[Windows Phone 8 Development and Hacking] GoodDayToDie:
It took us much longer than WP7 did, but the first Interop Unlock hack for WP8 is now available. It's currently limited to SAMSUNG phones, although we're trying to extend it to other phones, of course.

WARNING: Samsung is trying to break this hack! If you take the retail upgrade to GDR3 including the Samsung firmware update, it will not work!

A brief summary, for those unfamiliar with interop-lock: Windows Phone allows a number of high-privilege app capabilities, which can be used to make changes to the OS which are normally not possible for a third-party app. The limitation on whether we can use these capabilities or not is based on what "level" of developer unlock the phone has; standard "ISV" (Independent Software Vendor) dev unlock (max 10 apps or less) is what pretty much everybody gets; OEMs, however, get a special OEM Developer Unlock (300 apps or more) which gives them the ability to use much higher-privilege app capabilities than the standard ISV unlock permits. The name comes from ID_CAP_INTEROPSERVICES, the capability which was most important in WP7. In WP8, however, there are a great many interesting capabilities. Note that Interop-unlock by itself does not enable all of these. However, at least on Samsung phones, it is now possible to enable *all* the capabilities.

Guide for Samsung's ATIV phones:

The instructions are generally well-provided in [MENTION=2734362]-W_O_L_F-[/MENTION] 's app (direct link for updated XAP). You will also need the Diagnosis app, which is included (though hidden) on every Samsung WIndows phone.

The instructions are as follows:

Developer-unlock your phone. You will need the Windows Phone Developer Registration tool for this; it comes with the SDK.

Sideload the helper app using Application Deployment (included with SDK) or WPPT. It does not work to just copy the file to your phone, or similar.

Open the Phone dialer (the built-in one) and dial ##634# to install the Diagnosis app (if you hadn't already). You can exit it afterward.

Run the Interop Unlock Helper app and read the instructions, clicking Next until you get to Step 2.

Click the button to generate the toast notification for your phone's Diagnosis app, then tap on the toast to open the hidden registry editor.

Press-and-hold the Back button, and switch back to the helper app without closing the registry editor. Click Next to go to Step 3 in the helper app.

Copy the provided registry paths and values out of the helper app, use the Back-and-hold switcher to return to Diagnosis, paste the values into the registry editor, and write them.

Don't worry if the app says a write failed! Just hit Read afterward to verify the change.

Repeat the previous steps a few times, hitting Next after each set of instructions, until the Helper app says "Finish".

Once all the registry values are written, congratulations; you are interop-unlocked!

At this point, you probably want to run the EnableAllSideloading hack below.

If you want to enable sideloading even more high-privileged apps, you'll want the following:

Install the BootstrapSamsung app attached to this post. This requires having interop-unlock already, and will not work if you have Samsung's ships-with-GDR3 firmware update unless you unblock RPC.

Run the app once, and ensure it displays a success message. You may then exit and (optionally) remove the app.

Install the EnableAllSideloading app attached to this post. This requires the bootstrap step. However, it is not specific to Samsung (we just can't bootstrap anything else yet).

Run EnableAllSideloading once, and ensure it displays a success message. You may then exit and (optionally) remove the app.

At this point, you will be able to sideload any capability, even the ones used for built-in apps and services. However, there appear to still be restrictions, even with a capability such as ID_CAP_BUILTIN_TCB. Multiple XDA members, including [MENTION=3254428]Heathcliff74[/MENTION] and myself, are working to overcome these restrictions.

It may be necessary to repeat these steps after a phone update.

Capabilities which will be enabled, without further modification, by using interop-unlock:

Note: This list is *just* the ones from Interop-unlock; it does not unclude the ones from EnableAllSideloading.

ID_CAP_CALLMESSAGING_FILTER

ID_CAP_CAMERA

ID_CAP_CELL_API_COMMON

ID_CAP_CELL_API_LOCATION

ID_CAP_CELL_API_OEM_PASSTHROUGH

ID_CAP_CELL_API_UICC

ID_CAP_CELL_API_UICC_LOWLEVEL

ID_CAP_CELL_WNF

ID_CAP_CSP_FOUNDATION

ID_CAP_CSP_MAIL

ID_CAP_CSP_OEM

ID_CAP_CSP_W4_APPLICATION

ID_CAP_CSP_WIFI_HOTSPOT

ID_CAP_DEVICE_MANAGEMENT

ID_CAP_DEVICE_MANAGEMENT_ADMIN

ID_CAP_DEVICE_MANAGEMENT_BOOTSTRAP

ID_CAP_DEVICE_MANAGEMENT_SECURITY_POLICIES

ID_CAP_DU_MIGRATOR_STATUS_OEM

ID_CAP_OEM_DEPLOYMENT

ID_CAP_INTERNET_EXPLORER_FAVORITES

ID_CAP_INTERNET_EXPLORER_SEARCH_PROVIDER_KEYS_HKCU

ID_CAP_INTEROPSERVICES

ID_CAP_KIDZONE_CUSTOMIZATION

ID_CAP_MAP_WRITE

ID_CAP_MEDIALIB_PHOTO_FULL

ID_CAP_NETWORKING_ADMIN

ID_CAP_OEM_ADC

ID_CAP_OEMPUBLICDIRECTORY

ID_CAP_PEOPLE_EXTENSION

ID_CAP_PEOPLE_EXTENSION_IM

ID_CAP_PEOPLE_EXTENSION_MOBILE

ID_CAP_PERSONAL_INFORMATION_IMPORT

ID_CAP_RUNTIME_CONFIG

ID_CAP_SMS_INTERCEPT_AGENT

ID_CAP_SMS_INTERCEPT_RECIPIENT

ID_CAP_SYNC_EXTENSION

ID_CAP_VOICEMAIL

ID_CAP_WALLET_SECUREELEMENT

ID_CAP_WIFI_BASIC

One of the goals of this thread will be to explore what we can do with interop-unlock, and look for ways to achieve full permissions. I think I've found one, but it requires the ability to write registry multi-string values. Basically, if we could add a "superuser" privilege, or enable the use of ID_CAP_BUILTIN_TCB, which already has it, this would allow the creation of "root" apps.

Aside from myself, credit for this hack goes to [MENTION=770625]cpuguy[/MENTION] for the Native Toast Launcher tool which permits accessing otherwise-unreachable code, and [MENTION=2734362]-W_O_L_F-[/MENTION] for helping put the pieces together. I'm not actually certain which one of us achieved the interop-unlock first; we were both working on it. [MENTION=3254428]Heathcliff74[/MENTION] continues to be a help on the quest for full-unlock.

The source code for the apps below is posted at http://xdaforums.com/showpost.php?p=45606584&postcount=88