yashsingh1/xdaforums huggingface dataset:
[Windows Phone 8 Development and Hacking] compu829:
it's there...I am looking at it...it is listed as "unpublished" http://www.windowsphone.com/en-us/store/app/diagnosis/07a20ad9-a4f9-4de3-855f-dcda8c8cab39

What we need is someone with an Ativ S to go to that page and see if it is available for their device. Depending on what UserAgent/Device info they send back and forth, it might magically send back the extra info we need (the thing that enables the install button). I got wicked far using the the unpublished youtube app...I could download that to my 8x from the store, even though it was pulled. It always failed the license check and never completed installation though because I couldn't provide it with the "proper" SKU and checksum to allow it to register.

Edit:

This is what needs to be changed/added to the response to make it work on any phone:

1. <visibilityStatus>Unpublished</visibilityStatus> needs to be changed to <visibilityStatus>Live</visibilityStatus>

2. <isAvailableInStore>false</isAvailableInStore> needs to be changed to <isAvailableInStore>true</isAvailableInStore>

3. This section needs to be added:

<offers><offer><offerId>urn:uuid:04815c18-c48a-49b6-bf11-8a0dd129d1b6</offerId><mediaInstanceId>urn:uuid:00479f49-b01a-4bc7-b583-0fea8bd6815a</mediaInstanceId><clientTypes><clientType>WindowsPhone71</clientType><clientType>WindowsPhone80</clientType><clientType>WindowsPhone81</clientType></clientTypes><paymentTypes><paymentType>Credit Card</paymentType><paymentType>Mobile Operator</paymentType></paymentTypes><store>ZEST</store><price>0</price><displayPrice>$0.00</displayPrice><priceCurrencyCode>USD</priceCurrencyCode><licenseRight>Purchase</licenseRight><expiration>2100-01-01T00:00:00Z</expiration></offer></offers>

the correct MediaInstanceId can be gleaned from using the "SKU" line contained elsewhere in the xml. Without the correct offerID, you can download the app, but it will fail to install due to the registration server not supplying a license. If someone can figure out the correct "offerID", we can install this app on any device.
[Windows Phone 8 Development and Hacking] ultrashot:
Offer ID and Instance ID can be taken from corresponding MPAP_*.provxml from Ativ S ROM. I don't remember exact order, but I guess that first guid (in <parm name="InstallInfo" value=...) is Instance ID, second is offer ID.

I haven't looked into any Ativ S internals yet, so main questions are:

1) Isn't Samsung using its very own custom drivers?

2) Will such app pass certificate check on other devices?

I have doubts regarding both points.

EDIT: I indeed told you right order. Such provxmls are parsed inside my XAP Deployer.
[Windows Phone 8 Development and Hacking] compu829:
ooOOOooo can anyone upload the provxml file?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I can. Just tell me a path/name.
[Windows Phone 8 Development and Hacking] djadry:
The app doens't look available on Ativ S.

BTW, we can try to do what you're saying...
[Windows Phone 8 Development and Hacking] compu829:
It should be located in PROGRAMS\CommonFiles\Provisioning\OEM and be called either MPAP_Diagnostics_001.provxml or something weird like MPAP_randomcharacters_001.provxml. If you can search for the file that contains "8448ced7-7a7e-41c7-8142-a7b2f0561395"
[Windows Phone 8 Development and Hacking] compu829:
In the meantime, enjoy this screenshot from my HTC 8x! >:D
[Windows Phone 8 Development and Hacking] ryotgz:
Nevermind
[Windows Phone 8 Development and Hacking] compu829:
lol I still cant download it yet...I need the offerId
[Windows Phone 8 Development and Hacking] cpuguy:
I was able to download it on my Lumia 920 but the install fails... :( It gets to the "Installing..." phase, stays there for about a few seconds and finally says "Attention required. Tap here." which then gives me "There's a problem installing the item. Tap and hold the item, then tap Retry...".

To add further, it fails when it makes a call to "marketplaceedgeservice.windowsphone.com". But since that's an HTTPS request, I can't see what it asked for (if I get Fiddler to decrypt the HTTPS traffic, the phone drops the request instantly). Anyone know a way to decrypt the HTTPS traffic to and from MS services?
[Windows Phone 8 Development and Hacking] compu829:
that's cuz we need the offerID for the fiddler script. (I hope).

The HTTPS://traffic is the call it makes to the license server to actually get the license. If fiddler is allowed to decrypt https traffic, the request will fail because we don't have the certificate that is baked into the Windows Phone app store on our PCs to auth to it. I am guessing it is still failing here because we are using an invalid offer id

Also, what country is your device registered as? I keep getting the error "this item isn't available from the Store in your region."
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
It's a middle of the night in Moscow. I'll post any provxml you want from ativ s rom next morning. Do you need provxml that installs diagnosis?
[Windows Phone 8 Development and Hacking] da1stprince:
This is exciting news..i love this dev community!
[Windows Phone 8 Development and Hacking] ultrashot:
exactly
[Windows Phone 8 Development and Hacking] compu829:
yes. Sorry for bothering you so late. it's 6PM here in the Eastern US! :P
[Windows Phone 8 Development and Hacking] mrZoSo:
Awesome! Awesome! This is great stuff here!! Thanks to all!!!

Hope this will be possible on the Nokias' soon,,, especially the 928 :D
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Well, that set off a firestorm! I'm sorry I was incommunicado so much of the day; work, ya know.

Anyhow, here's the provxml (and the license, for good measure) from my phone. They're in \Windows\System32 (\windows\system32\provisioning for the provxml).

I'm going to move this over to a new thread...

By the way, the value I used for MaxUnsignedApp (10003) is completley arbitrary; if this is like WP7, it just needs to be at least 300.
[Windows Phone 8 Development and Hacking] cpuguy:
My country is set to Canada... To clarify, the only way I got it to "download" was by intercepting a request for an app in the store (I click on one I know my device supports) and changing the request GUID and "deviceId" in Fiddler. Doing so loaded up the application page with the name of that particular app but with the details of the "Diagnostic" app. I could then click on "Install" and it would download but not install...
[Windows Phone 8 Development and Hacking] jacano:
I'm not completely sure about this but maybe the oem drivers that are used by the Diagnosis Samsumg App are incompatible for other devices different from Samsung's. ultrashot asked the same.

Besides trying to install the Diagnosis App from the store it would be great to get the decrypted Diagnosis Samsumg App xap (any interop unlocked Samsung ATIV owner could provide this xap to us) to have a look and see how it really works.
[Windows Phone 8 Development and Hacking] toywlf:
You are the man!!! Just heard about this on wphckr. Can't wait to try in a few hrs.!
[Windows Phone 8 Development and Hacking] GoodDayToDie:
The error in question is due to the including of ID_CAP_INTEROPSERVICES (more specifically, it's due to the "interop-lock" which is what "interop-unlock" was invented to defeat). However, even if you removed interopservices, the app would still fail to deploy on account of the high-privilege capabilities it requires... unless the phone is interop-unlocked.
[Windows Phone 8 Development and Hacking] compu829:
that error means your phone isn't interop unlocked, that's all...

I have everything crafted up, but something seems weird with my phone post-GDR2...when I have fiddler off or on, random apps wont download from the store complaining that "This item isn't available from the Store in your region."

edit:

I think they have gotten wise to the proxy trick for those of us lucky enough to have GDR2...This is what I am seeing:

1. Launched app store with fiddler off. Found the Skype page and downloaded Skype...everything went fine...

2. deleted Skype. Turned on fiddler...(ssl decryption is off)

3. reloaded the app store and tried to reinstall Skype. Now it says "This item isn't available from the Store in your region" when I try to install it *sigh*
[Windows Phone 8 Development and Hacking] thuanngotau:
Good news, bro!

Hope to see this on Lumias too.
[Windows Phone 8 Development and Hacking] Zealson:
how about LUMIA 920,I really hope it on my nokia WP
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
I knew I picked the right Windows Phone. Samsung isn't so onboard with Windows Phone so this wouldn't be patched easily. If the Lumias get interop, most likely the exploit will be removed (Like the Lumia 800 incident where an exploit for the Network Setup app was found but the app was unpublished within a few hours). Or if this happens after Microsoft's purchase of Nokia is complete, Microsoft may take this matter into their own hands instead of OEMs
[Windows Phone 8 Development and Hacking] ryotgz:
How are you going about unencrypting the xap files? I'd like to decompile these and take a peek as well.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Decrypting XAPs has not been done yet. We can repack them if we have access to the file system like Windows Phone Device Manager or something.
[Windows Phone 8 Development and Hacking] djadry:
that would be interesting...
[Windows Phone 8 Development and Hacking] jacano:
random thoughts

Has anyone tried to install the WP8Diag.xap as a Company app. You need to sign the xap and also install the company cert.

Maybe this installation process will also ignore the privileged capabilities on the manifest as we suppose the marketplace app installation process does...

Do any of you know how the SD card xap installation process works? It could be similar to the company app installation so I don't expect this to be a promising way.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Distributing Company apps is really hard and expensive. If it wasn't, we would've used this method a long time ago
[Windows Phone 8 Development and Hacking] snickler:
We aren't unencrypting these files, they are taken from the ROMs. The XAPs are ONLY encrypted when coming from the store.. the preinstalled ones are just normal xaps.
[Windows Phone 8 Development and Hacking] jacano:
It's not that hard, we just need to buy a Symantec Enterprise Mobile Code Signing Certificate for $299, we get from Symantec website our custom code signing CA cert and private key pair, them install our CA on the phone, sign the xap with the private key and see if it works.

Anyway, are you guys working on any interop unlock hack for lumias? I would like to help you. I think nokia has also a locked diagnostic app, when you dial ##634# it appears.

Do you know how can I obtain a dump of a lumia 920 OS to have a look at the diagnostic xap to see if we can open hidden pages using the Toast Notification hack?

Autoreply: http://xdaforums.com/showthread.php?t=2066903

Here is every hidden screen we can reach from the dial:

dictionary.Add("634", "/Regulatory;component/ColorVariantPage.xaml");
dictionary.Add("3282", "/FTDComponent;component/Views/MainPage.xaml");
dictionary.Add("778", "/ProductSupportTool;component/MainPage.xaml");
dictionary.Add("4678255", "/SilentInstallerComponent;component/MainPage.xaml");
dictionary.Add("07", "/Regulatory;component/MainPage.xaml");
dictionary.Add("7820", "/SimUnlockComponent;component/MainPage.xaml");

##number#

Nothing interesting here... :(
[Windows Phone 8 Development and Hacking] GoodDayToDie:
By default, company apps have tight permission restrictions, equivalent to those of standard third-party apps. They aren't actually granted much in the way of special access.

I've been doing a lot of poking at this stuff recently. Take a look in HKLM\SOFTWARE\Microsoft\SecurityManager (you can use my native access webserver; it's all readable even though you need to switch to a Samsung app to write). It's possible to change the relevant authorization rules in SOFTWARE\Microsoft\SecurityManager\AuthorizationRules\Capability\CAPABILITY_RULE_ENTERPRISE_APPLICATIONS - in fact, I did this for CAPABILITY_RULE_ISV_DEVELOPER_UNLOCK, and I think this means I will now retain my interop-unlock even if my MaxUnsignedApp value gets reset - but the highest-level capability class is CAPABILITY_CLASS_FIRST_PARTY_APPLICATIONS and even that one is missing a lot of stuff I'd really like to use. I can add additional capabilities to a class in theory, but it requires the ability to writing multi-strings. We don't have that, so far as I can tell. :(
[Windows Phone 8 Development and Hacking] o2neouzr:
used fiddler and got the app to show up with the install button enabled. unfortunately,when I click install, it tells me this app is not available in your region. I did change true in the xml return for all the isavailable. my region is set to u.s,and I tried a bunch of others. I also got it to show as compatible from my sd card,but that also is going me an error when trying to install.

yeah. search for the gdr2 nokia rom, extract and you should get an FFU file. then download this

http://xdaforums.com/showthread.php?p=35908597

it will mount the ffu as a disk image,and you have access to all the files. you need to use ida pro 6 to disassemble the binaries properly. the free version works fine.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
After you get the app to show up in the store, switch back to the WiFi settings page (*switch back*, do *not* close the Store!) and disable the proxy. The store browsing functionality doesn't use certificate pinning, but application installation does. Therefore, you need to be not going through the proxy at the time of installation.
[Windows Phone 8 Development and Hacking] o2neouzr:
tried that already,same error
[Windows Phone 8 Development and Hacking] Gh0s7_Dj:
I think that there's no way to get that app now as it has been removed from the store.

I was able to let the download start, but it ends up in a 8000ffff error which means:

"Problem

This error may occur when an app has been removed from Store and no longer available to be installed or updated.

This error may also occur when you try to restore a downloaded or preinstalled app that may not be restorable from the Windows Phone Store. "

This should mean that the server is not giving the decrypted xap file and so the phone can't install the app.

Any idea?
[Windows Phone 8 Development and Hacking] arizz96:
Fiddler Rules

Can you post Fiddler rules that you used?
[Windows Phone 8 Development and Hacking] compu829:
sssooo...In order for the app install to complete successfully, it needs the correct offer id and media instance ID. Assuming I am giving it the correct one, the store returns an error saying "this app is not available in your region". If I change the offer ID to something else that is available, I can start the download, but it wont install (bc of the offer id, I'm assuming)

something else interesting...if you mess around with "CC" the store gets "funky"maybe if we figure out which "CC" this app is supposed to be valid in, we should be good to go! I wonder if there are "private" CCs that test or pre-production devices use?
[Windows Phone 8 Development and Hacking] Gh0s7_Dj:
I used Burp Proxy so I don't have any Fiddler rule.

Here's what I did:

1) Replace "NOKIA" with "SAMSUNG" in the request's header

2) Replace "<visibilityStatus>Unpublished</visibilityStatus>" with "<visibilityStatus>Live</visibilityStatus>" in the response's body (I don't if this may be skipped)

Now, for the next step, you need to intercept the response generated from an available app.

So just open the market while you're capturing the traffic, load an app to get the server's response and take everything that's between "<offers>" and "</offers>" (so you need to get the content of the "offer" tag)

3) Insert the content of the "offer" tag between" </tags>" and "<taxString>" in the response body.

That's all but, as I said, you still won't be able to complete the setup.

Now I've got the app in my list but it says that there's a problem with the download. If I'm not wrong, the app can't be downloaded even if using a Samsung device!

EDIT:

I guess you're right.

I think that the app just got pulled, or maybe is just not compatible with Nokia phones and it won't install.

(I understand the five minutes limit to prevent spam, but why does it work even when I'm just editing??)
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Try to install it from SD. If your phone has it.
[Windows Phone 8 Development and Hacking] Gh0s7_Dj:
It doesn't work.

The XAP file is not even shown in the "SD" section of the store.
[Windows Phone 8 Development and Hacking] awesome71717:
What is the offerid for diagnosis?
[Windows Phone 8 Development and Hacking] awesome71717:
/offtopic Double posts ftw.

Ok, so I think I've exhausted the xaps I have extracted. The one I like the most is the TrustedInstaller (Silent), but I don't know how to use it. Maybe cpuguy or someone else would be able to write something to utilize it.

Here are my screenshots:

TrustedInstaller (Silent)

EPST Edit Dialog:

Launcher. (Launches. Does nothing. Black screen. Maybe used to launch apps?)

Field Test Menu: (It seems that Nokia has stripped it. Settings menu works, but the changes do not stay. I did not include the warning page.)

I don't know what to look through next.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Well, if you want a tip, I actually worked from the opposite direction:

Started by finding the native code to write to the registry. Then I found everything which called that code. I checked the parameters in each case to see if we could edit them. When I found one that used user-controllable strings, all I needed was a way to get there.
[Windows Phone 8 Development and Hacking] awesome71717:
Hmm a method that has interop capabilities and user definable strings.... But what about the Lua? Drive is an app with such capabilities I believe.

Lua code allows for file execution: os.execute("c:\\temp\\program.exe")

What program should I try to run?

I must sleep for now though.
[Windows Phone 8 Development and Hacking] tonbonz:
[MENTION=2854207]snickler[/MENTION] [MENTION=3529492]GoodDayToDie[/MENTION] In awesome71717's post above in the screenshot for TrustedInstaller; what exactly is Multivariant? There is a xaml in my dump files that shows how to call this only the component was FUELib and it wasn't the MainPage.xaml. Sorry not at my PC and don't recall the exact path. When run I just got an update successful and option to close. It seemed to reference a manifest somewhere in commonfiles/OEM/Nokia. Didn't have much time to investigate though.
[Windows Phone 8 Development and Hacking] herg62123:
Hey if any of you are looking for the download link for the Diagnosis App - I have placed it in my Samsung App Update App.

If interested the download link is found on this XDA Thread - http://xdaforums.com/showthread.php?t=2436448
[Windows Phone 8 Development and Hacking] :
The diagnosis app doesent work on lumias and htcs...try to edit The source code and try to port in on to The other wp8 phone doesent make any sense because The diagnosis app require The interop-Service so a sideload would fail
[Windows Phone 8 Development and Hacking] Gh0s7_Dj:
I don't know if this may work or not, but I saw a link to windows command prompt in a downloaded rom and this points to

so you should try to run it and see what happens.

FYI, the link was found in
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
IMHO, IE is much more suitable in this situation.
[Windows Phone 8 Development and Hacking] ultrashot:
yeah, cmd probably doesn't trigger chrome (doesn't create a page visible in WP HW Compositor )
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Yes, without UI you can't say if it worked.
[Windows Phone 8 Development and Hacking] awesome71717:
Yeah, I think I will try to launch ie later if no one else gets to it.

[MENTION=1414420]Gh0s7_Dj[/MENTION]

Here is the screenshot of the Nokia Care app if you wanted to try launching some of the pages:

I am going to be on and off randomly. Schoolwork. :silly:
[Windows Phone 8 Development and Hacking] GoodDayToDie:
cmd.exe doesn't exist on System32 (on the phone) normally. You would have to extract it from the WIM file instead (which I think is just tools for updating the OS).

If you want something that you can try launching, there's \Windows\System32\FeedbackCPL.exe...
[Windows Phone 8 Development and Hacking] Sunius1:
Actually, you could redirect its output to a textfile and read it afterwards. Trying to execute .bat files gives "File not found" error, which kind of is expected, as cmd.exe is nowhere to be found on consumer devices.

Anyway, even if we did have cmd.exe, what would we achieve? Created processes inherit permissions, so it couldn't do anything more than we can do already using win32 API.
[Windows Phone 8 Development and Hacking] awesome71717:
Easy way to launch installer:

##4678255#

I guess it was used by Nokia often. Still have no idea how it works.

Filtering through the registry it seems that FUELib has registry operations, but there are no user-editable areas.

EDIT: Apparently there are NonImmediate codes for dialer:

##782# is listed as one under "PersoUnlockCode"

I called it and was sent back to recent calls. Works, but don't know what I unlocked.
[Windows Phone 8 Development and Hacking] thals1992:
Check my diagnostic apps thread. Apparently another user had done a quite a bit of research of what goes on.

Sent from my Spark_W (HTC 7 Trophy) using the OFFICIAL Tapatalk app
[Windows Phone 8 Development and Hacking] awesome71717:
It is quite tedious to type in commands so I am streamlining the app to what we already know as well as adding other features. :silly:

Of course I am not changing credentials in the app, this is still cpuguy's work.
[Windows Phone 8 Development and Hacking] :
hey can somebody please help me

i have found in the nokia music app a debug page but how can i open it

what i should type in the native toast launcher

app://(id)/_default#/...(here is my problem);component/....
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Go look in the decompilation of the page's code. In the InitializeComponent function, there will be a line that decompiles something like this (I'm using a different decompiler than you, but it'll be similar):

Application.LoadComponent(this, new Uri("/WP8Diag;component/7_ETC/GCF_DM.xaml", UriKind.Relative));

That string (the one passed to the URI constructor) is what you are missing.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
What is DLL name?
[Windows Phone 8 Development and Hacking] :
I found it...dll Name is Nokia.Media.MusicClient.dll

When i launch The URI...Nokia Music App crashes...

Can somebody with an Nokia please try it

URI:

app://f5874252-1f04-4c3f-a335-4fa3b7b85329/_default#/Nokia.Media.MusicClient;component/Pages/Debugging/DebugMenuPage.xaml
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
It's a hiden page, it may not work properly.