[Windows Phone 8s by HTC] testone:
I have an HTC Windows Phone 8S Rio. I would like to dump the partitions, as it looks like people are doing in this thread [DEV][R&D] FW & Partition Tables (Here!). When I connect the phone in the standard booted mode, the phone connects as a camera in Ubuntu linux. When I connect it using the boot mode entered by holding camera + volume down, the phone connects as a PocketPC PDA Converter and a serial port is made available. Is there some trick that I'm missing to get the partitions to show up as a drive?

If I boot when holding down Volume Down and Camera, I get the Barcode screen. Before it's plugged in, it shows Serial at the bottom. Once the USB port is plugged in, serial changes to USB. The device then is recognized as Vendor ID 0xBB4 Product ID 0x00CE and the product string is "USB BLDR". The linux kernel uses the ipaq driver to service the device and a serial port is created in /dev.

If I boot when holding down Volume Up and Camera, I get a blank screen. The device is recognized as Vendor ID 0x5C6 and the Product ID is 0x9008. The linux kernel uses the qcserial driver to service the device and a serial port is created in /dev.

If I boot when holding Volume Down I get an exclamation mark. If I plug it in, it doesn't enumerate. The phone reboots after about 30 seconds.

If I boot when holding Volume Up I get a lightning bolt and a gear. If I plug it in, it enumerates with Vendor ID 0x045E and Product ID 0x062A. It shows up as a QUALCOMM MSM device. It doesn't appear to add any devices into /dev/.

If I boot holding nothing down, it boots into regular windows phone 8. It shows up as Vendor ID 0x045E and Product ID 0xF0CA. No devices show up in /dev/.

If it matters, here is the information on the barcode bootloader:

PM5910001 P S WP8 I

SBL1-103.054.002

SBL2-103.054.001

SBL3-001.532.011

TZ-001.030.530

UEFI-0.0.1030.54(159870)

OS-1.04.401.03

eMMC HNX 3696MB F-83

CID-HTC__J15

Radio-1.11b.3054.25_10.13.30.54

MSM8227 v2.0-p0 0x207d00e1

Krait:Fast Q6:Fast VDDCX:Slow 0x30c00

Touch FWS1:1195017,52303038,13106

==== UPDATE ====

If booted with the volume up and camera button, the device shows up as QHUSB_DLOAD. Apparently this is commonly referred to as the OSBL bootloader. According to this thread: http://forum.dailymobile.net/index.php?topic=77415.0 the QHUSB_DLOAD identifier means that it is a locked bootloader, and won't present the file system to the host. So, I think I can scratch off the whole USB partition dumping.

On a separate front, I downloaded the ROM for the phone and I found what looks to be an NTFS partition. If you delete the first 0x15F [351]bytes of the european ROM version 1.04.401.03_1.11b.3054.25_10.13.30, or 0x22 [34] bytes of the russian ROM version 1.04.411.03_1.11b.3054.25_10.13.30, to align the image on sector boundaries and run Active File Recovery, you can see some partitions. For each version you'll find 3 unnamed FAT partitions and a single NTFS partition named Boot. Unfortunately, none of these partitions appear to have the system binaries in them and overall they all appear to be involved in bootloading. Additionally, I've seen some references to BitLocker both in the binaries on the phone and here: http://www.windowsphone.com/en-us/business/security. It wouldn't be too much of a stretch to think that Microsoft may be protecting some of the file system using BitLocker and would explain the high entropy data present in the ROM.

I am getting a not-so-gently used Windows Phone 8S today and will use the motherboard to attempt to find JTAG pinouts. Hopefully there will be some traction on that angle, unless someone can help me out with an easier method before I take this fork in the road.