[Windows Phone 8 Development and Hacking] jacano:
I have already tried that without results :(

tl;dr

I have dumped the lastest amber update for my lumia 920 using ImgMount.

Inside file.mnt\PROGRAMS\CommonFiles\Xaps you have some xap the OS install when you configure your phone for the first time.

and also here file.mnt\PROGRAMS\CommonFiles\OEM\Public\PreloadedApps\tier3Apps

I copied all these xap's to other directory, opened them one by one to see their manifest and declared capabilities. If I find someone with high ones I drag and drop all its dlls to ILSpy, remove the native dll's and start by looking at the Resource section of the remaining dll's, if they don't have this section, removed. Then I open the MODULENAME.g.resources section of the remaining ones to see all xaml pages we could navigate to by using the toast hack.

If during the inspection I find any promising page, for example (/menu/debug/hotchicks.xaml) I open it on my phone to really know what we can do with it.

So, imagine I was inspecting the preinstalled Nokia Drive app (c843585440544fb0a4cadf1bb696839a.xap) and I have found a promising page inside and want to open it.

First I need the AppID of this xap, get it from WMAppManifest.xml, <App xmlns="" ProductID="GUID".... by the way I also have a look inside this file at it's declared capabilities.

This is my candidate page to inspect:

It's inside the Drive.dll, the module name of this dll is Drive.

In order to open it, I need first to install the Native Toast Notification Launcher to my Lumia 920 -> http://xdaforums.com/showthread.php?t=2398275

Them edit the uri inside the app like this:

app://GUID/_default#/MODULENAME;component/pages/debug/debugmenupage.xaml

So in this case:

app://31bbc68c-503e-4561-8d85-a294d54df06f/_default#/Drive;component/pages/debug/debugmenupage.xaml

Tap on the toast and start looking around to see if this page allows us to modify the OS filesystem or registry.

Notice that if you made any filesystem modification you are in fact doing them with the capabilities of the app you set in the uri. So that's the trick here.

Also notice that with this uri notation we could open xaml pages from whatever dll inside the xap we want.

I did all this procedure by hand with the xap's I mentioned earlier and couldn't find anything interesting.

Right know I have two ideas to keep working:

We can automatize this procedure, get all xap's we could install in our lumias and particulary the ones we thought could contain native code and high privs, decrypt them somehow and see if we find hidden xaml gems like the samsumg diagnosis registry page :)

I think I can do a program that outputs all the xaml pages from a list of managed dlls, then inspect all them to see good candidates and try.

We also have to consider that the default xap's that get installed when we updated to amber may had change due to marketplace updates. So we need the last version to inpect their xaml pages. Any jailbreaked Samsumg owner could provide us this xaps.

The other idea is to iterate though every reachable file inside the \Windows and \Windows\system dir's and try to write on them, I think I can do this with the wp8nativeaccess project from GoodDayToDie. Them list the ones we have write access to, see if we hit any dll or exe.

If there are any executable file with high priv, them will need to figure out how to execute it by using our phone as a normal user. See what functions get call when we do these normal actions (imagine we can write inside the alarm app dll, and we know that when we set a new alarm, the SetNewAlarm() function gets call inside this dll), edit the arm code to redirect the flow to a place where we wrote our jailbreak arm code before.

You know, set a hook inside the SetNewAlarm() and blah blah. This is only possible if wp8 dll's aren't signed with authenticode or other stuff.

Maybe GoodDayToDie could help here.

In the case we hit any writtable file, we could think how to modify it to write in other places as long as we suppose this file is used by any process with high privs.

We need to automate our hacking process!!