yashsingh1/xdaforums huggingface dataset:
[Windows Phone 8 Development and Hacking] jordanmills:
AWESOME. I'm glad to see someone tried it.

But they're out of the dolphin jigs right now, darnit.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
There is MultiString function in FCRouter, but we don't have client part for it.

Currently, wolfROM has partitial CAP unlock. Authors of "all CAPs" apps can use only included in wolfROM CAPs.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
If you can figure out the function interface to call multistring (and, ideally, binary) functions in FCRouter, that would be awesome! I figured they must be there but I'm not really familiar with the RPC mechanism used on WP8 and figured it wouldn't be worth wasting the time trying to call them when I have other hacks to try.
[Windows Phone 8 Development and Hacking] lordmaxey:
Yes, i can, but just in about 30 hours. Sorry. :(
[Windows Phone 8 Development and Hacking] myst02:
But I can, I interopunlocked my Lumia 520 RM-915. Should I post the files? I can in about 4 hours.
[Windows Phone 8 Development and Hacking] tfBullet:
[MENTION=4630012]lordmaxey[/MENTION] : exactly the way i said, just patching the registry, glad you did it! :)

And sad i couldn't put aside enough money for trying myself so far...

I tryed some stuff with a selfmade LPT-JTAG adapter, but really: a full dump would take WEEKS :silly:

im just curious, how did you get the ATF-Box to read/write the data you want?

As the original software is more meant for... lets say "average-joe-users" :D and doesn't provide such features, as far as i know...

Did you use OpenOCD or something else? :)

EDIT: maybe i've just stubled across a cheap (open, and OpenOCD + urJTAG compatible) alternative

for the expensive boards specifically made for phone recovery: Bus Blaster v4

The previous version (v3) even runs you 10$ less... I'll take a look at this, 45/35$ sounds like a decent price :)
[Windows Phone 8 Development and Hacking] GoodDayToDie:
[MENTION=5736292]myst02[/MENTION]: That would be great! Thanks.
[Windows Phone 8 Development and Hacking] myst02:
So, the development is going on! I also interop unlocked my Lumia 520 RM-915 and it works! I tested higher privileged apps like File Manager, they also work :highfive:

btw, Phablet mode looks great small on the 520 ;)
[Windows Phone 8 Development and Hacking] Hyp3rh4ck:
Today a new Era begins!
[Windows Phone 8 Development and Hacking] lordmaxey:
ATF-Team updated their JTAG software for custom read/write to the public, because of my inquiry.

So you can tell the jtag software which parts of the emmc you want to read/write.

So, you just need to dump MBR and calculate where your MainOS partition starts and ends.

Then you can dump just those sectors, which makes reading and writing faster.
[Windows Phone 8 Development and Hacking] tfBullet:
very nice :) but i think its still ~100$ for the box?!

[/QUOTE]

so you always dump the whole main os partition?

if we can minimize the amount of required reading & writeing, it could be possible to use those cheap JTAG-LPT adapters (10$),

so everyone can JTAG his device... as i already said, the r/w speed of these things is really bad :D
[Windows Phone 8 Development and Hacking] hutchinsane_:
so you always dump the whole main os partition?

if we can minimize the amount of required reading & writeing, it could be possible to use those cheap JTAG-LPT adapters (10$),

so everyone can JTAG his device... as i already said, the r/w speed of these things is really bad :D[/QUOTE]

Sooo... just curious, with these JTAG to LPT adapters, would it be possible to (really slowly) reflash a corrupted bootloader, if we extract the fils from the rom (possible, but no QPST Flash programmer)?
[Windows Phone 8 Development and Hacking] ngame:
Sooo... just curious, with these JTAG to LPT adapters, would it be possible to (really slowly) reflash a corrupted bootloader, if we extract the fils from the rom (possible, but no QPST Flash programmer)?[/QUOTE]

Mainos Is not good at all . because after every hard reset we need to interop again .

we need more partitions to Dump .

what partitions is access-able with ATF?
[Windows Phone 8 Development and Hacking] hutchinsane_:
[MENTION=4542506]ngame[/MENTION] XDA is a little bit buggy with the quotes at the moment, I only wrote "Sooo... just curious, with these JTAG to LPT adapters, would it be possible to (really slowly) reflash a corrupted bootloader, if we extract the fils from the rom (possible, but no QPST Flash programmer)?"

But, Main OS IS good. You can write it with JTAG.
[Windows Phone 8 Development and Hacking] spavlin:
myst02

Verify that it is?

[HKEY_LOCAL_MACHINE\MountedDevices]

"\DosDevices\U:"=hex:44,4d,49,4f,3a,49,44,3a,61,51,83,bf,a7,65,11,49,89,da,39,\

5a,ce,0a,9d,37
[Windows Phone 8 Development and Hacking] myst02:
[MENTION=3529492]GoodDayToDie[/MENTION]: I've uploaded all the registry files from 8.1 for you. Sorry, I know it's late, but I haven't got the time. Good luck and happy programming! EnableAllSideloading for WP 8.1 would be so awesome!

[MENTION=387617]spavlin[/MENTION]: I will look for registry entry and tell you if it's present.

I'm going to play around with Mass storage, maybe I can make registry editor, so much things to do ;)

So, all Lumia users, wish me luck! If I figure out something new I post it here.

EDIT: I looked into SOFTWARE registry file and found a key that sets if cortana is enabled! Maybe we can enable cortana on other languages with it!
[Windows Phone 8 Development and Hacking] lordmaxey:
Yes, you need the box + seperate JTAG module activation ($40) + dolphin clip + lumia jigs is summed up approx. $200.

Of course dolphin clip + JIGs isn't a MUST, but it's defenitly worth it.

Yes, for the first try, i dumped MainOS, edited it and wrote back modified dump.

Of course you can dump every single partition.

Just dump the MBR and check what's inside. It might be helpful if we could write the values to the hardreset-partition. But therefore, we would need enableallsideloading working on 8.1 ;)
[Windows Phone 8 Development and Hacking] lordmaxey:
Interop Unlocked Lumia 920

Ok,

i successfully interop-unlocked my Lumia 920 now!

I flashed it back to stock GDR3 and did the same procedure i did for my 520.

As my 920 is my productive phone, i'll leave it the way it is now, and will do all further testing with the 520.

One weird thing persists: after updating the interop unlock 920 gdr3 to 8.1 i tried uninstalling and re-deploying WP-Tweaks: success.

i installed [MENTION=3529492]GoodDayToDie[/MENTION]s webserver All Cap version: success

But i failed deploying [MENTION=4770139]hjc4869[/MENTION]s File Explorer on 8.1...

Weird. :D
[Windows Phone 8 Development and Hacking] sensboston:
I'm thinking about a low cost scheme for the equipment; I'm not ready to spend $200 for interop unlock (I'm not that cheap but don't need the unlock so much :)). $20 sounds much better and I do have an idea how to make it possible.

We just need 5-6 people here in US (best if located at the East Coast or - better - New England, to minimize shipping charges)

First person should buy stuff for the full price; after unlocking handset(s), he should send equipment to the next person for base_price - $10 (and shipping charges should stay on sender). So, the last person will get a hardware for the base_price minus $50/60, it will make future ebay sale much easier (or he can save it for himself).

If someone is interested, please PM me.

P.S. lordmaxey, I'm very sorry, I'm not trying to steal your thread; I just want to maximize chances to get a right people :)
[Windows Phone 8 Development and Hacking] lordmaxey:
No worries ;)

Btw: i uploaded what webserver is showing me, watching SOFTWARE\Microsoft\SecurityManager\CapabilityClasses on the phone.

It seems, 8.1 is adding some new CAPs.

here's the saved webpage: http://lordmaxey.de/Lumia_Interop_Unlock/WP8_NativeAccess_L920_8.1.htm

oh, another thing:

This unlock right now is really time-consuming and intensive.

And it is "device-specific", means that there is no "general unlock emmc image" right now. I always set up the whole phone first, dumped it and wrote the changes back.

So writing this image back, would add my live account to someone other's phone, which is not wanted, of course ;)

So, i'm checking now, if it's possible to unlock a phone, which has not been set up.

We need to check, if something get's overwritten during first setup.

If not, we can publish a general unlocked emmc image which can be written to the phone without being dumped first.

We'll see.
[Windows Phone 8 Development and Hacking] ngame:
Good News .

my failure maybe was that :

we have to only set some of caps as THIRD_PARTY and we have to mostly set them with multi strings like :

First_PARTY

THIRD_PARTY.

Now it's time to see what we can do to provide a pure Capability Unlock for 8.1

GUYS IN MASHAD , IRAN :

Is there anyone with a ATF o work on it ?

کسی اینجا هست اهل مشهد باشه و ATF

داشته باشه و بتونه کمک کنه به من تو این پروژه ؟

Kindest Regards .

NGame ;)
[Windows Phone 8 Development and Hacking] Mattemoller90:
It's possible to compare a registry of a phone with Cortana enabled, small text and 5 quick option with a "normal" phone and find the registry key?
[Windows Phone 8 Development and Hacking] lordmaxey:
No, because 1520 has fifth shortcut, but can't be interop unlocked due to no JTAG access.

Oh, btw:

I played around with my 520 again today and have good news.

I flashed it with stock rom booted it up and set language to English in first step.

Then i turned it off and dumped the MainOS.

I modified this dump with interop settings and wrote it back to the device.

As expected, the device was still in the "welcome back" step of the first time configuration.

i configured the device and could successfully deploy enableallsideloading.xap, executed successfully and could sideload WPTweaks.

SO: it IS possible to make a "general interop unlocked" emmc image from every single phone, as the phone does NOT reset the values within first time configuration! :good::good::good:
[Windows Phone 8 Development and Hacking] Mattemoller90:
But if I set PhoneManufacturerModelName to RM-938 in My ativ S i have 5 shortcut and we can compare with another Ativ s with PhoneManufacturerModelName as GT-I8750

Is it a good idea?
[Windows Phone 8 Development and Hacking] tfBullet:
yes of course, but as i stated, the read/write speed is horrible...

16MB takes ~35min thats ~2,2min per MB,

lets add that up: if we would need to dump a 256MB thats 9hrs 20min => thats not really fun, u see why i quit experimenting with LTP-JTAG now? :D

As i said, if the amount of data we need to dump&write is very small, it could be done...

But if you invest, lets say twice the money (30 - 40$), you can grab a USB one, compatible with free software (OpenOCD).

I'm shure there is JTAG on the board as well, we just don't know the location of the connection points for now?!
[Windows Phone 8 Development and Hacking] lordmaxey:
Of course there is, but it can't be exploited (for now), as qualcomm fixed something with the latest cpu family...

[MENTION=238362]skiddd[/MENTION] described this a few pages ago.
[Windows Phone 8 Development and Hacking] myst02:
Hey all, I have good news!

I was able to display the Windows BCD on my Lumia 520 after playing around with BCD file :D. Looks like we can boot other .ffu with it, someone posted that .ffu must not be signed, maybe we can make recovery tool like on Ascend W1!

I've uploaded a picture as proof. [MENTION=3529492]GoodDayToDie[/MENTION]: What progress has your EnableAllSideloading app? If you can make an app for 8.1, that would be VERY awesome ;)

btw. I'm coding an app to activate USB mass storage on the interop-unlocked Lumia phones, so wish me luck :)
[Windows Phone 8 Development and Hacking] pete_es:
AFAIK phone security relies on nokia_sec_drv.sys (overall) and apperso.dll (simlock).

Did someone try to delete apperso.dll? Is signature of apperso.dll checked during boot / execution?
[Windows Phone 8 Development and Hacking] ngame:
good luck .

How is it going with your Rom Edit project ?
[Windows Phone 8 Development and Hacking] ultrashot:
Boot FFU? Sounds strange. You probably saw ffuloader which is AFAIK stock (Microsoft) ffu flasher.

As for USB mass storage: with RiffBox it shouldn't be hard to activate real Mass Storage built into UEFI.
[Windows Phone 8 Development and Hacking] pete_es:
Did someone find a way to browse through the files system of the two NTFS partitions without changing NTFS rights / taking ownership?
[Windows Phone 8 Development and Hacking] siddharth1102:
Well, so you can flash roms as you wrote in 1st step, if so then in later stages of interop can you flash those roms of phones which are oem unlocked (phones with ms certified developers) as they can change ram limit and overclock too. Well changing ram limit is my main concern. Finding one with developer phone may not be a problem i found many on internet.
[Windows Phone 8 Development and Hacking] lordmaxey:
Ok - i finally received my AT&T Lumia 520 (RM-915) from ebay :)

So - as i don't really need 2 520s, i'm willing to donate my interop unlocked RM-914 phone - the one with the broken screen - to a clever developer ;)

So, i first though about [MENTION=3529492]GoodDayToDie[/MENTION]: Would you like to have my Rm-914 Lumia 520?

Maybe this would help you researching the not-working EnableAllSideloading on 8.1...

So, if you would like to have it, i'd be happy to send it to you.

I just need to know, if it's better to give it interop unlock on GDR3 or 8.1 to you.

Just let me know if you're interested or name another dev who might need the phone.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
I would very much like to have an interop-unlocked WP8.1 Lumia to test/hack on, cracked screen or no. Send me a PM.
[Windows Phone 8 Development and Hacking] lordmaxey:
It's on the way :)

Sent you a PM, too.
[Windows Phone 8 Development and Hacking] Harkunwar:
No update since then, I want you all to develop some method through this to unlock it without JTAG. It makes the price more than the phone :/
[Windows Phone 8 Development and Hacking] ceesheim:
Not to be rude in any form, but why not develop it yourself ?

demanding for unlock stuff isn't the way to go here, they all work hard and have also a private live.

next thing is that posts like this will only turn developers away from here, and I don't think you want that , right ?

Greetings Cees Heim
[Windows Phone 8 Development and Hacking] myst02:
Yes, good question, why do not develop it yourself? A few months ago I was a normal user, jealous to Ativ S users because they have Interop unlock. But there wasn't any unlock for other phones, also after waiting a long time. So I thought, why don't develop it myself? I started working on interop unlock, I tried multiple times and finally, [MENTION=4630012]lordmaxey[/MENTION] came up with the idea to interop it with JTAG. We did it to a together-project, he teached me a few things about JTAG. And it worked! This was the happiest day in my life :D

But you also all should respect that we have a private life, have to go to work or some of us has to go to school. I normally don't care about ETA questions, but I just wanted to explain it here for all jealous Lumia and HTC users. I understand you, but you all should keep in mind that we can't woek all times for XDA. But I can promise you, we are working to do this without JTAG!
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Interop-unlocked Lumia 520 has arrived! I haven't had time to hack on it yet, but I've got plans. HUGE thanks to [MENTION=4630012]lordmaxey[/MENTION] for this!
[Windows Phone 8 Development and Hacking] Lanex777:
Great! Eagerly waiting for any news from you!
[Windows Phone 8 Development and Hacking] GoodDayToDie:
I want to make it clear that I can't promise an easy-to-use interop-unlock for Lumias. I'll look, of course, but I can promise nothing.

What I *can* do is work on things like updating EnableAllSideloading to work on interop-unlocked WP8.1 phones, maybe find some Nokia-specific tweaks and write the code to add them to the registry (or port existing tweaks, like Full FS Access, if somebody didn't already do that one), and so on.

It'll help to have another test device in general, even if I can't safely hard-reset that one (it'll lose interop-unlock if I do), but it'll be especially *important* when looking for stuff specific to Lumias. Seriously though, don't hold your breath. It took months to find the initial interop-unlock for Samsung phones, and the mechanism we used for it doesn't work in 8.1 anyhow.
[Windows Phone 8 Development and Hacking] -W_O_L_F-:
I found exploit for Sammy in 2 weeks ;) But... it depends on [MENTION=770625]cpuguy[/MENTION] hack.

Second exploit was found in a moment I flashed my ATIV for the first time. But I already studied MBN format.

And now I found 3rd exploit (unpublished). And way more powerful.

First 2 exploits are easy to find. They wasn't found before me because there is only a few (cool) devs with Sammy here. No one is interested. For ex.: GDTD never looked into flashing process.
[Windows Phone 8 Development and Hacking] lordmaxey:
Of course there is no guarantee for finding a software way of interop unlocking lumias.

But at least trying to find something is a great effort from you. So, keep up your good work!

Oh, btw, pls let me know if i need to test anything on a hardresetted /flashed lumia. I can alway re-interop-unlock it with jtag, so it's better to let me test things that maybe won't work to make sure your interop isn't "destroyed".
[Windows Phone 8 Development and Hacking] pete_es:
@ lordmaxey

Did you find a way to edit files without changing NTFS rights or do you just write back image with modified NTFS rights?

I fear that MS / Nokia will try to detect such NTFS right changes in future to prevent JTAG or direct eMMC hacks.
[Windows Phone 8 Development and Hacking] GoodDayToDie:
Easy enough to restore ACLs after modifying the files.
[Windows Phone 8 Development and Hacking] lordmaxey:
I'm not modifying any rights at all.

I simply dumped the whole MainOS partition, which is NTFS formatted. As you dump the whole ~2GB you also dump a bunch of "free space".

And because you'll just fill up parts of that free space with your changes, you don't break any certs or checksums, because the size of the file in general does not change.

So i don't think this can be "fixed" by MS, because the phone also does write to the partition of course. And i didn't do anything else. ;)

The poor thing is, that Nokia is using encrypted flashfiles. And those files are smaller than the OsPartition itself, so it seems there is no "free space" in them. So if you change anything in the flashfile, you'll break signatures etc. what we already know.

I guess just enabling bitlocker on every partition would be probably save.

Anyway, the jtag approach is due to a "fault" of qualcomm. they did not disable jtag propperly, which is already fixed with the new processor series which are used in Lumia 1520 etc.

But what am i talking, [MENTION=238362]skiddd[/MENTION] already mentioned that really good: http://xdaforums.com/showpost.php?p=51893009&postcount=28
[Windows Phone 8 Development and Hacking] ultrashot:
A lot NTFS rights changes break OS bootup even without implemented detection. Be VERY careful.

Actually, I have a tool (inside OSB8) that adjusts all rights based on policy xmls - if you want, I may try to separate it from unfinished OSB8 and publish it.
[Windows Phone 8 Development and Hacking] pete_es:
That would be great.

---------- Post added at 02:42 AM ---------- Previous post was at 02:34 AM ----------

That means you edit the whole 2GB dump file directly and don't mount it as drive in Windows?
[Windows Phone 8 Development and Hacking] norgan:
Could the Raspberry Pi be used as a JTAG for this? would make for a very cheap way of doing this. $30-$40 plus some wires and code and you've got a JTAG.
[Windows Phone 8 Development and Hacking] lordmaxey:
No, i do mount the partition in Windows for editing the registry.

Have a look at Post #1, it's written there what i did.
[Windows Phone 8 Development and Hacking] pete_es:
I do it the same way as you. And this means, that initialy I couldn't access many files due to missing NTFS rights. Only after taking ownership and modifying NTFS rights I can access all files and e.g. mounting *.reg-files as hive.

So the question is if there is a way to get access to the files without modifying NTFS rights.
[Windows Phone 8 Development and Hacking] lordmaxey:
Ok, which reg-files do you want to edit? In which folder?

I only edited Windows\System32\Config\ Software.reg

And i could edit it (load hive in regedit) without modifying the NTFS rights.

Did you extract the downloaded Firmware or are you trying to edit a jtag dump?
[Windows Phone 8 Development and Hacking] myst02:
It should work, more info here: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
[Windows Phone 8 Development and Hacking] lordmaxey:
Successfully updated to latest 8.1 preview update

just wanted to quickly inform, that i've updated my Lumia 920 to the latest 8.1 dev preview update.

OS version is now: 8.10.12382.878.

Also interop unlock stays. I uninstalled WPTweaks and could successfully re-deploy it. :good:

I also checked values with [MENTION=3529492]GoodDayToDie[/MENTION]s webserver. All good.
[Windows Phone 8 Development and Hacking] sensboston:
Wow, any real experience will be very interesting!
[Windows Phone 8 Development and Hacking] pete_es:
A JTAG dump I made with ATF.

I will make dumps from some additional 520s to check again.
[Windows Phone 8 Development and Hacking] lordmaxey:
Great, it's good to see people trying this :)

Are you dumping the whole MainOS partition?

How are you mounting the *.bin file?

I used a freeware called OSFMount, works great.
[Windows Phone 8 Development and Hacking] pete_es:
Yes, the whole flash from phone. Then I use OSFMount to mount partitions as drive with associated drive letter.

Since there are rumors about direct unlocking (Simlock) of Lumia WP8 via USB there might be a security hole we don't know at this time.

I have several 520 to test. So I can play with WP8, WP 8.1 etc.
[Windows Phone 8 Development and Hacking] tids2k:
Good luck !
[Windows Phone 8 Development and Hacking] chinitopex:
hi guys

have a doubt about this cause my phone is lumia 520 model

so.. i can unlock for use anything sim cards network?

how much?
[Windows Phone 8 Development and Hacking] lordmaxey:
No, not now.

Interop Unlock has nothing to do with SIM unlock.
[Windows Phone 8 Development and Hacking] EnZl:
Can interop unlock help with notification delay? E.g. facebook or whatsapp message notification
[Windows Phone 8 Development and Hacking] titi66200:
No
[Windows Phone 8 Development and Hacking] _wook_:
Lumia 1020 wp 8.1 (registry kept after update)
[Windows Phone 8 Development and Hacking] djs92mg:
thinking

could you repack rom dump to be flashed by nokia care suit ?
[Windows Phone 8 Development and Hacking] tfBullet:
No.

Sure you could repack it, or even just modify a update package direcly but the phone would reject it because the signature is broken...
[Windows Phone 8 Development and Hacking] megasounds:
OK is this an idea ??

try to flash the nokia phone with the original package ...but just seconds before flashing replace it with the "repacked" version

will this work ??

m
[Windows Phone 8 Development and Hacking] tfBullet:
No, the phone checks the signature, before anything is written to the storage

By useing JTAG we write more or less direclty to the flash storeage, therefor the phone has no chance to check anything,

This isn't anything like a normal software update you do by nokia care suite...

Please do a google search for JTAG, and take a look at the last post of the achievments topic

It might give you an idea...

I'm having exams right now, but i'm working out a cheap and easy way atm...
[Windows Phone 8 Development and Hacking] ceesheim:
correction, the phone still check signature of everything, just remove the sig of a file(.exe or spl or EFI ) and you will see it will be a non boot for you.

only things you could edit are .reg files and some .xml files