yashsingh1/xdaforums huggingface dataset:
[Windows Phone 8 General] lordmaxey:
Sorry for missunderstanding, i do not have riffbox, i have ATF.

But i don't know if atf jtag can "only" write boot partitions or if it can also write "data/system/OS" partition.

Is it save to turn on the mobile while i have wires soldered to the mainboard? :D

Well i'll see if i get any "short circuits" :D

The best thing would be, if we would know something like this:

- file 1 to partition X

- file 2 to partition Y

- file 3 to partition Z

etc. etc.

But i know nothing from this mandarin text :D

I'll try to "open" the ATF JTAG .afp files in a readable way.

Maybe a clever guy can modify the bootloader which should be in those files? http://174.120.45.27/big_boot/
[Windows Phone 8 General] tfBullet:
Well shure, you'll have to make shure you dont shortcircuit anything ;D

Maybe you could use hotglue to secure the wires in place :)

It should be, JTAG is not active until Test Mode Select Input gets set - also its meant to be debugging/testing devices,

how would you do that if you cant run the unit while JTAG is on?

First it would be nice to see what partitions & files we can access (read/write) and then we can think of what we can do with that

if we could write on secureboot (partition?) for example, it would be a piece of cake to patch it and then modify the bootloader.

we could also figure out where the registery is stored, and wether we can set/write any values.

but i think it heavily depends on the hardware design, what we can access, read and/or write or not.

i think first thing is to bypass secureboot, cause it is verifying the bootloader as far as i know.

after that we can take a look at the bootloader :)
[Windows Phone 8 General] lordmaxey:
So, for me, i'll have to find out what i can do with ATF JTAG.

Where i can write / read files.

Because if it turns out, that i can only repair boot with atf, but nothing more, atf is the wrong hard and software.

I need to go for riffbox then.

But i can only afford this in a couple of weeks.
[Windows Phone 8 General] ngame:
your right every changes in firmware (ffu) will breaks sign but it doesn't mean if we change registry keys it will breaks too.

if we modify ffu yes sign will be broken but i hear about something called direct write / read access that allows us to get and place files in phone storage (maybe something like MassS mode?)

we can replace modified registry files in phone theoretically

registry keys are always in change when you change your accent color or your background and more but you can see your phone didn't brick for change tiles color :D

maybe its safe to modify them after phone flash

hope you get my mind and also hope it true
[Windows Phone 8 General] skiddd:
[MENTION=4630012]lordmaxey[/MENTION]

ATF JTAG was designed for simplicity... But we have Internal versions of ATFJ.exe which can

perform custom read/write tasks and can even do advanced scripting like Trace32 high-end debuggers.

I am interested to help, and I have 2 working 920 (AT&T Version) hardwired with a permanent JTAG Connection.

My secretary can read/speak Mandarin, so she can do a better job than translate.google.....

B.R.
[Windows Phone 8 General] reker:
Nokia PC Suite will check the signature of FFU, but after some modify, it can be bypassed.

The Lumia will accept the modified FFU, it likely write a partition to NAND first and then check it's signature, if something wrong, stop.

But the Chinese thread in 1st post said that the whole modified FFU can be flashed into the phone, and bricked after reboot.

What ever it is, I guess, at least some parts of FFU can be written into NAND, once the phone checked the signature, it just halt. And the phone can't boot because there is a Flash Mode Flag bit set to True, when boot, bootload switch the phone into flash mode, not normal mode.

We can prove it with JTAG/RIFF/ATF or any else that can read phone directly. If it's true, we can make a FFU with modified bootloader and flash.

By the way, whole image signature is only check in flash process. Security Boot only check binary executable files used in boot time, so registry or even some exe/dll in NAND are safe to modify.
[Windows Phone 8 General] lordmaxey:
Wohoo, i'm glad to hear you are on board :)

And i can try this stuff out with my atf box and i don't have to purchase another box :)

So, first thing i would like to do is to make a full dump of my phone using atf jtag. :)

Then we can use this dump for research. GREAT.

[MENTION=1788780]reker[/MENTION] : so this means, we can theoretically modify the registry and write it directly to emmc and the phone would still boot?

I'll try :)
[Windows Phone 8 General] ultrashot:
Of course you can edit registry as long as you have an access to hive files.

FFU way won't work, as mentioned above.
[Windows Phone 8 General] tfBullet:
i'm not too shure about that - i think it isn't as straight forward as you think... the filesystem is encrypted, as far as i know with bitlocker,

so if we change any bit it will most likely mess up the whole hive.. we might have access to eMMC, we might be able to read/write to it,

but that doesn't mean we can just go ahead and write anything on there we want ;)

that would be just too easy, and the guys at M$ are not dumb, they've learned their lesson..

as far as i know: there is no way around secureboot on any device atm?! (correct me if i'm wrong)

I'd say custome roms / bootloaders are out of the game for now..

what i thought about was something like:

- attaching JTAG

- boot up the phone

- put the device on halt

- look for a codecave or a function in a high-privilege process that we can overwrite ( in the RAM of course )

- put a payload in there that creates our own high-privilege thread (e.g. by executing a fire and forget thread)

or maybe even doeing 'the magic' itself...

It might also be possible to break just before some registry value gets written, and patch the registry path and value to something we would like to write to the registry..

we can't modify these high privilege processes permanently by writing them to eMMC, but i'm damn shure we can modify them in ram :)

if my theory is correct (BitLocker), you will not be able to read any clear text from eMMC

if we're lucky not the whole eMMC is encrypted, but i doubt they would exclude such an important region like the registry

yeah, they might be able to flash the whole FFU because they patched the signature checks in NCS,

and they might even bypass the final signature/verification checks of the flashing process..

as soon as the phone reboots, secureboot kicks your butt if you modified the bootloader,

and if you didn't modify the bootloader and secureboot lets you pass

the chain of trust continues and the bootloader will kick your butt because its signature check of *whatever* failed...

i think we have to face it: if UEFI is implemented correctly (and trust me, M$ keeps an eye on that :-/ )

and as long as we can't get our hands on valid certificates to sign our own stuff, there is almost no way i can think of to get custome rom's running

(exept we find a way to manipulate secureboot, maybe with a chip like back in the days of PS one ;D)

nope we can't.. the chain of trust just continues after secureboot and bootloader, and every exe/dll that has any privileges needs to be signed

and successfully checked before it gets the rights it claims...
[Windows Phone 8 General] ultrashot:
BitLocker isn't activated on pure retail devices: it must be activated via remote device management (enterprise)/via registry.
[Windows Phone 8 General] -W_O_L_F-:
"Check after flashing" is a nonsense! It's the best way to the brick! What if an error occurred while downloading FW over USB?

My Loox C550 downloads FW to RAM, checks it and then flash it.

My Ativ S downloads FW to RAM and checks it part by part. Then flash part and downloads next.
[Windows Phone 8 General] skiddd:
After carefully reading and translating that thread in the Chinese forum... I am sorry to say that this has nothing to do with JAILBREAK or INTEROP Unlock.

The original poster is also NOT the actual "hacker"... he just took the info/process from somebody else (some other forum).

Anyway, it is just about flashing a modified FFU (developer rom) with a buggy Nokia Ovi Music app to a Retail Device. As you can see, his phone is yellow and AFAIK developer phones only came in black (at least mine is).

He also said that FURTHER DEVELOPMENT will no longer continue and that this is not a gateway towards JAILBREAK/INTEROP Unlock.

All those files which he shared are just for allowing other users to flash the revised FFU with Nokia Care Suite... Actually this FFU will flash OK using 3rd Party Tools which does not check vpl signature.

The rest of his posts are just blah blah on how the Care Suite patching was done and how Nokia Ovi Suite can be "cheated" to allow you to download/play commercial songs without a FEE.

He also did not share the FFU he used nor the app Nokia Ovi Suite...

That Image which you cannot translate from the first post simply says:

So there you have it... another dead end.

On a side note, you can disable secure boot temporarily via JTAG.

Similar method explained here:

http://xdaforums.com/showpost.php?p=30062504&postcount=247

http://xdaforums.com/showpost.php?p=30148348&postcount=296

What you cannot DO is realtime debugging the HLOS on a Retail phone. The phone will simply freeze and I am not sure which core is actually responsible for it.

You can debug the SBL1, SBL2 etc easily... but you would not need to do this if you already can temporarily disable secure boot.

B.R.
[Windows Phone 8 General] lordmaxey:
hm... :(

ok, but the method described in the first post seems to have nothing to do with the misterious lumia 920 3-tile row video from this (locked) thread: http://xdaforums.com/showthread.php?t=2585811

and IF this is true, they must have been able to modify the system.

does temporarily mean until next reboot?

So, doesn't this give us a little hope?

Isn't it worth trying to full dump the phone via JTAG and check the result?
[Windows Phone 8 General] tfBullet:
We can flash to eMMC with JTAG, and JTAG doesn't give a **** no matter what we try to flash (signed or not) to the eMMC - if the method to temporarily disable secureboot works, we would be able to boot any image we want, we would just need to disable secureboot at any reboot, and i guess we could do that with some dead-simple microcontroller

Did i miss something?
[Windows Phone 8 General] ultrashot:
I was telling this multiple times. This device is either jtagged or it is developer one by default - both methods work just fine AFAIK.

Poster has both developer one and JTAGged one so I can't guess which one he used for video.
[Windows Phone 8 General] skiddd:
[MENTION=4630012]lordmaxey[/MENTION]

I was just explaining things on that specific thread in that chinese forum... I am not aware of this 3-tile tweak. Maybe it already exists, but definitely it is not what that thread in that forum is talking about.

[MENTION=5426815]tfBullet[/MENTION]

It is disabled until next cold boot... like a tethered jailbreak for iOS before. If phone powers off or battery dies, then you need to disable it again via JTAG. It can be done via microcontroller but it is not a trivial task to implement it as a stand-alone. There are many variables that needs to be considered because the HLOS and the Modem will not load at all if it detects that the arm7 has entered debugging mode. That being said, one has to clean up all traces of a previous debug request halt in order to trick the phone that this was just a normal cold boot.
[Windows Phone 8 General] tfBullet:
as far as i know for the 3-tiles tweak you only need to change a registry value..

so if i get you right: we need to enter debugging mode, disable secure boot, remove any trace that phone was in debugging mode, and then do a "warm boot"?

sounds pretty doable..
[Windows Phone 8 General] lordmaxey:
Interop Unlock is also "just" changeing 3 reg values:

1. Registry Path: Software\Microsoft\DeviceReg\Install

Registry Key: MaxUnsignedApp

Registry Value: 10003

2. Registry Path: Software\Microsoft\DeviceReg

Registry Key: PortalUrlProd

Registry Value: http://127.0.0.1

3. Registry Path: Software\Microsoft\DeviceReg

Registry Key: PortalUrlInt

Registry Value: http://127.0.0.1

AFAIK thats basically interop unlock. So if we would get this changes booting, we could run [MENTION=3529492]GoodDayToDie[/MENTION] 's EnableAllSideloading.xap etc.

Well, i guess it would be interesting how atf software "stores" the "full dump" and if it's possible to modify this "full dump of emmc"...
[Windows Phone 8 General] skiddd:
[MENTION=4630012]lordmaxey[/MENTION]

If you can "see" this registry inside FFU File and if you can edit it and repack it, I can try to write it directly to my AT&T RM-820 Phone.

Preferably on a 3051.40000.1347.1001.

Then we can start from here to check whether hlos checks registry integrity or not.

The lumia 920 is not as "strict" as you may expect. If we edit something, normally the modem part get's disabled (NO IMEI NO CALLS ETC) but the Wifi and HLOS is still working fine...
[Windows Phone 8 General] lordmaxey:
Great. :)

I'll check what i can do tonight when i'm home. I'll download your firmware tonight and will check.

But i can't promise anything as i don't have expert knowledge :D

[MENTION=1794621]ultrashot[/MENTION]

how is your progress going? http://xdaforums.com/showpost.php?p=49984111&postcount=23
[Windows Phone 8 General] ultrashot:
MainOS\Windows\System32\config\*

Use Registry Workshop\regedit to mount hive and edit it

Oh, weird. Pretty much idling because of multiple IRL problems I have to resolve...
[Windows Phone 8 General] lordmaxey:
So, i'll download the rom for [MENTION=238362]skiddd[/MENTION], "open" it with [MENTION=406172]AnDim[/MENTION]'s ImgMount Tool and edit the value with regedit?

Oh, good luck in solving, then! :)
[Windows Phone 8 General] ngame:
if you open phone's ffu you will find Software hive with max unsigned app with 0xffffff (I don't remember it's decimal but it's not 0)

it will 0 after first boot I think .

you have to get this hives from your phone storage !

we need Mass Storage Mode or use Webserver . I think webserver by [MENTION=3529492]GoodDayToDie[/MENTION] can access to this folder but i'm not sure

---------------------------------------------------

Edit :

I checked Number in hex : 0x7fffffff

Dec : 2147483647
[Windows Phone 8 General] lordmaxey:
Ok, i downloaded the latest black rm-820 ATT rom and mounted it using ImgMount.

Now i can't load this file with regedit. But i opened it in Hex-Editor and searched and found the values of MaxUnsignedApp, PortalURLInt and PortalURLProd

How do i have to change these values now?

For example MaxUnsignedApp value is written like this: " .0. "

Do i have to just replace the " 0 " with " 10003" or do i have to write " 1.0.0.0.0.3 " with those dots?

Same for "h.t.t.p.s.:././. " do i have to write it with dots or without?

Sry for dumb questions :D
[Windows Phone 8 General] DaviUnic:
That's some sort of different format than what RegEdit supports, but it's rather unusual for the SOFTWARE hive, as I can load it perfectly fine from my Lumia 820 FFU. :S I don't think hex editing will work, but you never know...
[Windows Phone 8 General] sensboston:
MaxUnsignedApp is a DWORD parameter, so 0 in dword is not equal character code for '0' :)

And it's not a "dots" in "http" - it's UNICODE encoding :)

P.S. I'm sorry but according to your post you should stop by now - the chance to brick your phone with that kind of knowledge is very high...
[Windows Phone 8 General] lordmaxey:
ooohhhh... embarassing :D

Yeah i know i can brick it, but it doesn't matter ;)

I could repair it with jtag, so i don't worry.

And: If i don't risk anything, i will have no result. ;)

Should i try loading the software hive with registry workshop?
[Windows Phone 8 General] tfBullet:
as we are experimenting with JTAG here, it shouldn't be a big deal if we 'brick' any device, as we're already hooked up to JTAG

to recover the device if we mess something up - or do i miss something here?

i just thought of another method we could try when we don't have success with our current ideas:

secure boot resides on a write protected space/chip, on production time secureboot gets written to it, verified

and then they blow an (e)fuse to make it read only. anyone here with some experience on e-fuses?
[Windows Phone 8 General] ultrashot:
wasn't it the first thing I ever wrote about?
[Windows Phone 8 General] lordmaxey:
yes. :)

I'll post back when i'm back home. :)
[Windows Phone 8 General] ngame:
as I said max unsigned app value in ffu is :

hex : 0x7fffffff

Dec : 2147483647

if you want to open hives you have to use regedit.exe then click on HKey_Local_Machine

after that from file menu select Load Hive... then address the SOFTWARE hive it ask you for a name , name it something like 123 then go to Max Unsigned App root key you will get the hex and Dec value I provided .

So our phone must be interop unlocked after flashing :D but it doesn't because I don't know when but this value will change .

Maybe after first boot or also after following Getting Started steps !
[Windows Phone 8 General] GoodDayToDie:
Just a quick reminder: the 10003 value for interop-unlock was literally just a test number I used by sticking a few digits on the end of the initial value of 10 (which I had because of standard developer-unlock). You can use any value greater than 300 (up to a maximum of at least 0x7FFFFFFF - 2147483647 in decimal - which is far more than you could possibly need).

Oh, and if you want to run EnableAllSideloading, you'll need to change the capability class for ID_CAP_DEVELOPERUNLOCK_API to be either CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS or to ...SECOND_PARTY... (which normally wouldn't be usable for sideloaded apps, but is if you're interop-unlocked). The EnableAllSideloading app just changes *all* capabilities to be THIRD_PARTY class, so you can sideload and run any app that uses any of them, probably even if you lost interop-unlock.

EDIT to respond to the post below this: prevent-relock is a hack that goes back to WP7; I didn't discover it. I arguably ought to update the capability-unlock apps to apply it, though, because people keep forgetting to!

EDIT 2: Yes, the capability class names are plural. Just checked!
[Windows Phone 8 General] tfBullet:
if he is interop unlocked, even if just for a short time, he can apply the prevent relock fix of GoodDayToDie and he will be good - as he has enough privileges for that fix then :)

---------- Post added at 09:21 PM ---------- Previous post was at 09:11 PM ----------

thats pretty similar to the SeGetImageRequiredSigningLevel = 00 on Win-RT isn't it?

that means every thrid party app gets second party privileges - so isn't it possible to set it to higher privileges? (e.g. first party)
[Windows Phone 8 General] GoodDayToDie:
Eh, not really. There's some stuff worth looking into in that area too, but that's not what capability unlock actually does.

On WP8, capabilities (SIDs which can be attached to AppContainers to give additional permissions) are divided into a number of "capability classes". By default, third-party apps (from the store or from sideloading) can only use the third-party class, which includes the "normal" capabilities (ID_CAP_NETWORKING, etc.). OEMs, and those blessed by them, can use second-party capabilities (but apps requiring 2nd-party caps can only be sideloaded on interop-unlocked devices); this includes not only INTEROPSERVICES but also things like ID_CAP_MEDIALIB_PHOTO_FULL. The remaining capabilities - and there's a lot of them - can mostly only be used by Microsoft themselves; this includes things like ID_CAP_DEVELOPERUNLOCK_API and ID_CAP_BUILTIN_SYMBOLICLINK. If there is *any* way to sideload apps using those capabilities, I don't know it. There probably is, of course, but it would take more research to find (the key to interop-unlock, dating back to Mango when INTEROPSERVICES was first moved out of the "generally available" pool of capabilities and into a class of its own, was found by somebody else).

WP8, especially since GDR3, also has multiple classes of Enterprise app capabilities. The lowest of these is basically just the same as third-party gets, but the highest incorporates most or all of the 2nd class capabilities and possibly some of the 1st-class ones. Installing such an app requires that it be signed by the organization in question, though. Still, INTEROPSERVICES is on the list (at either enterprise-medium or enterprise-high, I forget) so in theory a business could produce an interop-unlock app for its employee phones.

EDIT: Specifically, ID_CAP_INTEROPSERVICES normally requires CAPABILITY_CLASS_SECOND_PARTY_APPLICATIONS (capability unlock lowers this to CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS) or CAPABILITY_CLASS_ENTERPRISE_OEM_HIGH_ACCESS_APPLICATIONS. I don't know what's required to enable installation of an "enterprise oem high-access" application, or how to get the requisite signature for one. I haven't really looked into the enterprise app sideloading much.
[Windows Phone 8 General] lordmaxey:
Yep, i got the changes now, you are right ;)

But damn... how to "repack" the mounted image? :confused:
[Windows Phone 8 General] tfBullet:
If you repack the Image you need to flash it, and therefor it has to be signed to flash it - the way you shold try is by flashing only this file, or better just the bytes you've modified directly to the phone ;)

EDIT:

Forget what i said, i was confused.. :D its early in the morning..
[Windows Phone 8 General] lordmaxey:
:) :good:

Yeah, i just don't know how to "repack" the image.

It seems ImgMount "extracts" the ffu file to "C:\Users\Username\AppData\Local\Temp\Firmware-File-Name.mnt\"

So i could edit the files but i could not copy those to another folder for example, to repack them. :confused:
[Windows Phone 8 General] tfBullet:
search the forum, someone explained how to interop unlock the windows phone 8 emulator, there is a step by step guide how to modify the registry :)

bit i thing all you have to do ist rightklick the hive in regedit and export it?!
[Windows Phone 8 General] lordmaxey:
Ah, i got it :D

ImgMount converts the ffu to a vhd file which can be loaded easily with windows disk management utulity. :)

[MENTION=238362]skiddd[/MENTION]: So, i'll upload the .vhd now. Hope this is ok for your JTAG test. Don't know if it's necessary to rename the file to .ffu or not. :confused:
[Windows Phone 8 General] tfBullet:
*.VHD = Virtual Hard Disk

we don't need to copy this to a virtual disk - its an actual "disk" we have here ;)

the tip with the emulator was just to lookup how they imported/exported the reg. hive...
[Windows Phone 8 General] lordmaxey:
[MENTION=238362]skiddd[/MENTION]: Here are the links for your phone.FW: 3051.40000.1347.1001 black

Part 1: http://www.4shared.com/file/rCtrVAmNba/RM820_ATT_L9207z.html

Part 2: http://www.4shared.com/file/IfAaufyqce/RM820_ATT_L9207z.html

Part 3: http://www.4shared.com/file/YHSbwx4Wba/RM820_ATT_L9207z.html

Part 4: http://www.4shared.com/file/azl6DCMcba/RM820_ATT_L9207z.html

Part 5: http://www.4shared.com/file/PRtwFmndba/RM820_ATT_L9207z.html

Part 6: http://www.4shared.com/file/eFl946wPce/RM820_ATT_L9207z.html

I packed it with 7zip in 6 parts for easier uploading ;)

I hope this is what you need for testing :)
[Windows Phone 8 General] reker:
I can help making a Jailbreak FFU for the JTAG guy, just tell me the official FFU download link of your phone

---------- Post added at 06:29 AM ---------- Previous post was at 06:25 AM ----------

Nop, it will be 10 if you unlock the phone. Or it will keep 0x7fffffff, don't forget DeveloperUnlockState=0 so 0x7fffffff is safe.
[Windows Phone 8 General] ngame:
o.o

i didn't check DevUnlockState value and i can't check it right now