jump from one mode to another, maybe even execute something directly on the RAM (and if you can do that, forget about certificates and stuff since you only inject our unlocked bootloader to ram and execute it from there, then reflash the 2nd partition and reboot, then, unlocked bootloader on flash).

Qualcomm's Diagnostics interfaces ARE available on EVERY phone, locked and unlocked. The only thing that's preventing me from tampering around is I can't seem to find any suitable drivers for the MSM7630 surf based board.

As soon as you put the phone USB mode in Serial (Diagnostics App), four devices appear, and all of them are Qualcomm's serial ports, and the four of them can link to QPST, but need drivers!

If you force usbserial in linux you can talk with AT commands to the AMSS on the phone. I think you can even tether your internet connection with it. But can't find drivers to link it to QPST in Windows...

eMMC download mode works for unlocked bootloaders, btw...
[Nokia Lumia 800] rescbr:
For the ones looking on .esco: Nokia.Wezen.Programming.dll.

It seems that it is NCS who is checking certificates etc, not the bootloader.
[Nokia Lumia 800] ceesheim:
lol that is also the same for samsung ( the flashing app is looking for serts )

they hacked the flash tool and then we could load engineering roms

it is good possible by just hacking the flashtool will make it able to flash wrong signed files ( wrong because phone normally always look for a cert but in this case just a normal one from or nokia or Qcom)
[Nokia Lumia 800] ombadboy:
@xsacha, how exactly can you check if a firmware has the Qualcomm or NOKIA DLOAD bootloader? I've got a hunch and trying some stuff out, but without flashing the firmware how is it possible? I saw somewhere your using a hex editor but on what file exactly in the RM-803 posted in the other thread (in particular)? Cheers!
[Nokia Lumia 800] tjramage:
I'm pretty sure you can find out by looking at the size of the osbl file. I may be wrong, but I think the Nokia DLOAD osbl file is approximately ~932KB...
[Nokia Lumia 800] rescbr:
Open the .esco file on a Hex editor and look for "Nokia DLOAD" (or "Qualcomm CDMA Technologies MSM")
[Nokia Lumia 800] ombadboy:
Yup got it.. You firstly need to unpack the .esco and look at the .mbn file inside.. we're looking at the NOKIA DLOAD .esco file to be 932kb and 933 kb, whereas the Qualcomm one is 835kb.. I went through each and every firmware available on NaviFirm for the Lumia 710 and 800 and I can confirm NONE have the qualcomm bootloader (anymore) (maybe Nokia addressed the issue).

Even the one posted by xorizont has the NOKIA DLOAD bootloader on Navifirm.. If you guys have any OLD firmware files you downloaded.. could you please host them somewhere so I can take a look?

Maybe downgrading to one of those (if they have the Qualcomm bootloader) might do the trick!
[Nokia Lumia 800] tjramage:
I have a ton of old firmwares from months ago back when I was testing them for battery performance issues... All of them have the 932KB osbl esco file :(
[Nokia Lumia 800] EmaTheLegend:
I tried to open with HEX Editor 2 esco files extracted from 2 updates downloaded with navifirm...

First image is relative to release 11465 : first occurrence of DLOAD is at address 590D0.

Second image is relative to latest release (12070) : first occurrence of DLOAD is at address 5DF0 ("Secure DLOAD started")
[Nokia Lumia 800] _Madmatt:
I'm a noob in all this, but is there no way to port the 710 bootloader to the 800? We know what parts are different. Wouldn't it work to sort-of copy paste the unknown parts in the 710 bootloader? I really don't know, the idea sounds too simple to be true, but maybe you can try it out?
[Nokia Lumia 800] ombadboy:
Could you please list which ones you have checked? So we can tick them off the list.. There must be one that they forgot the Qualcomm bootloader in, as with the Lumia 710!

Cheers!

---------- Post added at 08:09 PM ---------- Previous post was at 08:06 PM ----------

xscacha has been trying to do that, he posted a few firmwares in previous post but to no success.. Feel free to grab the .esco file from: http://narod.ru/disk/45935058001.2aaca38c9acf622332f4a81b5bf0e331/RM-803.rar.html

credit xorizont

---------- Post added at 08:11 PM ---------- Previous post was at 08:09 PM ----------

I can confirm Nokia is onto this, and fixed any firmware on NaviFirm with the Qualcomm bootloader! So any stored versions you have on your PCs could prove useful!
[Nokia Lumia 800] biktor_gj:
NaviFirm doesn't get every file from Nokia Care Suite. I've been also digging into this. Put NCS in online mode, you'll find 11414 firmwares in there. Still haven't found anything witch qcsbl yet, but still looking. The more people we look into it, the more probable we'll find something!

Regards,
[Nokia Lumia 800] ombadboy:
Will look into it now.. Dont have NCS installed, thought it wasnt needed to find the firmwares!
[Nokia Lumia 800] sHaHiN786:
On the Navifirm, when you search for Lumia 800 on all three servers, using the search bar that is, it shows (300+ hidden results) :confused:

How do you view the hidden results?

---------- Post added at 08:32 PM ---------- Previous post was at 08:30 PM ----------

Yeah, same here, just comes up with an error to re-install it and never does the job, to put shortly, it doesn't support it I guess.
[Nokia Lumia 800] ombadboy:
Actually it requires both 2005 and 2010.. Working fine now
[Nokia Lumia 800] ap3rus:
User account control should be disabled during installation process.
[Nokia Lumia 800] X3n0n:
I believe when firm 12070 was released in NZ and India, it has bee removed and replaced at some moment no ?

Maybe it has nothing to do with bootloader :o
[Nokia Lumia 800] Bph&co:
Hi,

It seems some good news during the day. Just a quick one on the flashing of

RM-803 into RM-801, probably the phone HW id is in the cert and is checked.

Flash File:	RM803_12w07_prod_generic_nokia_osbl.esco

Sending certificate...Done.

Sending file...Failed.

The response of the write finalizing is:

00000000	0.00000000	[5568] execute responce
00000001	0.00005824	[5568] 47 00 03 00 00 00 00 00

where correct responce should be 8 bytes of zeros.

Regarding modding the cert and error on parsing - it must be file structure

error, as NSS will not check RSA or SHA on the certificate. Anyway, runtime

edit of any byte in the cert (valid RM-801 one) returns the same 47,03 error

code.

BR
[Nokia Lumia 800] ombadboy:
For some reason though, I can't put NCS in online mode!
[Nokia Lumia 800] xorizont:
yes, this situation happened with 710. They have deleted one version, and later uploaded another. I have managed to save the first version and now it possible to open lumia 710s bootloader
[Nokia Lumia 800] X3n0n:
Oh OK, I tought this was for 800's firmware, and foe the 710 it was for another version.

So, nevermind :D
[Nokia Lumia 800] tjramage:
I have about 15 or 20 different ones, so too many to list really. None of them have the Qualcomm bootloader though...

I also have about 20 or so Cache folders for NaviFirmEx sitting in my recycle bin going from January 27th to present day. I disabled my network connection and copied/pasted every single cache folder in. It pulled varying amounts of firmwares depending on the date the cache was made (obviously) and they all had 932KB osbl esco files.

I doubt we're going to find a firmware for the Lumia 800 with the Qualcomm bootloader on Nokia's servers or local copies people have previously downloaded.

It may be time to look into other ways - such as hacking NCS to force flash, etc...
[Nokia Lumia 800] cdbase:
remember .cab from singapore ? you can find qualcomm files inside but cab method doesn't affect bl

http://speedy.sh/8XeZ2/pr12-oemupdate.cab.pks-33f6e72c7916dcdfca7f8d2c8a89fb00e49b2dbf.cab
[Nokia Lumia 800] ombadboy:
looking into that now.. but doubt we'll get anywhere with this

---------- Post added at 09:47 PM ---------- Previous post was at 09:46 PM ----------

Don't forget the way we managed to get the Qualcomm bootloader on the 710s is via this method! We were lucky enough for someone to save an old version which had the Qualcomm bootloader, and flash that!
[Nokia Lumia 800] xorizont:
why are you so sure, that Nokia has mistaken also with lumia 800s bootloader files, and uploaded it to navifirm?)
[Nokia Lumia 800] ombadboy:
I am not, but we're exploring every possibility here.. For sure it's not on navifirm anymore, hence why am looking at archives ;)
[Nokia Lumia 800] X3n0n:
From the other thread :
[Nokia Lumia 800] lilstevie:
not in this case, while yes the flashtool does a sanity check on the signature and verifies it, the device also does the same thing
[Nokia Lumia 800] rescbr:
I'm not so sure about cab method not affecting BL. Many files inside of this cab seems to have to do with the CE Bootloader (ULDR), which seems to be related to modes such as Factory Test, etc.

Zune can flash bootloaders (Nokia.First.dll is flashed by Zune). Even if Zune couldn't flash bootloaders, it is possible that some software/driver inside one of those .cabs does the flashing step.

OEM_7x30_MODEM.cab.pkg is very interesting, unfortunately encrypted. Why is there a MODEM file? Is it the firmware for the ARM9 "hypervisor" (REX/AMSS) core (MODEM filename suggests this)?

Another question that just popped on my head: Qualcomm/Nokia OSBL runs in the ARM9 core or in ARM11 core? This page suggests that OSBL runs on ARM9. Is this valid to Nokia too? ULDR seems to be equivalent to hboot.

Does other .cab updates contains such files (MODEM, ULDR, etc)?
[Nokia Lumia 800] lilstevie:
Ok so more information about the certificate:

0x0 -> 0x9 is a WP7cert magic

0x1C -> 0x1F is the ImageCert magic
[Nokia Lumia 800] Ricehead:
Ok, I've been following the thread for a while now and from a firmware and flashing with permissions from NCS, point of view there are obstacles here there and everywhere. (Certificates and Signing, Being able to flash it)

Is there a way we can approach flashing a rom with the unlocked bootloader through HARDWARE, I'm not very educated with the hacking of hardware in mobiles so could someone explain to me if this is achievable or not.
[Nokia Lumia 800] lilstevie:
You could probably flash it via Qualcomm Emergency Download mode without a certificate, but the question is how to get into this mode
[Nokia Lumia 800] xsacha:
I checked out 0x1C-0x1F that you said is ImageCert magic.

Its ascii representation is: WP70.

Hang on, WP7 right? It seems to be an OS version? This should be something the bootloader looks for.

So, I have a disassembled copy of bootloader on my right and I check out if it knows about this "WP70". Yep, there it is, it's a variable it stores.

It simply loads a value and compares it to that magic.

If someone wants to hunt around that area for the device-dependent stuff, maybe we can fix that cert!
[Nokia Lumia 800] Briefcase:
So since this ImageCert Magic just indicates the required OS level (assumption after your research) this isn't of interest to us. Or is it because it's WP70 that this is going wrong? (Does the Nokia DLOAD bootloader have WP71?).
[Nokia Lumia 800] xsacha:
No it's because it's in the area of the bootloader that checks cert that it is interesting.

Used something constant to find the entry point.

By the way, I was looking at strings and found "ANDROID!" in the Nokia DLOAD. :P
[Nokia Lumia 800] Bph&co:
Probably they meant "!ANDROID" ;)

On a serious note: Not the whole cert from the file is sent, the header is cutoff,

so the WP70 Magic is the start, end is the RSA2048 signature.

BR
[Nokia Lumia 800] xsacha:
By the way, the source code to the OSBL for this chip is available here:

https://www.codeaurora.org/git/proj...oot2/osbl/target/msm7x30/src/osbl_mc_target.c

from AMSS commit here:

https://www.codeaurora.org/git/proj...ons/db2575e163152f681668800744c99f287f77a8ef/

A full repository with source code for the chip (and all middleware components) is available here:

https://www.codeaurora.org/git/projects/hisense-ts7008/repository
[Nokia Lumia 800] lilstevie:
I was getting this information from using reflector on the dll.

the magic is specified in the code as being that. The cert is certainly split into two parts, and is handled in its two seperate parts, at least by the programming dll.

Later on today I hope to figure out the structure in its entirety without any unknowns
[Nokia Lumia 800] xsacha:
Well I decided to back trace from the error that Nokia Care Suite reports.

I found out exactly where the error is reported to NCS and have backtracked to three comparisons.

One of those three comparisons is the issue.
[Nokia Lumia 800] Briefcase:
Fantastic work guys, I hate the 'Sorry, you are limited to 8 thanks per day' this thread deserves so much more ;-)
[Nokia Lumia 800] EmaTheLegend:
probably there are more checks in the program. Try to remove them and hope it works ! Thanks and good luck,
[Nokia Lumia 800] lilstevie:
I have just started working on a program to parse the certificate data based off the structures outlined in Reflector hopefully it will give us a better idea of the cert and maybe find some weakness in it.