yashsingh1/xdaforums huggingface dataset:
[KIN Two Software Development] mcdietz:
I have started looking back at some of the log files that I had the phone email me through the hidden menu and I have found some AT commands for the phone along with some other information. Here is a little bit of one file that I just started sorting through. The formatting isn't perfect because the log files have a lot of unreadable characters, but I have bolded files and commands. I also left everything in the case (upper and lower) as I found it in the file. The name of this file is:

MICROSOFT-PMX-DEBUGSTRINGPROVIDER-CHANNEL.02.clg

MPM_MainsSmThread

MPM_BB_STATE_NORMAL_ON_PRE_UPDATE

MPM_BB_USB_DRIVER_LOAD_UPDATE_EVENT, dwWaitTime: -1

MPM_Util:USB Client 1 has been Loaded

MPM_Util:USB Client 2 has been !UnLoaded!

CDMA Radio Updeate: Text stored version : v0.4.727

CDMA Radio Update:Registry Key version: v0.4.727

CDMA Radio Update: Current Modem version: v0.4.727

MPM_MainsSmThread

MPM_BB_STATE_NORMAL_ON_PRE_UPDATE

MPM_MainsSmThread

MPM_BB_UPDATE_REQ_EVENT - No modem update is needed

MPM_MainsSmThread

MPM_BB_STATE_NORMAL_ON_POST_UPDATE

MPM_END_RSTISR_REQ_EVENT, dwWaitTime: -1

MPM_MainsSmThread

MPM_BB_STATE_NORMAL_ON_POST_UPDATE

MPM_END_RSTISR_REQ_EVENT MODEM RESET ISR Init Completed.

MPM_MainsSmThread

MPM_BB_STATE_NORMAL_ON_POST_UPDATE

MPM_POWER_ON_REQ_EVENT, dwWaitTime: -1

RILNDIS: GetPacketInterface Initialize = c117d634

Shutdown = c117c4e4

RILDrv : i : Accumulated response (1) : <cr><lf>

IOPTMODE: 6 <cr><lf>

RILDrv : i : Sending cmd: ATV0E0X3 <cr>

RILDrv : t : LoadEriData : Opening file

\RoamingIndicator\eri.bin

RILDrv : i : Accumulated response (1) : ATV0E0X3 <cr> 0 <cr>

RILDrv : t : LoadEriData:

\RoamingIndicator\eri.bin not exist. Err 0x00000002

RILDrv : i : Sending cmd:

AT+cstt=0, 1, 75, 85, 95, 100 <cr>

RILDrv : t : LoadEriData: Opening file

\Windows\eri.bin

RILDrv : i : Accumulated response (1) : 0 <cr>

RILDrv : i : Sending cmd :

AT+CSTT=1,1,18,22,26,30 <cr>

PMIC Boot cookie: rb7262h

RILDrv : i : Accumulated response (1) : 0 <cr>

RILDrv : i : Sending cmd :

AT+CSQT=1<cr>

RILDrv : i : Accumulated response (1) : 0 <cr>

RILDrv:i: Sending cmd:

AT+GMI; +GMM; +GMR; +CKEYPAD?25<cr>

RILDrv:i: Accumulated response: +CKEYPAD:25

RILDrv:i: Accumulated response (2): equesting :

IUSBON, USBST, New PLMST, timestamp, 10, 2,2944 <cr><lf>

RILDrv:i:Accumulated response(1): +IQMIREADY <cr><lf>

+IUSBON<cr><lf>+IECHO: Requesting:IUSBON, USBST,

New PLMST, timestamp, 10, 2, 2944 <cr><lf>

RILDrv:i: ParseNotificationOEM: +IQMIREADY: SetEvent for QMI Init

RILDrv:i: Accumulated response(1): +IUSBON<cr><lf> +IECHO:

Requesting: IUSBON, USBST, New PLMST, timestamp, 10, 2, 2944<cr><lf>

RILDrv:i: Accumulated response(1): +IECHO:

Requesting: IUSBON, USBST, New PLMST, timestamp, 10, 2, 2944<cr><lf>

RilDrv::ParseGetEquipmentInfo Modem Version: 727
[KIN Two Software Development] mcdietz:
I found out one more thing, if you use the s+l+power comination when the phone is powered off and connected to the computer another USB device is found. I just found this thanks to conflipper's early work We will have to come up with some sort of driver for this now.

Here is the name of the device and the hardware IDs

Microsoft Pink Bootstrap

USB\VID_045E&PID_2345&REV_0000

USB\VID_045E&PID_2345
[KIN Two Software Development] mcdietz:
I also just found this hardware id when having the computer turned off and plugged into the pc. When I hold down u+s+b+power Windows finds another device with the following name and hardware IDs (According to what I have found online this VID is Nvidia.) So this might be where we can use the tegra chipset stuff.

APX

USB\VID_0955&PID_7416&REV_0103

USB\VID_0955&PID_7416
[KIN Two Software Development] mcdietz:
Thought I would also add that my phone is currently unusable, but on the positive side, I wouldn't found those other two usb hardware IDs if this hadn't happened. Sidenote, I was using QPST Configuration program, and I right clicked on the my phone in the active phones tab. I then clicked on "Configure service to port mapping..." and added one property (unforturnately, I can no longer go back to the window because the program doesn't recognize my phone now). At this point, my phone rebooted and is now stuck trying to boot up.

I don't think it is completely bricked, but I fear that until we pull a rom it is probably useless because it is stuck in a constant cycle trying to reboot. The only way to stop this is to remove the battery. I have since tried using the various key combinations provided by conflipper and have found that the bootstrapper combination (s+l+power) would probably work if we had a rom. I then tried the hard reset combination (c+b+power) which initially looks like it might work but then it gets stuck in the cycle of rebooting.

I am going to continue working on it, hoping that somehow now that I might have some extra sort of access to hardware, but I am afraid my contributions may be limited until we are able to pull a rom.
[KIN Two Software Development] kintwouser:
Sorry to hear that. There has to be a way of getting it out of the loop.
[KIN Two Software Development] johnkussack:
RevSkills Hardware Log.

Diag Port Supported Command List.

(the phone rebooted many times while doing this test, hence the unknown responses).

I tested more of the options provided by the free version of Revskills and it was kind of funny to see how the keyboard emulator worked, but only for numbers.

After all the reboots and so, i got some hex descriptions for errors in a new folder, called Err. Uploaded a new screenshot from that folder contents.

Easy CDMA just lets you browse the filesystem we already know.... not so much fun.

Little update.

You seem to be able to enter the recovery mode holding the U S B + power option but, as i tried right now, also using "Volume -" + power as stated for other tegra devices. Can't check if that loads ok on the computer, as i dont have the usb cable here right now.
[KIN Two Software Development] kintwouser:
OOPS I made a mistake. I am not seeing anything using windows 7 using u+S+B and power up. Should I disable zune, change registry for zune back to normal etc??
[KIN Two Software Development] mcdietz:
You shouldn't have to because the device has a different hardware id, so the drivers installed for the zune portion aren't applicable. Try turning your phone off, plugging in the usb cable and then using the key combinations. If the new hardware message box doesn't appear, you should still see an unkown device in device manager.

Also you have to hold the u+s+b+power for a few seconds before it will be recognized. When I have done this the screen stays blank on my phone and the only way I know it is working is through Windows.
[KIN Two Software Development] kintwouser:
Using Windows 7 OS. I had to uninstall the zune driver located in portable devices in the device manager then it found new APX device and i was able to point to the NVIDIA driver. Tried ruining the phone (Flashing android to it) as in another thread but it also got stuck on the flashing prompt. Restarted phone normally and the windows found another device and loaded the zune drivers back.

Incidently, holding the volume down and power on does the same as the U+S+B+Power and is easier on the fingers.

Thanks and keep up the great work.
[KIN Two Software Development] kintwouser:
I again may have spoken to soon. I cannot duplicate the above scenario anymore.

I also can no longer transfer pictures taken with my phone on to my pc. I can add pictures to the phone from pc and back but not the ones taken with the camera. Originally I could with zune software. The folders for uploaded pictures are different then the ones taken with the phone. I really think that I screwed something in the phone up by playing with qpst and others.
[KIN Two Software Development] johnkussack:
I'm not sure about what you did there, but in my testing & curiosity purposes trials, i wasnt able to alter the device (do a write to memory), so i doubt that qpst or the others did it for you.

Also, according to coinflipper notes, the kin has several layers, including the SBL that is the one operating with the os directly (the "Ms Pink bootstrap" device), not the recovery mode, which basically put us handling a modem....

I'm trying some things, but no results yet... gonna take some time....
[KIN Two Software Development] kintwouser:
I have changed the USB password and added contacts (somewhere) while writing to the device using qpst. I changed the password to 000001. Is this a different part of memory I am fooling with?

Thanks
[KIN Two Software Development] johnkussack:
I am not sure. I have no previous experience with any phone deving nor Qualcomm tools. Just pointed what coinflipper said.

I said "basically a modem", cause you got diag(nostics) mode within a com port, and some users (in other posts) showed logs with AT commands.

I'm working with some tools to connect to the device, but using the driver we all got (zune software). Not promising anything, just peeking around some tests.

@mcdietz

Here I pasted a public output of the linux command "lsusb -vv" (ultraverbose) where Kin (factory default settings) values are.

http://pastebin.com/rZscb9wz

Is useful for usb access to the kin. Use at will.
[KIN Two Software Development] johnkussack:
I have been testing usb connections to the kin devices (the ones we used in this forum) and i checked this:

Kin mode (normal Zune mode):

Of course, Zune software does use this mode and is

allowed

to write to the filesystem. But that's because before doing so, it uses MTP protocol values to send and receive crypto values based on JANUS from Microsoft (Microsoft DRM for Mobile Devices) and after crypto relationships, the usb commands enable the "Connected" window at the Kin.

Capturing and replaying this values over usb does not work (ever) and does not work for the kin (had to try), so no go-go from here. Also, we cannot know if it would be able (dreaming after bypassing the DRM) to go outside the pictures/music/etc folders.

On the other hand, MTP tools reports that our little friend is able to reproduce the following files:

Where firmware is strange and good but the question is... how to upload the firmwares files (you can get zune firmwares from the net) to the zune software on the device (and run them)?.

It's more interesting when you notice that firmwares contain "Zboot.bin" which is "Tegra device bootloader" but, sadly, doesnt work with nvflash because of what I said below. Those updates are WinCE updates too...

APX mode (nvidia "flashing" mode), with or without Nvidia driver.

This matches the post where coinflipper told us that you cannot dump the rom image.

Microsoft Pink Bootstrap (No driver):
[KIN Two Software Development] shlhu:
markspace. com/kin/

Here's some software that was developed for it, but I'm guessing it is only client end?

I'm not allowed to link, so assemble the spaces yourself please
[KIN Two Software Development] johnkussack:
The link for the download (direct) , being for Mac(only) is:

http://www.markspace.com/kin/download.php

But you must register to get an activation code from the main page (posted by shlhu). It will need internet access to activate the software during installation and reboot after it.

Requires Itunes (for audio sync), Iphoto (for image, also have started it once), and Quicktime (for video).

I tested it with a fresh installed Snow Leopard and i can say that it works. I dunno how it does (without zune installed), but it works.

Unfortunately, i wasnt able to analyze the usb transmission there, so i cant compare with the windows one. If it can skip the JANUS drm, then we may have a chance. If it is the same process as windows... we are done... lol.
[KIN Two Software Development] cadogan32:
I haven't seen many posts on here in awhile.Not sure what happened with johnkussack either.We need to get more people working on this project somehow.
[KIN Two Software Development] SchwassKIN:
I dropped this awful phone long ago. Android all day now
[KIN Two Software Development] cadogan32:
phone

I think that will be my next step too SchwassKIN.I really wish we could of got it hacked cause it has a lot of potential to be a good phone.
[KIN Two Software Development] DustinWolf:
Yes. The kin is a very good phone with lots of potential. I doubt it could run later versions of android (the newer versions i think require faster processors than what the kin provides) but we could at least possibly update it to windows phone 7 (the real WP, not the sad KIN Windows Phone version) or even put something like open webOS or something on it. Seriously, its only limited by its rushed OS. Even the camera is great!

I am curious as to if those drivers from Windows Embedded/CE Platform builders are "the ones" though (as mentioned in my above post a month ago)...

Id get the free trial of the software, except for the fact:

A. Requires you to fill out a form first as to why your trying the free trial, Business phone and name is necessary, why your business is interested in CE/Embedded, etc...

and B. My pc is crap and couldnt handle such software anyways. this thing fails with Visual Basic Express even. XP

if we had more people working on this maybe we could finally get it hacked, but sadly it seems lots of folks working on it either left or dropped off the face of the earth early this year. :(
[KIN Two Software Development] xboxfanj:
The thing is that you'd have to write the drivers for Tegra and you'd have to hack the bootloader to be able to flash Android. There aren't any similar devices to pull from.
[KIN Two Software Development] DustinWolf:
i wasnt saying we could get android on it. i was saying its doubtful (because ive seen alot of people suggesting it in this forum).

Most likely, even if we DO crack this phone, all well be able to do is do something like put Windows Phone 7 or 7.5 on it at best (which still wouldnt be bad. the os is pretty good) or add things to the existing os.

And again, if there was someone who would be willing to try, one of the drivers needed for the device development is listed as coming with the Windows CE 6 Platform Builder, so its somewhat possible its as simple as getting a copy of that software (whether the free trial or full thing) to crack the thing. just an idea, i mean, the driver (compositefn.dll i think it was) thats needed for the kin when pulls up (as CompositeFN of course) in one of the hidden usb modes is listed as in the platform builder, so itd be worth a shot...
[KIN Two Software Development] DustinWolf:
"...All for not"??? *sigh* is this phone REALLY doomed?

And, again, im gonna ask till im blue in the face: has anyone tried the CE6 Platform Builder? And if not, do you think it may work, having one of the needed drivers listed on the site and all?
[KIN Two Software Development] cadogan32:
phone

I think i tried that out along with a couple other people but it still comes down to the phone is locked down pretty good.The SBK is one thing that keeps us from actually modifying any of the files to flash the partitions.If we knew someone who could pull the movinand chip off and dump the rom maybe the key would be on there.The reader for it runs about $1200.00 but can be built if you have enough electronics experience(I dont have that much)

---------- Post added at 08:41 PM ---------- Previous post was at 08:38 PM ----------

I still think this is a great phone for what it can do.I'd say pretty damn good for a 'feature phone' Being able to record hd video and really good pictures are still my favorites.
[KIN Two Software Development] klamation:
I haven't been active here for a while. I know about KinO from JohnKussack, but what did you and xboxfanj do? Did I miss something cool?
[KIN Two Software Development] xboxfanj:
I haven't done anything. I never have and probably never will own a kin. I just look at this forum occasionally because I feel bad for you guys. Unfortunately, due to microsoft's closed source nature and the unique hardware of this device, it'd be very hard to make drivers for another OS. And even if we could, how would it be flashed? No other device I've seen even has the tegra 1 chip (apx2600 I think) minus the zune hd and I doubt you'd want that software even if it could be ported.
[KIN Two Software Development] klamation:
Gotcha. I'm sure we appreciate the attention, though. I have dug deeper into the Kin than any other mobile device I have access to, simply to try to pull more out of it. It saddens me that Microsoft did such an amazing job at locking down a device, and they just happened to do it on the Pink series.

Honestly, I don't think work should have been made at trying to port Android to the device. Like you and others pointed out, it's such unique hardware that it's basically starting from scratch on getting drivers, etc. I have tried getting into the Os through methods that work on other Windows Mobile devices.. but again, it's too solid. :/

On the bright side, I have found plenty of bugs in the OS and tried reporting them to Verizon. They don't care, though. :)
[KIN Two Software Development] klamation:
Ah those, that's right, I remember reading them. Darn, I thought you found something useful. :(
[KIN Two Software Development] shlhu:
Hmmm... anyone tried to use the ftp client in the hidden menu? since we know the file system from bitpalm (kind of), anyway we can get files online using the ftp client to load OS updates or jar apps, or anything?
[KIN Two Software Development] johnkussack:
Yes, there are attempts on the topic (restricted because you cannot use slash symbols on the names).

I tested again the Osx sync software and as i was able to read on some websites, it has no support for DRM (only windows dude!). Nothing that, the usb protocol is a looot more simple, but i dont have the windows tools to get all the transmitted data.

Seems like the normal "kin" mode (the one you use with Zune @ windows) can access the Zune folders only, which you can see on explorer (/storage/pictures/captured/... ) using the regedit hack.
[KIN Two Software Development] cs6ceo:
Maybe the late KIN Studio has some answers

Being the owner of a KIN Twom, I was researching the original KIN Two because every aspect of the hardware of the phone is identical between the two, yet the only difference is a few software features and a hand-stamped "M" next to the model number on the label beneath the battery. So, there should be no physical difference between the KIN Two and the KIN Twom, which makes me think this link might be useful. (SEE LINK 1 IN ATTACHMENT)

The teardown provides the information and further links on the hardware, and it gives us a glimpse of what we're dealing with.

Also, the KIN Two had a web-based storage/backup site hosted by Microsoft called the KIN Studio. (SEE LINK 2 IN ATTACHMENT) The studio was used to automatically back up every single text, picture, contact, and just about everything else on the phone so the owner could go to the website on any computer, and using their Windows Live sign-on, could view/change everything on their KIN phone, without having to plug it in. It also provided the user with "unlimited" storage space, which is a possible reason the phone doesnt support any type of memory card.

So where am I going with this? The Studio could access literally everything we're trying to get at here. It seems like Microsoft simply ripped out the Studio coding from the phone software to make the Twom. Maybe there is a way to get in the phone through the protocol used by the studio? Either way, I dont think the usb cord will be much help, as it only seems to let us at the media, not the OS. The hidden menu seems to be the key, though.
[KIN Two Software Development] Antonpup:
FTP client? That's the only way I see how KIN synced with Kin Studio.
[KIN Two Software Development] johnkussack:
No. Unfortunately for all, and if you don't know it yet i will say it, reversing a dead protocol (kin studio is

gone

by now) without the server source, a client software/firmware or access to the logs inside is impossible. Would be hard to do if you got logs from the transmissions or the software client to understand what it asks to the client.

So good idea back then when it was operative: yes.

Available now, unless someone logged the CDMA/3G/wifi packets back in the day or we get the firmware: no

sorry if i sounded rough, i just was stating what happens. I do agree on the usb cord thing (posted it), but if anyone has a better idea to go or test, i'm here to read and test it.

I even used zune firmwares bootloaders through CDMA tools but the most impressive result you get is a reboot of the phone (pfff).

I dont really know, but noting that data on the air cost money, they probably used some kind of compression protocol and/or UDP protocols so save bandwith. FTP tends to be much more bigger talking about bandwith.
[KIN Two Software Development] cs6ceo:
Another look at the teardown

The teardown of the KIN Two that I originally posted reveals that the Tegra unit is mounted underneath the RAM, and it's a whole seperate chip from the actual 8GB storage chip. (See step 11) It looks like the Micro USB cable accesses the storage chip...so maybe the firmware is somewhere included in the RAM unit? I'm primarily a computer hardware person so if I'm going in the complete wrong direction here, please let me know....I won't feel bad. But expanding on this, maybe the USB settings in the hidden menu allow access to view the contents of the RAM chip?
[KIN Two Software Development] johnkussack:
Yes, that should be expected, as storage is empty and formatable (said so above), so different memory.

What you'r saying is not the solution (at least not yet) cause we have no drivers for that modes, and the only driver we have is the Zune one or raw MTP protocol (in zune and kin is MTPz).

So basically we cannot know how to operate with the devices, and i posted above what happens when i read/wrote (using c++ and usb libs) to the devices, mainly nothing works but MTP.
[KIN Two Software Development] Heratiki:
Importing Contacts

Just a small discovery but it seems I was able to import my contacts through the debug menu. IE the import contacts button was not grayed out. I went by the store right after getting the phone and had them attempt to transfer my contacts over to the phone which they were unable to do. When I got home I started putting some of my contacts in but gave up. After about a week I decided to give the debug menu a try (as I was afraid I might break something before then) so I did it up and entered the menu. The import contacts button wasn't grayed out so I tapped it and gave it a try. Sure enough all of the contacts from my old phone showed up but I know that the Backup Assistant wasn't left on my phone after I left the store but I know the debug menu had been accessed on the KIN Twom. So don't know if that helps but apparently it's able to grab the contacts (134 from my end) from over the air or perhaps Wifi. I'll see if I can do a little HTTP sniffing and perhaps catch any transactions when it happens. Can't wait to see if it's possible to get WP7 on this phone. It's an amazing phone gimped by silly software.

Heratiki
[KIN Two Software Development] kintwouser:
So the diagnostic password 000000 is part of the storage chip??? I ask because this is changeable through usb.

Thanks