yashsingh1/xdaforums huggingface dataset:
[KIN Two Software Development] johnkussack:
Fastest way would be to install / use Wireshark to capture all wifi packets and turn your kin into airplane mode (no 3g/over the air) and enable only wifi. If you dont see any packets from the kin IP to anywhere then the store put some file in your device like .dat or .bin or .contactsExtension, else... interesting idea...

Having Wireshark installed should take under 5 mins to do the whole test process :P.

No. I think that the SPC code (aka 000000) belongs to the part called NAM (search at wiki) which also stores your mobile number and other security issues.

NAM is writeable from the current tools (REVskills, QPST) as by default in the phones is called "KIN" and i renamed it to "KINT" (for "T"esting purposes).

Opening the "Field test" option under the hidden menu shows "KINT" so common agreement on the "Writable values".

(btw, as i cannot use CDMA here i am able to broke any thing related to it for testing :D)
[KIN Two Software Development] Heratiki:
I have wireshark installed and will attempt to give that a go tonight. I have a Data block on my phone and will also put it into airplane mode as well. Not to mention the fact that I'll just connect to my laptop through Adhoc and sniff that way. It shouldn't be a big deal but just in case I didn't want to put myself out there without a way to get it completed. I'm getting more and more excited everyday regarding this phone.

Question. I know the iPhone had a vulnerability that was able to be attacked through the browser and gain root access. Do you think it at all possible the same could be done through this machine? I mean IE8 Mobile (IE 6?) has bound to have some flaws. I guess we'll just have to see. I hope more and more people begin to assist with this phone as it's cheap and comes with no data plan making it unbelievably cheaper than most smart phones. Here's to hoping.

Heratiki
[KIN Two Software Development] kintwouser:
Thanks for the info on NAM. I also have had the import feature ungrayed twice but only after adding contacts using QPST. So I am thinking that area is the same as the password area and not of much use for getting a rom dump etc.

I am not trying to be negative only stating my own personal experiance or perhaps I am missing the point of the wifi exercise.
[KIN Two Software Development] johnkussack:
Yes. IE6 mobile is the version included. Of course is tweaked so you cannot access ftp pages or any other than http(s). You are also limited in the number of extensions, as you cannot browse direct .cab files, .zip files, etc.

Fortunately for us (a bit) it has some flaws, like his brother on pc's where some javascript overflows can bypass the limits and crash the internal IE.

I have been testing almost all the "security holes" that are available on the net for IE in case they could work and some did but the results are:

- IE6 reboot. Working later or not, probably ****ing wifi & reboot needed.

- IE6 closing. Not working later, ****ing wifi & reboot needed)

Most exploits require assembly language inside to be executed after the exploit itself, and as "our" OS is customized also noting that varies among devices, the mem addresses for windows ce functions are not the same to be called. I have no experience in mobile things nor exploits, so i left there.

Anyway, if was trying to guess a part of it that would make the explorer thing crash (and be owned) like if i was on a Guess show on TV, i would say the javascript function "XMLHttpRequest" as is not handled by the JS / IE engine but through an ActiveX object.

You know... ActiveX isnt known for being the most secure thing in the world .

I spent a lot of time coding on javascript to re-check that it was an ActiveX component, and others are "banned" from execution (like local open/save files ActiveX's.).

Yeah, i have been trying things since long time ago xD.
[KIN Two Software Development] Modestmuse:
any progress with wireshark? or any progress at all for that matter, It looks like you hhad figured out a way to work with the modded ie6 a bit
[KIN Two Software Development] Heratiki:
Due to work requirements I've been too busy to give it a good set of testing yet. I have the next 6 days off so I should have plenty of time to mess around with it and hopefully will post something.

Anyone have any preference on where I should upload the logs for viewing? Maybe just Dropbox and then make it a pub link?
[KIN Two Software Development] johnkussack:
The logs... if any, could be there or on multiupload, as it does well... multiuploads so you can pick whatever direct-download website you like.

I like megaupload, but have accounts in dropbox and everywhere anyway ;).
[KIN Two Software Development] johnkussack:
just in case that you ever think that messing with the nvm items on the kin is some kind of good idea... forget it.

now i have a little brick, possibly in factory mode, which boots, shows verizon and then tries and ota update to the modem, which fails, cause i dont have cdma here, to start. then goes in a loop

sooo i think that i have been kicked from development without a kin. donnation accepted hehe.

which i noticed...

- l+s still boots pink bootstrap

- u+s+b still boots apx nvidia thing

none let you flash ... anyway.
[KIN Two Software Development] mcdietz:
Sorry to hear that. Sounds exactly like the same thing that happened to my phone. I posted on this thread a couple weeks ago about what I was doing when mine reverted to the verizon loop. What were you doing with the nvm items when it failed.
[KIN Two Software Development] johnkussack:
Yes, i'm sorry too. Must have kept trying on the live system, without touch nvm.

I modified the FTM / Fact_mode nvitems, enabling it, and also doing a lot of changes like USB device id (from usb_networkdevice to usb_mass_storage).

That were the most / biggest changes.

I could return my phone to a normal state if i was able to enter in COM mode, and using the program again, but even after CB+Power reset (soft reset)i wasnt able to boot and during this attempt, i rebooted the config to KIN normal mode. COM didnt worked as it didnt give time to connect and so but... that
[KIN Two Software Development] Heratiki:
Well after many many tries I just can't seem to get my KIN Twom to connect through adhoc on my Laptop. So I'll keep trying and in the meantime will someone else give it a shot? If your Import Contacts button isn't grayed out then see if you can track what type of information is transfered from the phone to Big Red during the process if anything is done at all.
[KIN Two Software Development] johnkussack:
Well, just to say it.... wireshark will capture the packets within the air, not needing the kin to ask your laptop for wifi network.

I also tried to make the kin going through a "proxy" laptop, but seemed like it didn't like the idea.

So... try if you can browse the net with the kin, connected to the normal network and get captured on the laptop (just an idea). If i'm right, you should still capture its packets.

What i wonder now is... IF we even get a rom from verizon (the probably source according to other posts....) how do we flash it? hummmmm.....
[KIN Two Software Development] Modestmuse:
i will give this a try after work too!
[KIN Two Software Development] Heratiki:
Well it's a definite. The Import Contacts button pulls info from a file that is currently on the phone. I was able to delete all of my contacts and reimport them while in Airplane mode. Just to make sure I had wireshark running and no transmissions went over the line either. So now we just need to figure out where the file is located. I'm assuming that Exporting Contacts creates or overwrites the same file that is imported. Anyone with access to the file system (too afraid I'll brick my phone) able to see any new files created by using Export Contacts?

Heratiki
[KIN Two Software Development] kintwouser:
Import contacts was ungreyed but came up with an unauthorized XML file error message when I pressed it. Now it is greyed out again. I don't remember everything I have done to the phone to get it to that state. I did not notice any new files being created when i did an export.
[KIN Two Software Development] Antonpup:
Hmm my "Import Contacts" button isn't grayed out. Ima go set up Man-in-the-middle attack on my phone and press it. I'll be back with results in a bit...

Dam. I went to my browser to check if i was scanning the phone.. I was. But when i came back into Contacts menu, it was grayed out. :(
[KIN Two Software Development] Heratiki:
I'm not sure anyone else might have figured this out but to take screenshots of your phone simply hit the Camera button along with the Back button on the front. Hitting them at the same time takes a screenshot. I'm thinking this could be helpful in the future. Enjoy.

Heratiki
[KIN Two Software Development] WP7-KIN:
The KIN obviously has the potential to run WP7 or Android... With a 600 mhz processor. The KIN is obviously write-proof which makes it almost impossible to flash another OS on it... There has to be a way around the write protection but what :confused:
[KIN Two Software Development] kintwouser:
Just a couple of questions.

Is NVitems of no use to us??

The access numbers (such as programit)are not in NVitems?

Thanks in advance.
[KIN Two Software Development] johnkussack:
I bricked (factorized moded) my Kin while randomly testing NVitems. So yes, it has some usage, if you wanna have a black brick on your desk.

Otherwise, sTaY aWaY.

On the other hand, i think that reading and backuping the NV ITems on the pc seems a good idea now... for cases like mine, I mean
[KIN Two Software Development] fazi13:
Has any more progress been achieved on the Kin Two devices?

I've heard that there is a second version of the Kin TwoM that is even more locked than the original and I believe I have one of these. My device will not revert to the original Kin Two OS and simply stays with the "M" OS. However, it shows the arrow and deletes all data. Maybe someone somewhere out there is still working on the Kin TwoM? If we could contact him and he spills the beans, the Kin would become a beast
[KIN Two Software Development] BenDyer:
My phone is the newer version, but i seriously doubt it's more locked down. the only reason it doesnt have the old software is because it was created after they decided to downgrade to the kin twom firmware. So they didn't have to do any adding of firmware. i'd also like to add that this proves that it is still possible to program this phone. how else would they downgrade all the phones with the original firmware? that guy on the phone lied.
[KIN Two Software Development] fazi13:
@BenDyer I don't remember if you were there for our discussion on the FaceBook Fanpage, but we did find a few different varieties of the device and two of them will not downgrade. here's the link to the thread I created about it xdaforums.com/showthread.php?t=1049473
[KIN Two Software Development] kintworooter:
Lets try to stay on track..

Would calling/emailing people at Mark/Space be worth it? They have a phone number so we could call and might be able to offer some software help. They work in Cali, they're happy people maybe they will help us!

Idea!

Based on the theory that verizon stores can transfer contacts through a machine into/out of the Kin, maybe it can be used to extract other data. Based on This thread a company called Cellebrite makes the product. It might atleast be worth an inquiry...

Heres their site: http://www.cellebrite.com/mobile-pr...ory-exchanger/ume36-pro-supported-phones.html

mcdietz can you comment on this theory?
[KIN Two Software Development] fazi13:
Verizon stores cannot transfer contacts through the machine on the Kin. If you ask them to try, it will not work and usually the representative will also try to sync using bluetooth which will also fail. I believe that there is a complicated way to import/export the contacts using bitpim and the "secret" menu along with some other drivers for your computer.
[KIN Two Software Development] johnkussack:
MTP specification has some values for contacts. Maybe the phone uses them or was designed to. Nobody but MS and sharp should know how and where are they stored.
[KIN Two Software Development] klamation:
Actually, they can. I don't know if certains stores lack the hardware, but the one I went to on Tuesday was able to transfer my contacts from my old Moto phone to my TwoM. They reset the phone in the process (causing all my current music/contacts/etc to be lost) but the contacts are there, and the Import Contacts feature of the ##programnitt menu allows me to re-import them.)

John, how are you testing the MTP stuff? I've seen you mention this a few times, but don't know what you're doing. I'm interested in trying most anything everyone else has done, but I haven't seen details on how MTP works yet. :(
[KIN Two Software Development] johnkussack:
klamation, as you got a specific Moto Phone to see if it has MTP support (i guess you could only do a search on google to answer it). If i'm right, MTP could be what some stores use, or just luck. Maybe i'm wrong, everything could be.

About your question, MTP is an "open" specification protocol, and you can get the file that shows how to operate and what's in the protocol from the Wikipedia itself (MTP article). It's PDF with about 297pages which shows what could be done with a MTP 1.0 compliant device.

Not everything is doable on the kin (i think) and it's open to private part specification from companies (Microsoft), so part of the kin MTP may be outside that 1.0 standard specification.

What i posted, and i talk about is the output from libmtp-tools (linux software) which uses the MTP specification and calls the "GetDeviceInfo" function. Kinda complicated if not in the mood of reading documents of this kind.
[KIN Two Software Development] 4LC4PON3:
So let me ask this question. Without the support of Microsoft to give up what the phone needs to be hacked we will not be able to get the phone hacked to write to the ROM correct?

So at this point its almost useless? I was wondering because Ive been reading alot of posts on http://answers.microsoft.com & they seem to not want anything to do with the phone anymore but dont want to give what we need to hack it either.

seems that its some what of a lost cause. I really want to see the phone get hacked as well as everyone who owns one.
[KIN Two Software Development] klamation:
Thanks, I'm going to look into those more after work, or when I have some downtime tonight.

4LC4PON3, even though Microsoft would be unwilling to release the ROM, there's still a chance that we can find out something. After all, Mark/Space software is able to perform the Zune features on a Mac. Cellebrite says they support both the KIN One and Two devices, and the device they show on their website is the same one that my Verizon store used to transfer my contacts.

Hey, has anyone else had a look at the logs yet? When you log in to the PROGRAMNITT menu, one of the options is to enable the logging (Alt+Shift+Y, I believe) that will attach logs to an email, that you can send to yourself. I did this, and got a couple dozen files, with about half of them containing content. The content is all unicode or something, so Notepad++ shows a NUL every other character (rather distracting), but I'll finish reviewing those files later on.
[KIN Two Software Development] klamation:
I made a bit more progress, based on what johnkussack explained about MTP. I looked up a Wikipedia article on it and found a reference to a Mac version of software called XNJB (wentnet.com/projects/xnjb/) that I downloaded and ran. When the phone was in normal USB mode (PPro and USB Pass-Through set to off), I was able to connect to the device and browse through some of it. Under the Data tab, it showed three items:

<null>

cellebrite.contacts.xml

Pictures

As I suspected from before, the cellebrite.contacts.xml file is what Verizon used to import my contacts from my old e815 to this phone. The Pictures folder contains the images I imported through Zune for PC, plus pictures I took through the camera.

The only complication is this software is not letting me upload or download anything to the phone. It could be a limitation on the software; I'm not sure. I checked the logs when trying to retrieve the contact file, and found:

Error downloading file ((2) PTP Layer error 02f3: LIBMTP_Get_File_To_File_Descriptor(): Could not get file from device.;(2) (Look this up in ptp.h for an explanation.);)

I guess I need to get something set up on a Linux or Windows partition, unless anyone else has any ideas?
[KIN Two Software Development] johnkussack:
Great to hear it. You could attach the file to us labeling contacts to "FOO" and numbers to "999999" or anything else, so more people can enable contacts in the future (even hacks).

And as i said time ago, you need specific "hardware" operations for the kin, and dont wanna post a wall of text explaining how to (and i dont really know the details). To solve that problem, as i said in another threads, i need a normal device (not bricked) and some specific pack of software, which i dont have ready ;).
[KIN Two Software Development] kintworooter:
@John, We could pool together money to pay for a new KIN. Are you writing the software? Programers could help ya write it and the rest of us could raise funds.

What do you think about this? Ofcourse it all assumes you are able to do it..
[KIN Two Software Development] johnkussack:
Although i would like to accept that idea, i am not an expert on this and dont wanna be blamed for receipt a device and dont get things done later (cause of no way to success from my tests).

Anyway, as i'm in pro of this hacking movement, i posted the way-to get what i wanted on a separate thread, as it was a big wall of text, and dont want to write it again ;).

Anyone can follow that and get things done through testing (even if it takes lot of time testing).
[KIN Two Software Development] Michael Kohan:
Hey i have a mac and i downloaded the software XNJB that klamation was talking about i dont know much about phones and when i plug it in it isnt recognized how do i set the PPro and USB Pass-Through to off. Sorry if im being annoying but i really want to help however i can.

Thanks
[KIN Two Software Development] ishbarbarian:
hello so i have been following the discussions( i really want android) and experimenting on my own a little. i tried emailing myself the logs from the phone. i unzipped them and plugged my phone in and set it to usb pass through. i then used the logs as drivers(crazy i know) but it seems my phone is now in a new usb mode when i look into the secret menu it says tethered/ unknown and ppro and usb pass threw are grayed out. im not sure how much this helps( if im just being stupid tell me) but i think it could be a new approach
[KIN Two Software Development] klamation:
I just checked the log folder and didn't see any .inf files in it, so Windows doesn't let me use them as a driver. If you can duplicate this, can you check your device manager to see which file you're actually using as a driver for the phone, when in this state?
[KIN Two Software Development] ishbarbarian:
heyyo so i tried and cant repeat it... weird but it defiantly did something different.. maybe it was just and error
[KIN Two Software Development] ishbarbarian:
Is anyone still working? or have we bricked all the kins?
[KIN Two Software Development] klamation:
Hard at work! Just very slow progress. I've done some tests for JohnKussack, however the differences between my computer and his made the results unreadable. He should be getting a new phone to work with soon.

Right now, the first goal that he has (and I agree with) is to try and get rudimentary read/write capabilities to the phone. Even if we aren't able to touch the OS-level portion of it, if we're able to duplicate what Mark/Space and Zune are able to do, and maybe a little more, I'd call that a decent step.

As for coming up with a custom build of some OS for it, that is highly unlikely, unless some really good Android developer can be convinced to do it. The hardware is not standard that there are drivers for, plus to be able to image it AND get it working on the Verizon network.. I don't think that'll go.
[KIN Two Software Development] ishbarbarian:
heyyo so i found that real player can also sync with the kin.

im not sure beyound this is what to do. i plugged it in an zune complianed that real player was using hte device so i opened it up and sure enough i was able to sync music and videor since realplayer if im not mistaken is much freer with the software code then maybe we can reverse the proticals and at least gain axcess to the hard drive or at least see what drives it uses
[KIN Two Software Development] johnkussack:
Unfortunately you are. Real soft is not the opensource standard btw.

I already did a few threads below this one. I'm inspecting the "hard drive" as you said, although it's not a hard drive "as is".
[KIN Two Software Development] johnkussack:
Hey guys, i dont wanna flood the forum with threads, so i will just put it here.

There is a *way* (hahahack) to use Kin with the xna extensions in xna device center.

Unfortunately, the kin is not so happy about using xna, so the version provided is refused, hence cannot deploy Xna apps. A pity :|
[KIN Two Software Development] Heratiki:
Hmmm... So what does this mean JK? I've never used XNA?!?!
[KIN Two Software Development] johnkussack:
You probably wouldn't use it if i didnt mention. It's a "pack" made by MS so you can make games for the xbox and also, for Zune devices.

You need a zune or a device recognized as a zune (HD). Unfortunately, we have any luck with the kin. But if you... do some little tricks, it is "ok" for the app and it connects to the kin.

Bad news are that Kin has no xna Framework (the part who runs the games) in its belly, so it doesnt understand what i was sending to it.
[KIN Two Software Development] DarkMelon:
Is it possible to flash an XNA framework on the KIN?

*Nevermind just read one of the threads on here.
[KIN Two Software Development] azhockey:
Have we looked into what the phone accesses when R,B,and POWER are held at the same time? I saw that this reverts the Two M to the original OS. My thought is if we could just figure out how to jack into that process which reverts the OS maybe something could be sideloaded at that time. Wishful thinking maybe.
[KIN Two Software Development] johnkussack:
We can't look about what it does.

In any case, i told it. It was coming from the Verizon OTA update/upgrade, although many of you disagree with that opinion.
[KIN Two Software Development] azhockey:
What about a TIFF exploit like the PSP used?

http://pspslimhacks.com/chickhen-released-homebrew-on-all-psps/

Is the KIN vulnerable to this type of "attack"?
[KIN Two Software Development] Marcellus1:
I haven't tried syncing a TIFF file to the Kin to try and view it, but you can't save a TIFF file from an email, or download or view the TIFF file from the browser. It would seem that any TIFF exploits are not likely applicable...
[KIN Two Software Development] johnkussack:
only JPEG filetype is supported by the Zune software on the kin, so that's the only file you can upload and view to trigger exploits.

On the other hand, even if a jpeg exploit works, you need the .bin or similar file to load, which seems to be designed for the psp kernel which has no relation to the kin OS or OS kernel either.
[KIN Two Software Development] azhockey:
So this has probably been patched right? In the KIN OS that is:

http://www.f-secure.com/weblog/archives/00000301.html
[KIN Two Software Development] klamation:
That only effects desktop versions of Windows, not the Mobile versions. It's a completely different OS. :(