yashsingh1/xdaforums huggingface dataset:
[Windows Phone 8 Development and Hacking] jessenic:
Windowbreak was for WP7 and used completely different kind of method for unlocking.
[Windows Phone 8 Development and Hacking] ceesheim:
@sireangelus. where is that phone !!!!

hmmmm I am starting to feel ripped off by [MENTION=4409964]sireangelus[/MENTION].

still no phone , we all pay instandly ( me 40 euro).

ist alot bla bla bla :( but no phone.
[Windows Phone 8 Development and Hacking] lomax50:
I refuse to believe that this could have happened, but facts are stubborn
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
This is way too long a response time. The fact that he suddenly became inactive proves the fact that we may have been scammed.

This is no longer a suggestion. You SHOULD contact the proper authorities.

We have all necessary proof and sireangelus attempted to sell the device before so I won't be surprised if he already sold it to someone else and took the phone for free.

I still cannot believe this happened.

If there's anything I can help with, I'm always here.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Not sure if necessary but I found [MENTION=4409964]sireangelus[/MENTION] social network profiles. For the sake of privacy I will not post it here as I would give him another week to respond and send the device.
[Windows Phone 8 Development and Hacking] sireangelus:
sorry for the long wait. I truly am- life happened.I'm requesting pickup today, so i should be able to post a tracking code tonight or tomorrow, with the effective shipping being done by tomorrow or the they after.
[Windows Phone 8 Development and Hacking] snickler:
Please keep us, especially [MENTION=3254428]Heathcliff74[/MENTION], up to date with the progress of this. We'd really appreciate it man. :)
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
What a beautiful design on my ATIV S :crying::crying::crying:

Goodnight, my sweet ATIV.

6 Aug 2013 - 9 Nov 2013 :crying:
[Windows Phone 8 Development and Hacking] lomax50:
It is unfortunate. I'm sorry. It is definitely dead?

:crying:
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Ouch, sorry, that sucks. Cracked screen is usually still usable though, and even if it's not, they can usually be replaced (may not be cheap but probably costs less than a new phone). Not sure why you posted this here though, especially with gigantic images... kinda stuffs up the thread.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Replacement screen costs $299. I paid $350 for my ATIV S. Pretty useless to get my screen replaced. Gonna use my Lumia 920 in the meantime while I think of a solution. In the meantime, I'll be doing some research on the Lumia 920, see if I can find any exploits.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Oh, wow that sucks. Usually the glass is dirt cheap; is the digitizer broken too? Or maybe it has something to do with being AMOLED? Anyhow, good call on the Lumias. I really feel bad sometimes for not focusing on other OEMs more, but I enjoy finding things where I can actually try stuff out. Like, I think I may have found a way around the code signing. Now I just need to

A) produce a useful WP8 executable that isn't a sandboxed app

B) set it up to work with the signatures-don't-matter thing

C) pair that with a way to launch it with more-than-app privileges

and see what happens! If *all* goes well, it's Root; I'd be able to do anything, even (theoretically) install drivers and replace system libraries. Heathcliff74 supposedly already has a pretty functional Full Unlock, but it needs replacement of system binaries.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Digitizer is buggy with it detecting touches but reacts differently. Glass is $15 but the AMOLED + Glass is $299 :crying: it will cost me nearly the price of the phone so I chose not to repair it unless I find a good deal on the AMOLED.

I want to see what I am able to do with the Preview for Developers app.
[Windows Phone 8 Development and Hacking] oZed:
If you are looking for something useful why don't you try and enable user-mode access to the cycle counter register. It would literally be one line of code and could easily tell you if you were successful from anywhere as it isn't enabled by default (at least that was the case with my 920 on GDR3).
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Oh, I've got plenty of test avenues. What I need is a good test *program*... and a way to try launching it. Well, and ideally a way to write arbitrary binary-type reg values, because I'm hesitant to write a DWORD when I might need to be not-a-DWORD later and can't set it back without a hard reset.
[Windows Phone 8 Development and Hacking] chief:
oohhh s**t, i see great work is being done out here.

i just can't wait if you find a way to unlock Lumia 920 ;)
[Windows Phone 8 Development and Hacking] sireangelus:
The phone is on his way. I'm very sorry for all the waiting.
[Windows Phone 8 Development and Hacking] Reflexdarky:
wayyyyyyyyy not before time :good:
[Windows Phone 8 Development and Hacking] sireangelus:
heatcliff said he recieved the phone.
[Windows Phone 8 Development and Hacking] Heathcliff74:
Hi all,

Sorry for this off-topic message. But everybody who concerns this, follows this thread. So I'll drop it here.

Today something amazing happened. I received a package from Italy. It was the long-awaited Samsung Ativ-S developer device. Many people donated money so we could buy a new phone for [MENTION=4409964]sireangelus[/MENTION] and he could send his phone to me. Within a few days money was collected, new device bought and sent to [MENTION=4409964]sireangelus[/MENTION]. After that, silence... I sent several PM's to him often no response. Or messages of him trying to be funny or whatever. But nothing was sent. I'm not easily pissed off, but last week, almost 2 months after he promised to send the phone, I got really angry and I sent him a couple of whatsapp messages to convince him he should keep his promise and don't be an @$$. Today I received the package. :)

This night I had some time to check it out. Conclusion: it is really a developer device and very valuable for research! Yay!

I already had an incident with it. I connected the device in mass-storage mode to my laptop, while I already had a WP8 virtual disk mounted. Windows 8 decided that all partitions needed to be unique and it actually changed the entries in the partition table of the Samsung (!!!) It couldn't boot any more. Luckily, I could still use mass-storage, so I could still inspect the device. I found that the partition table was corrupted and I could manually fix it. Pfew! All is working well again and I can further dissect it.

Thanks to [MENTION=4409964]sireangelus[/MENTION] for finally sending the phone. I advise you to act more pertinent the next time you sell something, in order to avoid that people are getting really pissed off at you.

Thanks to all guys who donated to make this possible. I hope to bring you new hacks soon!!

Ciao,

Heathcliff74
[Windows Phone 8 Development and Hacking] :
Hopefully you can find a way to get all wp8 phones interop-unlocked!
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
So my ATIV S shattered, but the AMOLED was still fine, so I decided to take liberty to my own hands after I started going crazy because I'm not used to the 920.

Bought a replacement glass (like $15) and took 3 hours, separating the broken glass from the AMOLED. After 3 long hours, I separated the glass without breaking the AMOLED underneath. Bought a home button flex cable (broke it accidentally) and the adhesive. Now waiting for it to arrive.

For the 920, I've always been interested in the uninstall mechanism. I want to see if I can change the registry for some files that edit registry, deploy it, uninstall but somehow the file still stays there, then install and somehow make the file unreplaceable that when its executed, it interop unlocks. Still looking at what I can do.
[Windows Phone 8 Development and Hacking] Topogigi:
Something unexpected happened to me yesterday.

I upgraded to the official GDR3 with the new samsung firmware update (it's enough to set 000-AT in the "Region" field within SamWP8 tools to receive the upgrade).

My phone now reports the new firmware (2424.13.10.1) and the new OS (8.0.10.517.150) and I am still interop-unlocked with all capabilities enabled (tried to re-deploy pdf to office with success).

The weird thing is that I lost the capability of reading/writing the registry at all. All my settings are preserved (3 rows of tile in the home screen, etc), but I cannot change anything anymore.

Be careful while upgrading to the official GDR3: my guess is that Samsung introduced a patch somewhere, preventing any registry writing with known methods.

Before you ask me: yes, I've already tried to repeat the unlock procedure from the beginning. No dice. :)
[Windows Phone 8 Development and Hacking] lordmaxey:
Hm... what about hardresetting and trying the interop procedure again?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I'll test it. I don't think they fixed bug in flasher ;)
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Don't update to official GDR3!

1) SamWP8 Tools aren't working.

2) Diagnosis has Registry page no more.

I'm digging deeper. Some more things are need to be tested.
[Windows Phone 8 Development and Hacking] ngame:
Interop Unlock will miss after update ?

if it doesn't I think we can deploy old version of Diagnosis ! Isn't it ?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I don't think it'll work, as my SamWP8 Tools don't.
[Windows Phone 8 Development and Hacking] Turkishflavor:
worst guide ever.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Well sorry then. -W_O_L_F- is working his damnedest to try to see what Samsung did since they patched the Interop Unlock security hole. The least you could do is give the developers some support.

---------- Post added at 04:30 AM ---------- Previous post was at 04:28 AM ----------

Hmm... Too bad you didn't capture the update files. I would really want to see what Sammy did in their firmware update
[Windows Phone 8 Development and Hacking] Heathcliff74:
Worst comment ever
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Flashing GDR1 works.

Flashing unlock to GDR3 doesn't work. GDR3 wp8 file should save this issue.

View attachment 2394310
[Windows Phone 8 Development and Hacking] greenboxal:
Can you send me GPT.bin from this SMD so I can see the differences?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Here it is))
[Windows Phone 8 Development and Hacking] greenboxal:
Sure it's from the one that gave that error? It's same partition table of working SMDs and that error should only be reported by the download firmware when the GPT mismatches from the one in the eMMC. Kinda weird.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
It's from GDR2. I can't extract it from the phone (GDR3).
[Windows Phone 8 Development and Hacking] greenboxal:
Oh, I compared against that GDR2 ROM, I wanted the one from the .wp8 file that caused that error(mismatch partition data).
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
This GPT caused error, cause GDR3 (after update) has different GPT from GDR2 and GDR1.
[Windows Phone 8 Development and Hacking] marass82:
Captured files from the official update samsung GDR3.

This is an update from 8.0.10512.142 to 8.0.10517.150, + Samsung firmware update.
[Windows Phone 8 Development and Hacking] radwan020:
Application Deployment tool

what abot this masage when i want install app on my lumia 720 cant open Application Deployment tool
[Windows Phone 8 Development and Hacking] Topogigi:
install vs2012 update 3

---------- Post added at 10:45 AM ---------- Previous post was at 10:00 AM ----------

So I will lose interop unlock forever? Not a smart move, mate...

As a matter of fact, I still have my phone interop-unlocked, as the registry is fully preserved during upgrade, as I said in my previous post.

And, the registry page is still there in the diagnosis app (if you call it from the toast notification launcher, it comes out, but you can't read or write the registry through it).
[Windows Phone 8 Development and Hacking] lordmaxey:
I'm sorry i didn't want to offend you. :)

I just thought maybe there would be an error in the update to the official gdr3 version, and hardresetting + repeating the unlock procedure might work.

But i haven't read wolf's comment yet, that samsung modified the diagnosis app.

Hope the guys are getting it working on official gdr3!! :)

Hm... isn't there any way to get hands on the gdr3 pre release update?

So we could flash to gdr3 and update to gdr3 pre release manually...
[Windows Phone 8 Development and Hacking] Topogigi:
The problem does not pertain the MS GDR3 part of the upgrade, but the Samsung specific one. And the GDR3 pre release does not contain a line of Samsung specific code...
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
Attached is the updated WP8Diag.xap file + misc related files included in the GDR3 update.

Credits to [MENTION=2209346]marass82[/MENTION] for the update links. You rock :D

-W_O_L_F- [MENTION=3254428]Heathcliff74[/MENTION] [MENTION=3529492]GoodDayToDie[/MENTION] you guys may wanna see this.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
And what? I've already downloaded it with Native Access Web Server.

As registry functions aren't used anywhere but registryoperationscheck page, I think those functions just got blocked.
[Windows Phone 8 Development and Hacking] Topogigi:
Yes, they simply made the registry page unoperative, just like some already non operative pages into the diagnostic app. The RPC server is also part of the upgrade: wonder if they patched it too.
[Windows Phone 8 Development and Hacking] AlvinPhilemon:
huh. Are you still able to deploy Interop apps? How about a native registry editor that does not use Samsung's diagnosis app?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I don't use it, but think it works.
[Windows Phone 8 Development and Hacking] ngame:
if you have interop unlock now it's not bad to try old diagnosis from GDR2 and again test .
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
It doesn't deploy. Signature must be removed first.
[Windows Phone 8 Development and Hacking] contable:
May I help to remove the signature ?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I just have no time to test. I found something terribly interesting.
[Windows Phone 8 Development and Hacking] contable:
Anyway I will remove the signature and store the diag app on my laptop.

Who knows if I will need it again...

Let me know if I can support you in any way.
[Windows Phone 8 Development and Hacking] contable:
Just for the records: attached the WP8 Diag App without signature.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I replaced old dll with dll from new Diagnosis in SamWP8. Nothing happend, still doesn't work. BUT DevUpdates switch works fine. Samsung just fixed RPC functions.

I have an idea, what to do to make them work on GDR3.
[Windows Phone 8 Development and Hacking] contable:
So far I didn´t look at the DevUpdates switch but I´m sure that they can´t fix all apps with registry access...
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Pretty sure all that happened is that Samsung restricted the locations the RPC server would write to the registry. This is the same change that HTC made that broken interop-lock with their official Mango update on WP7, where they updated their drivers after the official MS bits came out, and people who took the HTC update at the same time they took Mango (which was purely Microsoft code, just like GDR3 is) lost the ability to unlock.

I suspect it's a restriction, not a complete removal of the ability to use the RPCComponent registry functions, because there are actually a number of other places in the Diagnosis app (and I think some other ones, though I may be misremembering) that do registry access. The check page that contains the full editor is the only one that supports writing to arbitrary paths, though; all the others write to specific locations that could be whitelisted.

Has anybody tried using full FS access to downgrade the driver/RPC server? It might not work - version checks, signature updates, the work of a different component that we don't catch - but it's worth a shot. Of course, that won't help those who get the update without enabling the full access first. I'll make a note in the first post!

Things like the DevUpdates switch and such will work fine, of course. That's pure MS code; not a bit of it depends on any Samsung component at all. Write access to the DeviceTargetingInfo key is included in one of the capabilities that OEMs (and Microsoft, of course; anybody more privileged than "third party" really) can use. They can call the registry APIs directly - just like my NativeRegistry class - and it will work for that specific key because of that capability in the manifest.
[Windows Phone 8 Development and Hacking] :
Downgrade?

is there any way to downgrade the firmware to the version where the Interop Unlock was possible?

I updated to retail GDR3 and made a softreset. Pure stupidity, I know.

Can't I just flash a GDR2 ROM to make this work again?
[Windows Phone 8 Development and Hacking] marass82:
Download Mode is not blocked, so normally flashing to GDR2.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Flashing GDR1 and GDR2 works.

Flashing custom CSC don't.

Flashing CSC only isn't tested yet.

We need GDR3 ROM.
[Windows Phone 8 Development and Hacking] greenboxal:
Was looking at this post and saw an weird thing, I flashed GDR2 then upgrade to GDR3. I have Interop Unlock and I use WOLF's custom CSC. Also my RPC component works(well, the parts I use).

Which are the limitations of GDR3 FCRouter?

edit:

Also, someone knows why FC_CreateProcess don't work? Always returns 0

edit 2:

Nothing changed in the RPC server between GDR2 and GDR3 with Samsung firmware update, if the restriction is with Samsung files, should be in the RPC client or in RPC server user privileges.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
Check FCRouterProxy and CSC Manager

One russian guy also reports that rpc works on final GDR3.
[Windows Phone 8 Development and Hacking] greenboxal:
FCRouterProxy is the same too, I didn't check CSC Manager
[Windows Phone 8 Development and Hacking] Topogigi:
Did you compare with this one?

http://ds.download.windowsupdate.co..._b13bd7f544e7dc91c0bc32bcf32cccc3b9bf313f.cab

Why upgrading this component if it is the same as the previous one?
[Windows Phone 8 Development and Hacking] greenboxal:
Weird, my phone show as I have samsumg firmware update, but the files didn't change. I'll see now where the locks are then.

edit:

Again, there isn't any piece of code in FCRouter or FCRouterProxy that filter calls to registry functions.

Also, I noted that in the RPCServer there a lot more of registry functions than the ones available through CRPCComponent, there is some way to generate Ndr stubs for them?

I never used Win32 RPC in depth but it doesn't seem hard.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
It would be extremely helpful if we could call those alternative RPC Server registry calls. The ones in the PRC Component library are very limited; no ability to create new keys, no ability to set registry values of types other than DWORD or String. I've managed to work around those restrictions for the most part, but until I get full "root" apps working (a process, incidentally, which would be aided by such ability), I can't do a lot of cool stuff that I'd like to enable because it requires writing other registry types.
[Windows Phone 8 Development and Hacking] greenboxal:
Know anything on why FC_CreateProcess doesn't work? In theory it should spawn under LocalSystem and have full privileges.

I thought that could be because I tried to use an unsigned executable but I can't launch signed binaries either. Any clue?
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
In addition to what is in RPCComponent there are some more in FCRouter:

1) add DWORD

2) set MultiString (but no get :( )

3) enum keys and values

If we manage how to call them, it'll be great!
[Windows Phone 8 Development and Hacking] greenboxal:
In theory we just the need to create a compatible MIDL definition for those functions and interfaces, but I don't know a thing on Win32 RPC.

Edit:

I think I found what locks RPC server on the new samsung firmware:

HKLM\SYSTEM\State\Samsung\Phone\SFMode should be 1

This value is loaded at RPC server initialization at 0x1001DA70

After, this value is checked on CreateContext(0x100038DC), this function also checks developer unlock status.

Almost all functions seems to be locked using this.

About the RPC functions, unfortunately those extra functions on FCRouterProxy aren't exported through RPC calls, although unlocking SFMode could probably let FC_CreateProcess works, if so, we could run our first process on LocalSystem(root!).

Edit 2:

Now it looks like a problem, SFMode entry is created by RCD service at system startup, it value doesn't persist on the registry. Also, FCRouter caches it's value on startup and we can't set any process to run before it(I think).

RCD service only enables SFMode if the IMSI is 999999999999999(Factory SIM) and there is no IMEI set yet.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Wow, nice work! Sorry I haven't been able to contribute much (busy with work, and travel for work, so I'm away from my dev machine) but it's great to see this kind of research going on

Set multistring is actually a *lot* more useful than Get, since we're a lot more likely to be able to Get just by calling the Win32 registry APIs from a normal app. In any case, it's pseudo-possible with the current string-writing function (the type code and apparent length are wrong, but you can write a string with embedded nulls if you use C++/CX to construct the Platform::String object).

No idea why FC_CreateProcess doesn't work; I haven't really looked into that yet, actually ( tried using it of course, but didn't deeply investigate why it failed). We actually do already have the ability to launch programs as SYSTEM; that's what the Full FS Access hack is, essentially (specifically, it launches an NT service as SYSTEM, but you can specify an arbitrary executable and chamber for any service at all). Getting past signature enforcement is a different trick, one that I'm actively (to the extent possible when working remotely) researching.

If we could gain sufficient privileges to write registry ACLs, we could try making the HKLM\SYSTEM\State\Nokia\Phone registry key read-only, after setting the appropriate value. That wouldn't help people who have already upgraded, but it would allow the rest of us to get back on the retail update path...
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Updated Q&A and list of apps which use these hacks.
[Windows Phone 8 Development and Hacking] greenboxal:
If we could write binary data to registry, we could add a certificate to the trust root, this would work right? I saw that there is a signature db somewhere on factory mode binaries, but it seems to be used by secure boot, so for executable it should use the standard certificate chain

that resides on the registry.

Sadly this will not work if the kernel checks against a specific certificate chain, one dedicated to executable signing, but in this case we could replace the chain and resign all binaries. Of course, if we did this all updates would break, but would give time to exploit the system and patch any code needed.

Edit:

Oh, and how I can launch a process as SYSTEM? I will play with that