[Windows Phone 7 Development and Hacking] martani:
I have been using ChevronWP7 for more than a month now and I was always wondering how does it work?

I tried to follow the obfuscated code in Reflector but it's really a mess and needs a lot of time and effort to follow the code's logic.

Aside from the code part, it seems that it changes the hosts file under C:\Windows\System32\drivers\etc to something like this

192.168.2.13	developerservices.windowsphone.com

172.26.68.53	developerservices.windowsphone.com

192.168.1.20	developerservices.windowsphone.com

So if anyone is working (has worked) on this, it would be great if you guys share your findings with the community here.

Thank you.

EDIT:

I am not sure if you guys have already seen the Windows Phone Developer Registration program that comes with the SDK or not (I didn't!!! for 3 months), but ChevronWP7 is just that program without the live services authentication! it is that simple, and you can see the source code with reflector :rolleyes:

Basically the app does the flowing:

it uses a TcpClient to communicate with the phone over port 27077

this.client = new TcpClient();
this.client.SendTimeout = 2000;
this.client.ReceiveTimeout = 2000;
this.client.LingerState.Enabled = true;
this.client.LingerState.LingerTime = 0;
this.client.NoDelay = true;
this.client.Connect("127.0.0.1", 27077);

To check the status of the phone:

it sends this byte array

byte[] buffer = new byte[4];
buffer[0] = 16;
buffer[1] = 1;
this.commandData = buffer;

To Unlock the phone :

it sends this byte array

List<byte> list = new List<byte>();
ASCIIEncoding encoding = new ASCIIEncoding();
ushort num = (ushort)(((authToken.Length + 3) + 2) + 3);
list.AddRange(new byte[] { 16, 3 });
list.AddRange(BitConverter.GetBytes(num));
list.Add(1);
list.AddRange(BitConverter.GetBytes((ushort)authToken.Length));
list.AddRange(encoding.GetBytes(authToken));
list.Add(2);
list.AddRange(BitConverter.GetBytes((ushort)2));
ushort num2 = isInt ? ((ushort)0) : ((ushort)1);
list.AddRange(BitConverter.GetBytes(num2));
[COLOR="red"]this.commandData[/COLOR] = list.ToArray();

An http server is made to listen for any requests that come from the phone (which were redirected in the system\hosts file to 127.0.0.1) and returns as a response :

<ResponseOfRegisteredDeviceStatus xmlns="Microsoft.WindowsMobile.Service.Marketplace" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><ResponseCode>0x00000000</ResponseCode>
<ResponseMessage i:nil="true"/>
<Entity xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.WindowsMobile.Service.Marketplace.BLLDevPortal.Entities">
<a:DaysLeft>365</a:DaysLeft>
<a:AppsAllowed>10</a:AppsAllowed>
</Entity>
</ResponseOfRegisteredDeviceStatus>

The number <a:AppsAllowed> is the number of allowed apps, discussed here in the changed version without the side limit.

To lock the phone :

internal LockCommand(string authToken)
{
List<byte> list = new List<byte>();
ASCIIEncoding encoding = new ASCIIEncoding();
ushort num = (ushort) (authToken.Length + 3);
list.AddRange(new byte[] { 16, 2 });
list.AddRange(BitConverter.GetBytes(num));
list.Add(1);
list.AddRange(BitConverter.GetBytes((ushort) authToken.Length));
list.AddRange(encoding.GetBytes(authToken));
this.commandData = list.ToArray();
}