Windows Phone 7 HardSPL +Dpp+Pvk+GUID+Live. - Windows Phone 7 Development and Hacking

Hi all - want to know what the status is on a hspl for wp7 and if can help and wondering how live pvk and id goes to phone in hd2-wp7 situation where no real device provisioning partition exists?!?!?!??! This leads me to think that maybe:
Perhaps with Cotulla's partition layout over 4 seperate nand areas it would be an option to modify this and his wp7 spl because the activation thing happened AFTER (live activation hack around etc) he had finished leo70 release and then..........
-whilst jtag/usb or eth/debug happening- (obviously Da_G etc thought of this b4- im just extrapolating further on this now live done after dft released- let me know if way off)- to take a HTC HD2 (LEO70) that HAS BEEN ACTIVATED ON LIVE and see where/how/when/with/which partitions, filesys, regkeys, etc, have pvk for live or the ffu and then insert a test cert like ur own xbmod/chevron. or whatever is in sdk for 7 or ce. and then utilize this to diff and comp. I dont see why not. Then .ffu then self signature.
If anyone is looking at doing this and needs hardware or I can help let me know thanks. Also:
Anyway to DUMP the newly-activated after-hack after-key after-ms-call hd2 wp7 contents completely? Any news on this unknown filesystem and sd jbod with nand? If a way to extract device provisioning partition etc. Not interested so much in live but more HSPL-for-WP7 creation to allow custom roms. Can not seem to find much on this. Anyone got ideas on own signature or other method using pre-existing leo70 nand parts as workaround maybe?
For the record - I have used a singled live key from Microsoft activation phone call more than 4 times on 2 devices and it works fine over and over: you have to consider fact that if vendor or product id was misflashed at factory onto DPP then every hardreset would not wipe this (unsure)? causing you to call microsoft again and ask for another key? eitherway:
does ne1 know what the key over the phone from microsoft is actual doing? is this key taken with say imei or serial of phone and maybe your @live.com unique GUID and seeded or used with hash or some algorithm to produce a pvk for device provisioning partition? or it simply override and enable live? are there only one type of activation key over phone? seems there could be ones maybe based on your live address+guid and ones that completely allow model and oem identification to be cleanly changed?
I am just theorizing here from what I have been reading. Finally: Is it true that uk/etc MS stopped giving out keys and referring ppl to HTC etc for
live? Any press release or official reaction?
Noticed leaked documents in another thread here marked Microsoft Confidential!

Related

Device ID Changing

I've read a few posts regarding the device ID changing from OS to OS flashes. I've been using Black from the beginning and it didn't seem to change the Device ID. Slingmedia and other programs installed OK.
I recently flashed LVSW ROM and it changed the ID. I had to get new registration codes from my programs because of this. I am afraid to flash new ROMS often now because of changing the device ID. These companies probably won't continue to change the codes for us forever.
I thought that the device ID is static based on the hardware itself. How can this change with a new OS? Can it be changed back without flashing another ROM? Can it be prevented from changing with a new flash?
The device ID is generated dynamicly after every hardreset.
http://blogs.msdn.com/jasonlan/arch...card-wipe-and-encryption-what-s-the-deal.aspx
Very interesting, but I wonder if other apps are using ( and used in WM5 ) the "same" ID ... In any case, there's gotta be a way to see and change it one way or another. "The doors are everywhere, you just have to know how to open them"
doedoe said:
The device ID is generated dynamicly after every hardreset.
http://blogs.msdn.com/jasonlan/arch...card-wipe-and-encryption-what-s-the-deal.aspx
Click to expand...
Click to collapse
I don't believe this at all. I think it's more likely the device is taking a one-way hash to the manually input device ID (see below) and SIM ID, plus some randomizer to create a unique identifier for the storage card encryption. My guess is this process runs when you check the box to encrypt the card. If anyone knows this to be different, please share how to locate the unique device ID.
Some ROMs has the Device ID (Settings -> System -> About -> Device ID) pre-populated with things like TyTn, or other text. I think the differences in some of the earlier ROMs was screwing everybody up because close attention wasn't paid to this. The first thing I've done each time I re-flash is change this to WM_[my-windows-logon], because when the device syncs with Activesync the first time, it goes with some combination of what's there plus your logon. Anyway, I've manually set this to WM_[myname] (yes, this is an example, 'myname' is not my logon) before syncing with Activesync. I've done this on Black 2.5, 3.0.1, one of LVSW's ROMs, and Custel's 2.5. I have yet to need a new sling code or tomtom code.
Maybe I didn't do such a great job of explaining this, but all you have to do is look at Activesync and see what it thinks your device ID is. If you've registered software, pay attention to this name and simply enter it after a re-flash. Multiple flashes means you need to delete the device partnership in Activesync each time, and when you manually code it to WM_(yournamehere) or whatever you have now, I bet you have no problem with sling or tomtom.
If anyone can confirm this, we should place it in the wiki.
Device ID
The device ID does not change after every hard reset, however with certain roms it can change the ID, at this time there is no fix for the changing ID problem. I also have a few programs that are teathered to the device ID instead of the IMEI.
My advice is, Keep track of which roms you load and on what dates you load them. Do like I do, before you install a new rom, run a Sprite backup (or whatever program u use) on your device (do a full, including storage card) backup. Then if your ID changes, you can reinstall the rom that worked with all your apps and run the backup app, I have had to do this several times and all of my apps are still working and registered.
You just have to decide what is more important, the rom, the working (registered) app, or continuing to ask for a replacement registration key.
100Tbps said:
Maybe I didn't do such a great job of explaining this, but all you have to do is look at Activesync and see what it thinks your device ID is. If you've registered software, pay attention to this name and simply enter it after a re-flash. Multiple flashes means you need to delete the device partnership in Activesync each time, and when you manually code it to WM_(yournamehere) or whatever you have now, I bet you have no problem with sling or tomtom.
Click to expand...
Click to collapse
It may work for those apps, but it isn't that easy for Infogation Odyssey (TomTom competitor), to name one. Has to be some deeper hashing algorithim in the ROM or whatnot. It changed around the time the 17xxx builds started appearing and I've always wondered if it could have a "dogfood" link.
Here are some MSDN articles on the issue:
http://blogs.msdn.com/jehance/archive/2004/07/12/181116.aspx
http://blogs.msdn.com/jehance/archive/2004/07/12/181067.aspx
http://blogs.msdn.com/windowsmobile/archive/2006/01/09/510997.aspx
We need a good programmer to figure this out
My Experiences
I have suffered from this very problem. My device ID stayed the dame from WM5, to XDA 0.1 > XDA 0.2 > Black 2.0 > Black 2.5
I then went to Black 3.0.1 and my device id changed. Infact, after getting a new licence string, the program that needed it (PocketHeroes) would bomb out whenever it tried to verify the new licence. This problem persisted in LVSW 3.3.
Now I am on Black 3.5 and my device id has reverted. My origional licence works fine and the app is 100% stable. My only guess is that a certain build of the kernal had a flaw with the deviceid and this has been naturally replaced by a newer version.
Device ID
The device ID (name) that is used for activesync is not the same as the device ID used for certain programs. The device ID that we are refereing to is a 12 digit code that looks like XXXX-XXXX-XXXX where X = the ID for each device.
lewnetoons said:
The device ID (name) that is used for activesync is not the same as the device ID used for certain programs. The device ID that we are refereing to is a 12 digit code that looks like XXXX-XXXX-XXXX where X = the ID for each device.
Click to expand...
Click to collapse
How can I see this 12 digit code?
Anybody going to write a program to change this? if legal!
lewnetoons said:
...clip...
My advice is, Keep track of which roms you load and on what dates you load them. Do like I do, before you install a new rom, run a Sprite backup (or whatever program u use) on your device (do a full, including storage card) backup. Then if your ID changes, you can reinstall the rom that worked with all your apps and run the backup app, I have had to do this several times and all of my apps are still working and registered.
You just have to decide what is more important, the rom, the working (registered) app, or continuing to ask for a replacement registration key.
Click to expand...
Click to collapse
I say, that is a great suggestion. :thumbsup
What's happening here is the platform ID portion of the Device ID is changing. This is because many roms here (including mine) use IMGFS components from the Universal. When this occurs, the platform ID portion of the Device ID changes from Hermes to Universal as well.
It appears that even the Official WM6 released today does indeed change the Device ID for instance with Tomtom Traffic.
I am having to take this original wm6 off now and stick with a development version of wm6 until i can convince tomtom to change my device id which they wont do. They are so useless....
just so other users are aware.

Licenced Software CAB conversion

Does anyone know if you can take a piece of software that you have purchased in CAB format, with a Licence Key and change it into a package?
Since the software isn't OEM is it still the same method to create a package?
Any Takers?
This cant be to much of a hard question!!! can anyone answer? please
Tried it with Phone Alarm. sort of worked at the second attempt. But not quite. If I spent more time on it I reckon I could have got it to work but just don't have the time.
crazyC said:
Tried it with Phone Alarm. sort of worked at the second attempt. But not quite. If I spent more time on it I reckon I could have got it to work but just don't have the time.
Click to expand...
Click to collapse
but you can actually do it? what do you do about the activation codes etc?
The code is probably just stored in the registry or a config file after you enter it, in which case just make an RGU in the package putting the right data into the right place.
Some software might encrypt the code.. but even then usually putting the right encrypted string in the right place will work.. You may have to have the owner information set exactly the same each time (as this may be hashed into the generated key) but this isnt a problem as you can set the owner information in the RGU as well.
If you get a program where you cannot track the installation to see what happens when entering serials etc.. try SKTracker.. you can use it to watch the ppc for changes to files, databases and registry and dump those changes for analysis... so you install it.. make a reference dump.. then install/register the app.. then dump again.. then compare to see what has changed.
Some apps it wont work with of course.. but i'd imagine for most it will be possible yes. The worst that happens is you have the app installed in trial mode.. and a text file burned to the ROM with the serials you have bought in it to re-register it when needed after a hard reset.
Yeah - SK tracker is fantastic. Generally it just involves exporting a reg key from your PPC and then putting it into the cab/package along with your owner name (in some cases).
All my licensed software has been set to install via cabs including the keys. Not found any that cannot be done this way.
Problems arise with more complicated installs that involve interfacing with the system. Just using the normal conversion process with the PA cab did not work, needed to run SK tracker and fix a load more reg entries that were changed by the instll prcess. Improved it but still had issues with no sounds etc. I must have missed something, and have temporarily given up. The cab only takes a minute to install anyway.

Stupid question - are ROM files REALLY ROM files?

Hi. I am relatively new with the PDA scene and as much as I would have loved to read an answer to my question from some other thread instead of starting a new one, I could not do it cos there are none. At least in "idiot's guide" style.
To the question that is stated in the title. As much as I have understood, there are (at least) three storage areas on a device (mine being Vodafone v1520) - the ROM, the EXT ROM and the files that we see on under "My Device" in Explorer. Some of the files have been marked as "ROM" if to look at the properties and those cannot be deleted (at least I haven't found any way) but they can be overwritten (with Resco or smth). The point of my question is that when I overwrite the WELCOME.GIF file (marked as ROM file, it's VF splash screen) it does overwrite it nicely (confirmed) but when I hard reset, it's back. Although I don't understand also why after overwriting I still see the VF logo instead of my own file, that is a separate issue.
The reason I am asking this is that nobody in this forum has been able to answer me how to unlock the EXTROM part on that ASUS P550 that I have. So I thought maybe if I change the STARTER.EXE or GENERALINSTALLER.EXE to something pointless, the EXTROM part won't be installed.
Although I suspect the VF logo is displayed from EXTROM part while booting, cos there is nowhere else that same file in normal storage.
Summary:
1) Does changing files marked as "ROM" really change ROM files or is it until the next hard reset and why?
2) Does anyone know how to unlock and unhide the EXTROM part on ASUS P550?
3) Does anyone know where the VF splash screen comes from while booting?
If anyone has ANY information on these issues, PLEASE enlighten me. It seems that there are a lot of senior members who have the knowledge but are quite unwilling to share it. I don't know why but it seriously sucks that they don't reply to threads or PM. I thought this forum was for helping each other, not giggling behind the screen: "I know something You don't". At least that is the impression that I have recently gained when trying to contact people that have the knowledge.
Thanks.
aiiro
The answer to your "stupid" question - "are ROM files REALLY ROM files" - is NO.
The question is not stupid and the files are really not the files.
Actually you have only the information about the files in ROM - the name, the size and other attributes. That's it.
You are not really overwritting anything when you copy the different file with the same name to ROM.
If you somehow dump the ROM from your device - you'll get real files.
Welcome Gif can permanently be changed only in dump.
Unlocking EXTROM .... I am not sure that I got what you mean. And why do you want to do that. But do the following: with Resco Registry go to
HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\TRUEFFS_DOC2\FATFS
Change MountHidden value from 1 to 0
You will be able to see the EXTROM content.
VF splash screen definitely comes from Windows folder of your device while booting - it's a part of the ROM.
OK, thanks for a quite thorough reply, but I still don't get it then - why does Resco (or similar prog) ask to overwrite the file? OR, if it doesn't overwrite it, how do I see the new file in Windows folder and the prog looking for splash screen file does not?
The EXTROM fascinates me because after hard reset the device is installing some "Auto Installation packages" and as far as I have found out those come from the EXTROM. I suspected that the WELCOME.GIF came from there too but now I am not sure. Might have to dump the ROM somehow and look into it but there are not many people with P550 and like I said those who have, don't have the willingness to help with that.
BTW, thanks also for the tip about the registry, but I have tried all the registry tweaks that I have found (including the abovementioned) but none of the works...
Thanks again and looking forward to Your (or anyone else's) comments.
aiiro said:
OK, thanks for a quite thorough reply, but I still don't get it then - why does Resco (or similar prog) ask to overwrite the file? OR, if it doesn't overwrite it, how do I see the new file in Windows folder and the prog looking for splash screen file does not?
Click to expand...
Click to collapse
Resco has been done like you have!
Try to do the following: copy your own Welcome.gif to Windows folder. You will be prompted to overwrite. Say yes. Then simply delete that file. It will not disappear - the old version of file will become visible again. ROM is not a number of files - it is one file which contains a copy of the data that later will be written (flashing process) straight to a read-only memory chip.
(Pay attention on my words "read-only")
Imagine yourself a wall painted with a hell of 100 dollar bills. You can see them. But you cannot take one of them. You can even glue you own bill upon the drawn one. It will work. But when you wash the wall (hard-reset) - your real paper bill will be washed down and the old painted one will appear (sorry for metaphor)
BTW, thanks also for the tip about the registry, but I have tried all the registry tweaks that I have found (including the abovementioned) but none of the works...
Thanks again and looking forward to Your (or anyone else's) comments.
Click to expand...
Click to collapse
Nothing works probably cause the registry is write-protected. Unlock your registry by changing the following:
HKLM\Security\Policies\Policies\00001001 = 1
HKLM\Security\Policies\Policies\00001005 = 40
But! You would do it with the digitally signed regedit. For example - one is attached. Unzip it to your device, run it, change the security policy settings, reboot. Then try to tweak your Asus again.
The attached regedit has OEM Sign 2005 - hopefully it will work for you.
Thank You for a thorough explanation and especially for the metaphore - it was very helpful.
But about the registry - wow... I mean I haven't even heard of unlocking registry...
As usually, answers are generating new questions. The ones I have now are:
1) How come some of the registry tweaks made with Resco still work even now - like showing the clock instead of battery (changing the TBOpt key) etc and the values are still there after soft reset?
2) Resco is also digitally signed, isn't it?
3) If I use this app, will hard reset still create a clean registry? (The answer to this probably is "yes" but I still ask just to be sure).
4) Can I seriously f**k up something with this method?
Thanks in advance.
But
aiiro said:
... answers are generating new questions. The ones I have now are:
1) How come some of the registry tweaks made with Resco still work even now - like showing the clock instead of battery (changing the TBOpt key) etc and the values are still there after soft reset?
2) Resco is also digitally signed, isn't it?
3) If I use this app, will hard reset still create a clean registry? (The answer to this probably is "yes" but I still ask just to be sure).
4) Can I seriously f**k up something with this method?
Click to expand...
Click to collapse
Read your PM - sure I don't have any subscriptions, but it's OK (I mean PM) - it works.
So:
1. The point is that not the whole registry is write protected - only several "important" parts mostly in HKLM. Normally - if you change someting in HKCU - it will work even with the protected registry. The vendor only protects the keys and values that can cause some "critical" system changes.
2. If to tell the truth - I know that Resco has digital signature - but anyway the permission level of it does not allow you to modify the protected keys. So that's why I offered you to use Regedit, signed with the customizers.
3. For sure - after HardReset you will return to factory defaults completely - it means you registry will again become clean and write-protected.
4. It depends upon what you mean writing "seriously". The worst thing - to damage the bootloader, but you will never do that modifying the registry. So - feel free to do whatever you want - you will always be able to return to factory defaults.
OK, thank You very much for the explanation! I have bookmarked like 200 pages related to PDAs, which means that if even only every 10th page gets bookmarked, I have gone through thousands of pages in 4 months and I haven't stumbled on this information before. So everything You have enlightened me about here is most useful, thanks again!
I hope I will not push it but since You have been so helpful and seem to know stuff, I am risking asking some more questions. First of all, would You happen to know a good "idiot's guide to flashing ROM"? I have read those on the wiki but as they are for HTC devices and asus mobile club russia does not have any basic explanation in English, it's pretty hard to catch the idea. I know that much that there is a PC involved with some kind of programs etc, but that's about it. I don't even know what the hell is a bootloader. There also isn't any good PDA architecture drawings lying around in the net
The second question is also related to hardware. I have the Vodafone v1520 as mentioned above and it has a small annoyance - the earpiece volume adjustment during call does not work. The slider moves and I hear the clicks getting louder or quieter but the volume level of the caller voice does not change. I took it to a repair shop and they told me that it's a faulty hardware but I know that there are people with exactly the same problem in this forum and I find it hard to believe that they installed some kind of faulty earpiece on all these devices. Or is that possible? What do You think?
Thanks.
aiiro
Sorry dude but both your last questions are about the specific device - your Vodafone. To answer - I should buy Asus P550 and get an experience first. It's only 700 bucks in my country but I am not sure that I really wanna have it. My current device (pretty old now) is P525 and the next one will probably be Diamond or something better and more expensive.
Second thing - I am not IT professional - I am just a user. OK, I always use my own (cooked) ROMs but it does not mean that I can give the answers to all your questions!
OK, I knew I was pushing it a little bit and in no way did I mean that You should make some kind of spendings. I just thought maybe You had any ideas and maybe ASUS devices are similar enough that they are compatible ROM-wise with each other or something like that.
Anyway, thanks for those thorough replies - You have been most helpful! As soon as I will have some time I will try the registry things out.
Thanks again and good luck!
try to install this cab file ,I make it .you can QQ me by my QQ:421264988 my E-mail:[email protected]
i'm sorry ,I chinese ,and my English is very poor
安装这个CAB文件试试,我的手机也是P320,安装完解锁成功,但在删除程序里看不到之后安装的程序,欢迎和我交流,我的QQ:421264988 E-mail:[email protected]
对不起,我是中国人,我的英语很差
Modified registry values don't survive reboot?
Try switching the device off before reboot.
The registry is not flushed to disk at every write.
And search the net for
flushing registry pocketpc
Click to expand...
Click to collapse
newxda-new said:
Try switching the device off before reboot.
The registry is not flushed to disk at every write.
And search the net for
Click to expand...
Click to collapse
So if you reset the handheld without putting it into suspend mode before, you risk losing configuration data (registry settings)?

Windows Phone 7 - ROM Deployment and how it will affect us

Windows Phone 7 has standardized the bootloader requirements for OEMs. No longer will an OEM be allowed to implement it's own design for ROM deployment (such as HTC with the .nbh/RUU system, .dz/LGMDP with LG, etc.)
The image format will be B000FF/.bin, which receives only minor changes from CE5, and so our current tools should work fine with this. The major change is in the way the bootloader handles image deployment. For Samsung and a handful of other manufacturers, this won't change too much, as they already utilize the B000FF system for deployment. The filesystem inside will be IMGFS - no longer will BinFS be used for NK/XIP section (now IMGFS will all partitions on device, NK and OS just being split by package rather than a seperate FS)
The physical flash layout will look as follows:
Reserved Regions, updateable only through a special oem-written driver to allow access to this area (size varies)
Partition Table (1KB)
BLDR (1MB)
DBSP (Device Boot State Partition, 256KB)
DPP (Device Provisioning Partition, 256KB)
USP (Update State Partition, 2MB)
ULDR1 (>=6MB)
ULDR2 (>=6MB)
NK (IMGFS, >=4.5MB) - At least 1MB free space for updates
OS (IMGFS, >=181MB) - At least 20% free space for updates
User Store (TexFAT)
Only the User Store (Which uses new Transaction-Safe ExFAT filesystem) will be user-writeable, all other areas will only be writable during an update operation. The Partition Table, DBSP, DPP, USP, and User Store are all not updateable during an update operation, only during a full-flash scenario. B00FF images are signed and checksummed, and passed through to the bootloader via ethernet over usb. The connection will most likely be encrypted, using the same flashing utility as Zune HD. (This is currently used to deploy images to the DevKits)
.ffu (Full Flash Update) file format (XML) will be used to pass information to the Zune software on which partitions are to be updated, etc. FFUs are signed just as .cabs are signed and only an .ffu which passes validation against the certificates on-device will be allowed to update a device.
Updates can also be done on a per-package basis, using the ImageUpdate process, which I have described in length @ the XDA WinMo Software Development forum. This process is largely unchanged from WinMo 6.x with the addition of a policy xml file containing security policy settings related to the .cab.pkg being deployed.
As such, I would recommend anyone interested in cracking the bootloader and creating a "HardSPL" take a good hard look at the Zune HD.
Similar to CE5/WinMo 6.x, There is a BLDR (Base Boot Loader) which makes the initial determination to boot up to the ULDR or to the WP7 OS. The OEM implements alternate boot parameters to trigger this and/or a button press combination. If ULDR is triggered, it checks the battery and power source to ensure that there is enough life remaining to successfully complete the flash, then awaits the flash download. There are redundant ULDR partitions (ULDR1/ULDR2) to facilitate failsafe recovery in the event of a failed ULDR flash (ULDR provides a basic level of functionality to enable a recovery flash even in the event of power failure during a flash)
MSFT is pushing it's Phone Update service much harder this time - it is intended to be used as the primary method for distributing phone updates. These can be deployed both over-the-air and through a USB connection with the Zune software.
subscribe to this......need to learn before my next device.
Thanks. I didn't see these threads before. Any chance you could share or point to the docs this info came from? It seems tweakers.net acquired it and I wouldn't mind looking through.
saved for future use! Da_G is the master of the roms!
As Usual Da_G you are cool..
Will you make this thread a Sticky for us? Thanks again G.
da_g said:
bump for visibility
Click to expand...
Click to collapse
bump! Bump! Bump!
Da_G you always rock, now we got a huge info.
thanks for your infos
that is some good news eventually have custom ROMs on wp7
thanks!!!!!
So you are saying that we will be able to cook for WM7, but wont be able to get a HSPL to flash it?
Well done Da_G.
Da_G said:
...
.ffu (Full Flash Update) file format (XML) will be used to pass information to the Zune software on which partitions are to be updated, etc. FFUs are signed just as .cabs are signed and only an .ffu which passes validation against the certificates on-device will be allowed to update a device.
Updates can also be done on a per-package basis, using the ImageUpdate process, which I have described in length @ the XDA WinMo Software Development forum. This process is largely unchanged from WinMo 6.x with the addition of a policy xml file containing security policy settings related to the .cab.pkg being deployed. As such, I would recommend anyone interested in cracking the bootloader and creating a "HardSPL" take a good hard look at the Zune HD...
Click to expand...
Click to collapse
Hi Da_G,
How can I get my hands on these files: not wp7 os but the other partition (dpp/bldr/uldr/imgfs/etc) contents? What IS known about wp7-fs? spl?
Do you have ANY dumps - even ZuneHD equiv? maybe the source of your .ffu info and an actual .ffu? Thanks there- pm me if you get the time. Yeah... I am noob here but interested in moving into rom-dev; used to do xbox-1+live and do have jtag, logic analyzers+trace, etc here. How would I begin? Once again: thanks and well done!
Edit/Update:
Perhaps with Cotulla's partition layout over 4 seperate nand areas it would be an option to modify this and his wp7 spl because the activation thing happened AFTER (live activation hack around etc) he had finished leo70 release and then..........
-whilst jtag/usb or eth/debug happening- (obviously you'd though of this b4- im just theorizing- let me know if way off)- to take a HTC HD2 (LEO70) that HAS BEEN ACTIVATED ON LIVE and see where/how/when/with/which partitions, filesys, regkeys, etc, have pvk for live or the ffu and then insert a test cert like ur own xbmod/chevron. or whatever is in sdk for 7 or ce. and then utilize this to diff and comp. I dont see why not. Then .ffu then self signature.
Now THAT'S cool! Thanks, Da_G!
This would mean, that we basically could get custom Rom's on WP7. Can't wait to see the first ones
Interesting info. Subscribing to it now....
Thanks or the info Da_G!!!
eh?
Did you look at the post dates before you all started subscribing? Almost a year now, doubt you'd see anything new ... but this and more 'subscribed' and a possible 'sod off' post.
Is this the only discussion on the topic? I'm sure im not the only one looking forward to having an unlocked bootloader. Any updates?
surrender420 said:
Is this the only discussion on the topic? I'm sure im not the only one looking forward to having an unlocked bootloader. Any updates?
Click to expand...
Click to collapse
See the first thread in this sub-forum.

Dumped RDC file from a RM-1063 prototype

I was able to dump the RDC that is provisioned to my 640 XL prototype. I dumped it and renamed it with a .bin extension. Have a couple of questions for those that know more about as I currently know little.
1. What is the RDC file, meaning what does it consist of? Or how is it used?
2. Where is it written when writing it from thor2? Or where is it stored on the phone?
3. Can it be re-used or is it good only for the one device it is provisioned to?
So, I am not sure if "dump" is the correct term to use here, as the command from thor2 would include the option -readrdc which sends it to a file that you choose...So it is reading something from the phone and generating a file...
I opened the file in hex editor but see little about its contents. It is small in size, about 804 bytes. I tried to write it to a different device same model but it failed with a specific error "Certificate error 25 (0x19) (0)"
Thanks.
Where to get prototypes phone?
nate0 said:
I was able to dump the RDC that is provisioned to my 640 XL prototype. I dumped it and renamed it with a .bin extension. Have a couple of questions for those that know more about as I currently know little.
1. What is the RDC file, meaning what does it consist of? Or how is it used?
2. Where is it written when writing it from thor2? Or where is it stored on the phone?
3. Can it be re-used or is it good only for the one device it is provisioned to?
So, I am not sure if "dump" is the correct term to use here, as the command from thor2 would include the option -readrdc which sends it to a file that you choose...So it is reading something from the phone and generating a file...
I opened the file in hex editor but see little about its contents. It is small in size, about 804 bytes. I tried to write it to a different device same model but it failed with a specific error "Certificate error 25 (0x19) (0)"
Thanks.
Click to expand...
Click to collapse
A RDC file is a research and development certificate tied to the device hardware it came with, it will only work on the device it was shipped with, having the same IMEI, hardware serial number and everything unique, you can't use them with other devices at all.
@gus33000
I was almost certain it was unique to the device it was installed in. Does it reside on the boot partition? Thanks for sharing.
nate0 said:
@gus33000
I was almost certain it was unique to the device it was installed in. Does it reside on the boot partition? Thanks for sharing.
Click to expand...
Click to collapse
It's in DPP along with all other provisioned data specific to the phone, you won't be able to do anything with it, just abort, you'll loose time and you'll most likely brick devices.
Was only wanting to know more about it. Thanks again.
nate0 said:
Was only wanting to know more about it. Thanks again.
Click to expand...
Click to collapse
Also as a tip, never overwrite MODEM*, SSD, and DPP with the ones from another phone, it will be destructive for prototypes. I advise you make a full backup of the prototype emmc first, before doing anything, (even if it's just reflashing with a ffu, it's very important to back everything up in mass storage using something like Win32 disk imager), if you however for some reason ever end up with wrong MODEM*, DPP and/or SSD, boot to flash app, switch to download mode, send the emergency payloads for that device RM, and write the rdc, writing it without DLOAD won't work.
DPP is the one nice to work with but never copy and replace, delete and eventually copy over onto it
I need this file
Can you help
Kidsnet said:
I need this file
Click to expand...
Click to collapse
I sold this phone along with dozens of other Lumias and Windows Phones over 2 years ago. I do not own the phone anymore, and I unlikely will find that RDC file if I even backed it up. It would be almost to you unless you are the new owner of this exact device that I dumped it from. Are you planning to use the file for any other reason?
I got a refurbished mobile came locked so i have to fl it since its demanding protection key so i need help
nate0 said:
I sold this phone along with dozens of other Lumias and Windows Phones over 2 years ago. I do not own the phone anymore, and I unlikely will find that RDC file if I even backed it up. It would be almost to you unless you are the new owner of this exact device that I dumped it from. Are you planning to use the file for any other reason
Click to expand...
Click to collapse
Kidsnet said:
I got a refurbished mobile came locked so i have to fl it since its demanding protection key so i need help
Click to expand...
Click to collapse
They are coming already locked, or if there's any tool i can download so that it will vo well with m
Sounds like the lock you are seeing is like a safety net lock. Someone must have had windows on it but had logged in with their account in Windows 10 mobile and set up the Reset protection with their Microsoft account. There is a method to remove that but it is quite dangerous and could ruin the phone.
There is a way to by pass it though as a work around so that you can use the phone but every time you hard reset it it will always lock back.
nate0 said:
Sounds like the lock you are seeing is like a safety net lock. Someone must have had windows on it but had logged in with their account in Windows 10 mobile and set up the Reset protection with their Microsoft account. There is a method to remove that but it is quite dangerous and could ruin the phone.
There is a way to by pass it though as a work around so that you can use the phone but every time you hard reset it it will always lock back.
Click to expand...
Click to collapse
@Kidsnet this is especially a problem for a lumia 640/640 xl. Because what happens is that if they upgraded it to Windows 10 mobile and enabled the protection but you reflash it back to Windows phone 8 you will unlikely set yourself up to not even get a workaround to get in the phone. Since the provisioning of W10M and WP8 are completely different.

Categories

Resources