yashsingh1/xdaforums huggingface dataset:
[Windows Phone 8 Development and Hacking] snickler:
Well now that you say that.. I've been looking through some of the nokia xaps and looking at some of their code and I DO see something to change the network mode... I'll have to make another app to see if it will work.
[Windows Phone 8 Development and Hacking] snickler:
1) Is your phone dev unlocked? If not, it won't work.

2) Which phone are you using?
[Windows Phone 8 Development and Hacking] returned4good:
That would be so awesome, man. I just brought my 810 to AT&T. I pick up their LTE bands and would love to be able to actually get the full benefits from it. :)
[Windows Phone 8 Development and Hacking] snickler:
I may be able to whip something up today. I'll let you know :)
[Windows Phone 8 Development and Hacking] GodlikePL:
Isn't Microsoft offering free unlock now?
[Windows Phone 8 Development and Hacking] snickler:
Yes they are, but I'm wondering if he's having issues because of not being full dev unlocked. Either way, he'll need to go into that Windows Phone Developer Registration tool program and unlock his phone.
[Windows Phone 8 Development and Hacking] Prerna:
Thanks, non, and I actually ignored my Lumia 920 could be dev unlocked! I guess I gotta take a look at the appropriate section first and come back.

cheers.
[Windows Phone 8 Development and Hacking] snickler:
Yeah, you can unlock for free now with a 2 app limit. All you need to do is run that Windows Phone Device Registration app from the SDK and put in your live email address and voila.
[Windows Phone 8 Development and Hacking] snickler:
Hmmm [MENTION=770625]cpuguy[/MENTION] & [MENTION=3529492]GoodDayToDie[/MENTION], I used the DWord methods within the Nokia.SilentInstaller registry class and still can't write to MaxUnsignedApp :/. We need some ROM dumps of HTC or Samsung to see if they use a higher privilege in their .winmds. I doubt, but it's worth a shot.
[Windows Phone 8 Development and Hacking] vivekkalady:
I have also tried these items but still no Luck
[Windows Phone 8 Development and Hacking] cpuguy:
That probably won't give us much. The registry methods the Nokia.SilentInstaller.Runtime.dll uses are the same ones [MENTION=3529492]GoodDayToDie[/MENTION] is using in his wrapper. The registry access permissions are granted based on the process' running security context.

I'm not exactly sure what determines the level of the security context (or executing user). If I'd have to guess, I would say it's closely tied to the allowed application capabilities (ex.: INTEROP access vs no INTEROP access). The capabilities are split in four categories: First-class, Second-class, Third-class and Enterprise. Our applications run in either Third-class or Enterprise while Nokia's, Samsung's and HTC's are Second-class and finally MS' are First-Class. Your capability level seems to be associated with the certificate used to sign the XAP. Each class level has it's own OID; each certificate signature should have one of these OIDs.

This raises another point... We could create our own root CA and sign our XAPs using SPC crafted from our CA containing a higher privileged OID. The problem we'll encounter is the phone won't accept the signed XAP because it's not coming from a trusted CA. I already tried doing this approach and ran into an error with the XAP deployer so, I came to the conclusion that it's probably because the CA isn't trusted (I could be wrong though - maybe there's a pre-defined whitelist of trusted XAP CAs). I tried to use the CRYPT32 APIs to install my CA in the Trusted Root CA store but I get an Access Denied error when trying to write the cert (I can open it just fine but can't write to it). If anyone succeeds doing this, I'd be interested in knowing how it was done.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
I don't know about the "classes" you speak of (got a source where I could learn more? That would be great) but if you look at the policy-defining XML files under the Windows directory (I forget the exact path, but it's not that hard to find, it's a ton of XML files within a subfolder that I think is called "Policies" either in Windows or System32) you'll see that there are a bunch of policies which give an app the necessary permissions to write to various parts of the registry or file system, access various COM servers (which presumably have their own permissions), and so on. If you look in the manifests of the various OEM XAPs, you'll see a bunch of those capabilities specified.

Naturally, all of these capabilities are missing from the public documentation. Unfortunately, nearly all of the undocumented capabilities are also impossible to install via the usual sideloading approach. The error message is basically "there's something wrong with your manifest". Getting around that is one of my research priorities.

Another possibility is to hijack the on-phone debugger. Visual Studio doesn't permit us to enumerate running processes on the phone, or to launch (and attach to) any process that we don't "own", but I don't know how deep that restriction is into the phone. I don't expect to get kernel debug, and even CSRSS is unlikely, but if we could attach to a high-privilege process that has the necessary capabilities to do something like changing the MaxUnsignedApp value...

EDIT: By the way, I can provide the Samsung SGH-T899M XAPs if you want. They have plenty of registry tricks in them, including a full registry editor mode (not a browser; it's more akin to what the LG phones had on WP7) that I can't find a way to activate (it's part of the Diagnosis app, but there's no dial code which leads to it...) but there may be useful security vulnerabilities or some such things hidden away in there.
[Windows Phone 8 Development and Hacking] phoy18:
yeah.... thanks..hopefully :victory:
[Windows Phone 8 Development and Hacking] cpuguy:
I think we're talking about the same file: \Windows\Packages\PolicyFiles\Microsoft.BaseOS.AuthorizationSecurity.policy.xml

You'll notice at the bottom of that document the CapabilityRule tags. These tags link the three capability classes (which lists the ID_CAP_* capabilities that you can add to your WMAppManifest.xml) to four principal classes (First-class, Second-class, Third-class and Enterprise). Depending which "principal" class your application falls under (which seems to be determined by the signing certificate's extended OIDs), the CapabilityRule tags will link it to the appropriate "capabilities" class which ends up determining what ID_CAP_* capabilities you can use in your application.

Speaking of attaching a debugger, I have tried something similar (I used a thread approach - not the debugger approach you're suggesting) already...

I iterated through all of the executing threads

Tried to open each thread (NtOpenThread) -> higher elevated threads failed here but I was able to hook about 120 threads outside of my own process

Impersonated the opened thread's security token (NtImpersonateThread)

Open the impersonated security token (NtOpenThreadToken)

Create a duplicate impersonated security token for re-use (NtDuplicateToken)

Spawn a new process using the duplicate impersonated security token (CreateProcessAsUserW)

Like I said, I got successful execution the above steps for about 120 threads up until the last action; I wasn't able to create a new process. I also tried manually setting the duplicated token to the current thread (mind you, that should have already been done in NtImpersonateThread) using SetThreadToken; this executed successfully but didn't seem to elevate my privileges (probably because the threads I successfully opened were all low privileged ones like mine). One more thing I'd like to try later is to spawn a new thread from within a elevated process (such as CSRSS).

I also attempted a few things with CSRSS... I was able to grab its PID (CsrGetProcessId) but couldn't open the process at all for hooking (NtOpenProcess); I kept getting Access Denied returns.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Oh, I hadn't thought about using the on-phone debug APIs. Generally, a process cannot debug processes from other users unless the process is running elevated. If everything is under the same "user" it may be possible, but I'd have expected Microsoft to have isolated each process from the others. If they did not, well, that's very interesting.

One thing to try is seeing whether we can hook an OEM app - one that can modify the registry for us - and using that. That's what I was going to do with the debugger if I wasn't able to attach it to CSRSS or any of the built-in EXEs.

Thanks for the tip on the "classes", I'll look at that file again. That may hold the secret to which Capabilities we can and cannot sideload.
[Windows Phone 8 Development and Hacking] vivekkalady:
Anyone tried disassembling the PhoneReg.exe file ?

I modified the exe and changed to 4 but nothing happened :(
[Windows Phone 8 Development and Hacking] megasounds:
resource edit some files ???

Hi there,

i am also thinking how we can "break" the : MaxUnsignedApp barrier ;)

i was dumping some files and saw the MaxUnsignedApp over there

my question , is it wise to resource edit the DataSmartRes.dll because its using the MaxUnsignedApp value

see here look at the RED part:

MosHost.*ÿÿÿ@.\.P.r.o.g.r.a.m.s.\.D.a.t.a.S.m.a.r.t.\.D.a.t.a.S.m.a.r.t.R.e.s...d.l.l.,.-.1.0.1.2.8.....Àÿÿÿvk&....€............{5B04B775-356B-4AA0-AAF8-6491FFEA5640}..Àÿÿÿvk&....€............{5B04B775-356B-4AA0-AAF8-6491FFEA5661}..*ÿÿÿnk .%”£ÊN[Î......“..........X...ÿÿÿÿ....ÿÿÿÿx...ÿÿÿÿ........................InboxProviders..ðÿÿÿlh..Øq..<Û..¨ÿÿÿnk .e».ÊN[Î.....`”..........ÿÿÿÿÿÿÿÿ....À...x...ÿÿÿÿ........................Install.øÿÿÿÈ...Øÿÿÿvk.....€ÿÿÿ.........[COLOR="Red"]MaxUnsignedApp[/COLOR]..*ÿÿÿnk .%”£ÊN[Î.....P—..........ÿÿÿÿÿÿÿÿ....P®..x...ÿÿÿÿ........L...N...........Preferred.......¸ÿÿÿ˜®..0¯.. °..¸°..P±..è±..€²...³..°³..H´..à´..xµ...¶..¨¶..@·..Ø·..p¸..Àÿÿÿvk&.N...Ø®..........{00000055-0000-0010-8000-00AA00389B71}..¨ÿÿÿ{.B.B.E.E.A.8.4.1.-.0.A.6.3.-.4.F.5.2.-.A.7.A.B.-.A.9.B.3.A.8.4.E.D.3.8.A.}.........Àÿÿÿvk&.N...p¯..........{00000160-0000-0010-8000-00aa00389b71}..¨ÿÿÿ{.2.e.e.b.4.a.d.f.-.4.5.7.8.-.4.d.1.0.-.b.c.a.7.-.b.b.9.5.5.f.5.6.3.2.0.a.}..

gr,

Megasounds !
[Windows Phone 8 Development and Hacking] venu238:
This is the quote of the person (wp8expert) from the windows phone central forum, it maybe helpful for you
[Windows Phone 8 Development and Hacking] snickler:
Anything in the format of "XXXXXRes.dll" is just a .NET compiled Resource dictionary. It's most likely only reading from the value. We're able to READ the DWORD value, but unable to set it.

Edit: Looks like I didn't fully read that post as you acknowledged that it was a resource. As I put above, I see it only used to READ that value rather than write it.
[Windows Phone 8 Development and Hacking] ultrashot:
Something from PDBs, something from IDA, something is similar to WP7.

I have lots of definitions, just PM me if you want something specific (multiple definitions if you want). They are not really sorted so I can't just take "all ShellChrome ones". Suggestion is valid for many libraries, not just ShellChrome.

QC is usually mode in which phone advertises some extra USB interfaces. If he sees any devices except QC, that could be great, though I don't think Samsung has obvious flaws :)
[Windows Phone 8 Development and Hacking] snickler:
Oh [MENTION=1794621]ultrashot[/MENTION], just know that your knowledge and contribution to WP homebrew has kept me wanting to help out as much as I can. :D.
[Windows Phone 8 Development and Hacking] returned4good:
Hey Snickler, any luck on that LTE fix?
[Windows Phone 8 Development and Hacking] snickler:
I'm still working on it. I'll see if I can put something up today. I've been pretty busy between this and working on CloudMuzik updates :P.

I'm not certain if it will actually work or not, but whatever I release will be worth a try.
[Windows Phone 8 Development and Hacking] returned4good:
Absolutely, and thank you for that. No rush; just curious. :)
[Windows Phone 8 Development and Hacking] ultrashot:
I don't really know what is the issue there, but I believe baseband fix must be done in NVRAM, which is usually accessible via QPST and hardly accessible via external means. Nokia USB interface provides a way to edit it, but to do that you must be in SwUpdate or Maintenance mode - the first one is achievable, but I wasn't able to edit NVRAM yet. Though, I am on vacations and this isn't something I want to check now and next week :)
[Windows Phone 8 Development and Hacking] snickler:
Well there you have it lol. Thanks for the heads up [MENTION=1794621]ultrashot[/MENTION].
[Windows Phone 8 Development and Hacking] returned4good:
Well, basically T-Mobile was going to release an OTA software update to enable LTE functionality on the Lumia 810 which had been disabled. They then reneged on that.

http://news.cnet.com/8301-1035_3-57577506-94/t-mobile-to-lumia-810-users-no-lte-for-you/
[Windows Phone 8 Development and Hacking] pdaimatejam:
hi snickler

I hope the information here can look at the following file

using System;
using System.Runtime.InteropServices;
using Windows.Foundation.Metadata;
namespace Touch_Display_Settings_WinPRTComponent
{
[ExclusiveTo(typeof(CTouchDisplaySettingsWinPRT)), Guid(74976083u, 20932, 14436, 165, 254, 168, 2, 198, 96, 37, 17), Version(1u)]
internal interface __ICTouchDisplaySettingsWinPRTPublicNonVirtuals
{
int GetRegistryValue([In] string registryKey, [In] string registryValue);
bool SetRegistryValue([In] string registryKey, [In] string registryValue, [In] int valueData);
}
}

using System;
using System.Runtime.InteropServices;
using Windows.Foundation.Metadata;
namespace Touch_Display_Settings_WinPRTComponent
{
[Activatable(1u), MarshalingBehavior(MarshalingType.Agile), Threading(ThreadingModel.Both), Version(1u)]
public sealed class CTouchDisplaySettingsWinPRT : __ICTouchDisplaySettingsWinPRTPublicNonVirtuals
{
[Overload("CreateInstance1")]
public extern CTouchDisplaySettingsWinPRT();
public extern int GetRegistryValue([In] string registryKey, [In] string registryValue);
public extern bool SetRegistryValue([In] string registryKey, [In] string registryValue, [In] int valueData);
}
}

using System;
using System.Collections.Generic;
using Touch_Display_Settings_WinPRTComponent;
namespace TouchDisplaySettings
{
public class DisplaySettingsManager
{
private Dictionary<string, string> RegistryPath;
private Dictionary<string, string> RegistryName;
private static CTouchDisplaySettingsWinPRT Native;
public DisplaySettingsManager()
{
this.RegistryPath = new Dictionary<string, string>();
this.RegistryName = new Dictionary<string, string>();
DisplaySettingsManager.Native = new CTouchDisplaySettingsWinPRT();
this.RegistryPath["TouchSensitivitySwitch"] = "Software\\OEM\\Nokia\\Touch\\Improved\\";
this.RegistryName["TouchSensitivitySwitch"] = "Enabled";
this.RegistryPath["SunlightReadabilitySwitch"] = "Software\\OEM\\Nokia\\Display\\ColorAndLight\\";
this.RegistryName["SunlightReadabilitySwitch"] = "UserSettingSreEnabled";
this.RegistryPath["BatterySaverBrightnessSwitch"] = "Software\\OEM\\Nokia\\Display\\ColorAndLight\\";
this.RegistryName["BatterySaverBrightnessSwitch"] = "UserSettingBsmDimmingEnabled";
}
public bool IsSwitchVisible(string name)
{
if (name == "BatterySaverBrightnessSwitch")
{
int registryValue = DisplaySettingsManager.Native.GetRegistryValue("Software\\OEM\\Nokia\\NokCgSvc\\", "ListenOnStartup");
if (registryValue != 1)
{
return false;
}
}
int registryValue2 = DisplaySettingsManager.Native.GetRegistryValue(this.RegistryPath[name], this.RegistryName[name]);
return registryValue2 != 2;
}
public bool IsSwitchEnabled(string name)
{
int registryValue = DisplaySettingsManager.Native.GetRegistryValue(this.RegistryPath[name], this.RegistryName[name]);
return registryValue == 1;
}
public bool UpdateRegistry(string name, bool state)
{
return DisplaySettingsManager.Native.SetRegistryValue(this.RegistryPath[name], this.RegistryName[name], state ? 1 : 0);
}
}
}
[Windows Phone 8 Development and Hacking] pdaimatejam:
It must have a solution

Whether to continue the study wish to reach a happy ending

thanks
[Windows Phone 8 Development and Hacking] snickler:
[MENTION=1622319]pdaimatejam[/MENTION], we WILL somehow get this working lol. Microsoft has to slip up somewhere.
[Windows Phone 8 Development and Hacking] :
You guys are finding a lot of other things that could help in other areas though. We still need to be able to write to the registry key to really do anything.
[Windows Phone 8 Development and Hacking] IzaacJ:
As soon as we're able to write to MaxUnsignedApp we're lucky ;) Can't wait for that to happen :P
[Windows Phone 8 Development and Hacking] thals1992:
That's if it performs the same function as in previous WP/WM devices.

I hate to be pessimistic, but even with WP8 carrying alot of the functionality from WP7, we are dealing with a fork of NT instead of CE. This value could just determine how many developer deployed apps can be installed at once. Nothing more. (Please correct me if necessary. My thoughts of this is conjecture, as I don't know where this value is called from and etcetera)

I hate for this thread to dwell only on finding an interop unlock, but I too hope to use this for interop before needing it for something else.

Sent from my RM-860 (Lumia 928) using the OFFICIAL Tapatalk app.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
It's a valid point. Interop-unlock loosened a lot of restrictions on WP7, and was presumably used by OEMs and MOs who needed easy ability to install ID_CAP_INTEROPSERVICES apps to test their high-privilege apps.

However, in WP8, things are different. What capabilities can be installed is now controlled via the policy engine, or whatever it's WP8 equivalent is called. Policy "classes" are indicated via key usage identifiers in the certificates used to sign XAPs. ID_CAP_INTEROPSERVICES (and nearly all other interesting capabilities) requires the class intended for use by OEMs. If we can't get our hands on such a signing key, or find some way to spoof it, we may be in a pickle with regard to a jailbreak via this approach.

It's possible that interop-unlock will function much as before too, though; freeing the limitations on app capabilities for all apps, even unsigned ones. It's worth a shot. Somebody might want to decompile the relevant code and investigate, though.
[Windows Phone 8 Development and Hacking] thals1992:
Yeah, I'd almost fork all of the general work into a new thread called "[PROJECT] Project Interop8" and have a moderator or two try and clean the development threads up, because a lot of posts are not quite about the titles of the threads, like in here. I could gladly make a new thread and summarize most of what's been done so far and let you and anyone else help contribute over there rather than make it hell for those trying to get/find help for these apps.

Sent from my RM-860 (Lumia 928) using the OFFICIAL Tapatalk app.
[Windows Phone 8 Development and Hacking] snickler:
That's a good idea
[Windows Phone 8 Development and Hacking] petard:
Are you guys saying you change the MaxUnsignedApp to a certain value it stops checking for signed apps?

Couldn't I use my engineering ATIV S that I posted about in another thread to check this? I can set this value to whatever I want in disk mode then boot back into the OS and see if it'll run unsigned apps. What should I do?
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Excellent point, [MENTION=280825]petard[/MENTION].

If you would, please:

1) Check the current state of sideloading capability on your phone. Set MaxUnsignedApp to 10 (the default for official unlocks) if it isn't already.

2) Attempt to sideload an app with the ID_CAP_INTEROPSERVICES specified in its manifest. If that works, then your ROM is special. It should give an error with simply a hex code.

3) Attempt to sideload an app containing other OEM-only capabilities (but not INTEROP) in its manifest. It should fail with a message about checking the manifest.

4) Set the MaxUnsignedApp value to at least 300 (that was the threshold on WP7).

5) Try tests 2 and 3 again. See if anything has changed (for example, if 3 still fails, but 2 now succeeds, or at least fails with the same error as 3 instead of the old error, we learned something even if it's not a happy thing).

6) If it's still not working we might try other values of MaxUnsignedApp, but at that point we'll probably need to reverse engineer the relevant code on the phone to find what is blocking us.

I've attached some XAPs to this post. They should let you test things. They are the same as the WP8 webserver linked in my sig (just edited the capabilities); you can use that for a baseline if you want. Use the standard Application Deployment tool from the SDK.
[Windows Phone 8 Development and Hacking] petard:
[MENTION=3529492]GoodDayToDie[/MENTION]

My MaxUnsignedApps came set to 7fffffff

It won't accept side-loaded XAPs. Gives me this error

What should I do?
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Hmm... reboot the phone (again, if you already did) and try it again, or try the other app. That result was quite unexpected. Still, you should be able to restore (or hard reset) the phone without any problem.

Out of curiosity, was the phone pre-dev-unlocked? Did you use the official tool to unlock it, or do it via direct registry editing?
[Windows Phone 8 Development and Hacking] petard:
I have rebooted it and that's all it will do. I tried both XAPs you provided and some other ones, no go.

It came pre-dev-unlocked. It's a pre-release version of the OS.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Hmm... if you remove the dev-unlock, then re-unlock using the official tool, does normal sideloading work, at least? What about high-privilege sideloading; does that fail with the same errors as on "normal" retail ROMs? If so, once you've done that, try setting MaxUnsignedApp to a reasonably high value (not 0x7FFFFFFF though; they actually might just be testing for that value) and try again.
[Windows Phone 8 Development and Hacking] ultrashot:
I think you have old connection binaries on device. Which OS version do you have on that device? (Hide last 2 digits just in case)
[Windows Phone 8 Development and Hacking] compu829:
if anyone can see if they can read and write to the following key (if it exists on WIndows Phone), it'd be appreciated!

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDLLCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength (DWORD)

This controls the minimum RSA key length that the phone will use. I need mine to be set to 512 so I can get my work email. Our IT group is taking FOREVERRRR to update the certificate (was supposed to be done in May/June).

all the gory details about this can be found at http://support.microsoft.com/kb/2661254
[Windows Phone 8 Development and Hacking] snickler:
Right now we're DEFINITELY unable to modify that key. Microsoft pretty much has every essential reg key locked down from modification by an under privileged account.
[Windows Phone 8 Development and Hacking] frama001:
Your work might seriously consider hasting that process. 512bit RSA can be broken in a matter of days with a home computer. 1024bits in months with a small cluster.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
512-bit is broken to the point where there's really no reason to use it. It was first broken well over a decade ago; that's a lot of iterations of Moore's Law.

Breaking 1024-bit will take more than "a few months with a small cluster" for any reasonable values of "few" or "small" - the largest well-generated key *ever* factored was only 768 bits, and that was only a few years back and took a ton of computing power - but for new keys you really should be using a minimum of 2048 bits. Existing 1024-bit keys are probably safe for now but should be retired in pace of stronger ones when it is feasible to do so.
[Windows Phone 8 Development and Hacking] compu829:
the most annoying part about it is it literally take two clicks on the mail server to generate a stronger key!