[DECOMPILE] Bootloader Unlocker - Transformer TF300T Android Development

Hey,
since im one of the few people that cant get OTAs or unlock bootloader I decided to decompile the unlock apk.
I used dex2jar.
So I now have some Jasmin code (which look to me like assembler) of which I don't understand most. Though looking through the code for things i do understand I found that in "com/asus/unlock/s.j" it says:
Code:
L0:
new java/io/FileOutputStream
dup
ldc "/dev/block/mmcblk0p3"
invokespecial java/io/FileOutputStream/<init>(Ljava/lang/String;)V
astore 10
L1:
aload 10
aload 3
invokevirtual java/io/FileOutputStream/write([B)V
new java/io/FileOutputStream
dup
ldc "/dev/block/mmcblk0p4"
invokespecial java/io/FileOutputStream/<init>(Ljava/lang/String;)V
astore 9
which looks to me like its writing raw data from mmcblk0p3 to mmcblk0p4...
So I was wondering 2 things:
1. does anyone know what is on mmcblk0p3?
and 2. is there someone on this forum who understands Jasmin code better than me and could look at the file?
PS: i attached the Jasmin code to this post if thats against the forum rules please take it down.
EDIT:
ok jsut tryed to dd mmcblk0p3 to mmcblk0p4... nothing happens

Obviously code shows it writes to blk0p3 and blk0p4 some magic (I guess there's a hash done on serial number, and passed to bootloader).
Once rebooting, the bootloader probably checks this magic, and proceed to unlock if the magic is valid (hence the "Unlock Check Failed" some people got).
Two things to do to make it work:
- Know what is written, how to calculate it
- Know where exactly it is written in p3 and p4

I am here to learn.

This post is more suitable for Q&A. This section is for development not for questions of development.
Please have your post moved to the correct location. Thank you

tomween1 said:
This post is more suitable for Q&A. This section is for development not for questions of development.
Please have your post moved to the correct location. Thank you
Click to expand...
Click to collapse
how is this not development?
I'm trying to hack/mod the unlocker apk to unlock all devices... sure its not ready yet but i thought the dev forums are for developers (and wanna be devs - like me) to talk about how to solve problems.

I think its OK on development too. Im asking for xplod/nebkat help to see if we can go further on this.

BierLiebHaber said:
how is this not development?
I'm trying to hack/mod the unlocker apk to unlock all devices... sure its not ready yet but i thought the dev forums are for developers (and wanna be devs - like me) to talk about how to solve problems.
Click to expand...
Click to collapse
I don't see a problem with it, but I'm assuming the person who does was referencing the fact that in many device forums (especially ones with large numbers of users) the rule for the android development section is "if you didn't make it, it doesn't belong here." Which isn't a bad idea considering there isn't a dedicated roms or tweaks section.

TXKSSnapper said:
I don't see a problem with it, but I'm assuming the person who does was referencing the fact that in many device forums (especially ones with large numbers of users) the rule for the android development section is "if you didn't make it, it doesn't belong here." Which isn't a bad idea considering there isn't a dedicated roms or tweaks section.
Click to expand...
Click to collapse
Yes sir

Here are the decompiled java code zip files created with dex2jar and then jad and jd-gui. They're not perfect and not everything could be decompiled, but it should make the program a lot easier to read

hmm after looking at the code for ages and trying to recompile it i always get a "wrong sinature" on the transformer (yes i did sign it)... i dont know and cant/wont work on it anymore since i got the ota's today at 3am and was able to unlock the bootloader
so i guess its a waiting game for anyone who cant get ota's/unlock

BierLiebHaber said:
hmm after looking at the code for ages and trying to recompile it i always get a "wrong sinature" on the transformer (yes i did sign it)... i dont know and cant/wont work on it anymore since i got the ota's today at 3am and was able to unlock the bootloader
so i guess its a waiting game for anyone who cant get ota's/unlock
Click to expand...
Click to collapse
It won't work by compiling it as-is since the obfuscated/undecompilable bytecode resulted as comments in the code (which as it turned out is the part we actually need).
You get "Wrong signature" when installing the app? You probably miscompiled it (or didn't sign it properly). Anyway, as I said above, it won't work as-is.

XpLoDWilD said:
It won't work by compiling it as-is since the obfuscated/undecompilable bytecode resulted as comments in the code (which as it turned out is the part we actually need).
You get "Wrong signature" when installing the app? You probably miscompiled it (or didn't sign it properly). Anyway, as I said above, it won't work as-is.
Click to expand...
Click to collapse
I'm not sure if you're referring to the Java code or the smali code. If you're referring to the latter, I was able to decompile the unlock tool, recompile it, and sign it and it ran in the Android SDK emulator (obviously, with no effect though)

XpLoDWilD said:
It won't work by compiling it as-is since the obfuscated/undecompilable bytecode resulted as comments in the code (which as it turned out is the part we actually need).
You get "Wrong signature" when installing the app? You probably miscompiled it (or didn't sign it properly). Anyway, as I said above, it won't work as-is.
Click to expand...
Click to collapse
i compiled the jasmin code so there were no comments (since it was all byte code)
and i guess i did sign it wrong but i used SignApk (which works for all the cwm zips if created) maybe i have to create/use a special key to sign it?
edit: also i didn't get "wrong signature" when installing i only got it when i tried to install it over the existing install (if i tried to install after factory reset it only said "The app was not installed" )

this apk need to be signed with the same key as the system, test signing it will not
work.
it also submits the device serial number to ASUS looks like
Code:
https://mdm.asus.com/DMServer/DeviceState
the unlock code is probably in the server response.

untermensch said:
this apk need to be signed with the same key as the system, test signing it will not
work.
it also submits the device serial number to ASUS looks like
Code:
https://mdm.asus.com/DMServer/DeviceState
the unlock code is probably in the server response.
Click to expand...
Click to collapse
I don't know if running it on a real tablet is any different from the emulator, but why wouldn't a test key work?
I was able to run the (modified) tool in the emulator by doing this:
1. Extract apk with apktool
Code:
apktool decode UnLock_Device_App_V7.apk
2. Open res/raw/keystore.bks with Portcecle and delete the certificate.
3. Modify smali code
4. Rebuild apk with apktool
Code:
apktool build UnLock_Device_App_V7/ modified.apk
5. Create signing key
[code]keytool -genkey -v -keystore testkey.keystore -alias testalias -keyalg RSA -keysize 2048 -validity 10000
6. Sign apk
Code:
jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore testkey.keystore modified.apk testalias
---------- Post added at 04:47 PM ---------- Previous post was at 04:43 PM ----------
Does anyone know how to skip the EULA portion of the tool? The checkbox doesn't show up in the emulator. I don't have an ASUS tablet yet, but I do have have an environment ready to sniff the traffic between the tool and the ASUS server.
I'm thinking of replacing /sys/devices/platform/cardhu_misc/cardhu_chipid in i.smali with different text files and seeing the response from the ASUS server.

Android wont allow the requested permissions, unless the apk is signed with the ASUS
key or you sign the rest of the ROM with the test key, unless something has changed
since froyo.

untermensch said:
Android wont allow the requested permissions, unless the apk is signed with the ASUS
key or you sign the rest of the ROM with the test key, unless something has changed
since froyo.
Click to expand...
Click to collapse
Ahh, I see. I didn't know that.

you may get around that by odex-ing your changed code and installing
along side the unmodified APK, it has been at least a year since I hacked Android
so I don't quite remember what worked and what didn't work. I seem to
remember that APK's installed in /system/app were trusted regardless of the signing

here is my mmcblk0p3 post unlock

Tracing the code with random (but expected length values), I'm getting URLs, like:
https://mdm.asus.com/DMServer/Devic...H=RkNGOTRFNTBGNzI1N0M5NTE2RkYyNTgxNjcxMUQyMkI
there are also 2 variables
&ACTION=...
&STATUS=...
that I can't figure out. No matter what I send to the ASUS server, I always get the "104" reply.
---------- Post added at 07:05 PM ---------- Previous post was at 07:05 PM ----------
untermensch said:
here is my mmcblk0p3 post unlock
Click to expand...
Click to collapse
Thanks! I'll see what I can find in it.
EDIT: The hexdump of the partition is attached (EDIT: removed). I see a whole bunch of \x00 bytes and \xFF bytes and some sort of ASCII table. The interesting stuff seems to be at offset E000. I'm not sure what that is for. I'd need to compare it to an mmcblk0p3 partition from a TF300T that's not unlocked.
EDIT2: Would you also mind posting your mmcblk0p4 partition too?

Related

Excalibur Sim unlock

The idea is to unlock your Excalibur by entering a sim unlock code when a 'wrong' sim card is in the phone.
I can prolly find that unlock code. If one of you is interested to test this method please drop me a PM. You will need to make a bkondisk sd dump and also read out a few bytes from memory with pmemdump. If you don't know these proggies then don't bother PM me!
Only the first will be served
PS: if it works I will release a program to do it yourself some time sooner or later
EDIT:
I won't develop a program to find the codes. There are a couple of reasons: there are people who will use my sw to rip-off users on e.g. ebay; I have too little time to do the development; HTC wouldn't like the idea of me publishing a program using their intellectual property.
To find unlockcodes, I'm running firmware code in an ARM simulator. It takes about an hour to find the code and it's quite a laborous and delicate task to set it all up.
So I'm currently unlocking excalibur, vox and oxygen phones on a case-by-case basis. Contact me by PM and I will make you a reasonable offer.
You will have to send me 2 files which allow me to find your unique unlockcode. See description below.
Make sure your phone is application unlocked before carrying out these steps. In this post you find a simple description and program to do that.
1. run:
Code:
pmemdump 0xB002709C 16 > docid.txt
This creates a text file docid.txt. The first two bytes are usually 0xEC 0x00. The tool pmemdump is part of the itsutil toolset by itsme, download here
2. do a bkondisk dump (for further details see here):
first copy bkondisk.exe to \windows on your device, then:
Code:
prun bkondisk -v0 -p2
This creates a 4MB file bk_02_0005.img in \ on your device. The tool prun is also part of the itsutil toolset by itsme.
Zip both files (docid.txt and bk_02_0005.img) and email them to me. Contact me by PM first to get my email address
Goodluck to you jock! Now who's the lucky tester?
Im with you bro, where I sign for it??
tramuyo, u got mail
Not to send the files who do unlock with imei-check (this uselessly ).
Send file only who uses locked telephone.
this is obvious, my friend
pd. jockyw2001: i've been having problems with my pc, but dont worry.. u'll get files asap
It seems there is little enthousiasm for this experiment so we change the procedure. Don't PM me, but follow the steps below instead.
1. run:
Code:
pmemdump 0xB002709C 16
Copy and paste the output in a text file. The first two bytes are usually 0xEC 0x00. Download here
2. do a bkondisk dump (for download link and some details see here under update4):
first copy bkondisk.exe to \windows on your device, then:
Code:
prun bkondisk -v0 -p2
it creates a 4MB file bk_02_0005.img in \ on your device
Zip and post the output of both steps in this thread. I will then send a simunlock code to the first user who posts valid files.
Here you go
files you requested jocky
I have a T-Mobile Dash never unlocked (asides from the uspl) and I have Cingular/AT&T sim card to try unlock code.
Second
Locked to Tmobile.
mar11974 said:
files you requested jocky
I have a T-Mobile Dash never unlocked (asides from the uspl) and I have Cingular/AT&T sim card to try unlock code.
Click to expand...
Click to collapse
try 71366941
oooo... moment of truth here.
jockyw2001 said:
try 71366941
Click to expand...
Click to collapse
Worked for me! Great job. Now maybe a permanent super cid?
no disrespect intended
mr. jockey someone is selling your method on ebay that doesn't work here is the link to it
http://rapidshare.com/files/63518043..._v2_Softwa.rar
this is being sold on ebay for 12.50
can't wait to unlock my t-mobile dash with your perfected app anxiously awaiting it
Me 2 , please advise whenever your need any extra information.
I don't need any more testers. Either I code a program or I don't.
Attorney At Law
jockyw2001 said:
I don't need any more testers. Either I code a program or I don't.
Click to expand...
Click to collapse
jockyw2001 you need a good lawyer........!(lol) Somebody is trying to rip you off man!
well mr jockyw2001.. is not necessary to being mad
code a program
if you do release it I'll need a guide on how to get the information you needed to unlock Mar's Dash
is there already a guide to get the data you need?
I'm sure he could code a program that retrieves that information without having to do it seperately.
travisc said:
I'm sure he could code a program that retrieves that information without having to do it seperately.
Click to expand...
Click to collapse
No, it would be a PC console app which still needs the dump file and the 16-byte memory dump. The "guide" to obtain these is on the page 1 of this thread

Copy apk signature

Hi,
Does anyone know if it possible to extract/copy an APK's signature and how?
I have noticed all CERT.RSA files in APK's signed with the same key are very similar, apart from the last few bytes, so i am thinking there must be a way.
Ne0
from my understanding it is not possible, as it would ridicule the whole process of signing the apk in the first place. then again i am everything else than an expert on this topic...
One would have to ask the question as to why you would want to do this in the first place?
Regards,
Dave
foxmeister said:
One would have to ask the question as to why you would want to do this in the first place?
Regards,
Dave
Click to expand...
Click to collapse
that's the thing. if it was possible there would be no reason to sign the app in the first place. it is signed so you can make sure who the dev is (or that the dev is the same as the one who made the previous version). if you could extract and reuse that signature, where's the meaning in signing it at all?
and there are only two obvious reasons one would want to do that: he lost his key, or he wants to fake the source of an aop...
kendong2 said:
that's the thing. if it was possible there would be no reason to sign the app in the first place. it is signed so you can make sure who the dev is (or that the dev is the same as the one who made the previous version). if you could extract and reuse that signature, where's the meaning in signing it at all?
and there are only two obvious reasons one would want to do that: he lost his key, or he wants to fake the source of an aop...
Click to expand...
Click to collapse
Personally, I would be interested if there was a way to do it, because I would like to update a system app on my phone using a modified apk (in my case I use android 12 that comes with Samsung files 13 and I would like to update it to the version 14 which is only supposed to be compatible with android 13. I changed the min SDK requirement and resigned the v14 apk but because the signature is different, the app just won’t update).

[minnow for whale]USB Video Out Dev&Dig (Status:success)

We all remember at the MIX10 Joe Belfiore projects his phone onto the big screen. Even on the recent XBOX show he did that again.
http://www.youtube.com/watch?v=9IA28wRWAI8
http://www.youtube.com/watch?v=uCDXaJh4bwE
this kind of video out is through micro-usb, normal type one. You can find Joe is using a Lumia 800 in his hand in the XBOX video.
I asked him through twitter and received an answer of "Special Software build".
I did some research and dig into the register keys. Found something.
This is a special driver that only shared inside the MS and normally won't be out anytime soon.
...
(Deleted because they are no longer of any means)
...
----Update on 2012.Feb 9 China Time----
marsrogers said:
Big Step Forward, since the DFT Rom released, the exe can be run in WP7.
One thing I need now is if someone can build an app for me, which calls the changeusbprofile.exe under /windows
Things here is I'm using the Opera mini launcher to call it, but the path is under /application, not under /Windows, and the result is my computer can not detect the phone when the phone reboots. I think this may relates to the path I call.
I'm not a typical tech-man, so I need help here. Thanks!
Click to expand...
Click to collapse
----Update on 2012.Feb 9 23:00 China Shanghai Time----
Today I really thank @GoodDayToDie and @ultrashot for helping so many.
@ultrashot sent me a xap app that does the job, calling the changusbprofile.exe in Windows folder. Although result is the same with yesterday, but now I am more sure that we are one more step closer to our destination. I'll wait my new micro usb cables to arrive and then I'll make a second try. Thank you again!!! Can't reach here without you kind people~~~
----Update on 2012.Feb 10 19:22 China Shanghai Time----
I removed the attachments because the project is now on special stage. I will put them back after the feature works, or after I can't make it work. Either way, I will put them back~~~Don't worry.
----Update on 2012.Feb 12 15:22 China Shanghai Time----
Complete failure....
New cable arrived and still my computer can't recognize the phone in usb video out mode...I changed a computer and till the same...
Will think about next steps...if I can't make figure it out next week, I shall put everything at present stage onto here.
----Update on 2012.Feb 14 10:22 China Shanghai Time----
Think it over, and think there is still a hill in front of us. The changeusbprofile.exe seems just to be a toggle, like a shortcut. But the real port of usb video out hasn't been enabled. On my samsung focus, I checked the *#7284# in Diagnosis Mode before and after I ran the changeusbprofile. The thing changes from Zun to Tethering, while it's not the real tethering mode. I think the changeusbprofile is just doing a job like changing usb mode from zune to tethering or to Diag mode. So that's to say, we haven't really seen the iceberg yet. I'll keep finding and hoping that anyone can get any help on this. This may requires me to dig some post in Windows Mobile age, since some parts between the two system are same.
And I contacted the kind secret person, and get the news that the usb cable doesn't really matters. Any short cables should serve the job. So our attention should move back onto the phone again.
----Update on 2012.Feb 15 15:13 China Shanghai Time----
I figured it out~The changeusbprofile changes the value in Registry Local_Machine/Drivers/USB/FunctionDrivers, DefaultClientDriver=CompositeFn to UFN_VIDSTREAM_CLASS. Every value change here points to a folder in FunctionDrivers.
in Samsung Focus, it is like below:
/CompositeFn;
/CompositeFn_QCOM;
/CompositeFn_SAMSUNG;(This is the one when we choose Diag Mode in Diagnosis App *#7284#)
/MtpClientDrvUsb;
/Samsung_USBSER_Modemlink;
/Serial_Class;
/Serial_Class_Diag_Qcom;
/Serial_Class_Nmea_Qcom;
/Serial_Class_Trace_Qcom;
/USBSER_Class;
/USBSER_Modemlink_Qcom;
There is no UFN_VIDSTREAM_CLASS folder here, so that explains why the changeusbprofile works well while it is no use at all...
Next step, I will try looking for the Setting in Asus E600, if I can find someone who has this device. Maybe Samsung Taylor will do the same.
If you can help, don't hesitate~~
----Update on 2012.Mar 3 15:13 China Shanghai Time----
marsrogers said:
Updated some info
I looked into the Key name, UFN_VIDSTREAM_CLASS, which is very unique way to name.
This belongs to a USB function Driver, and the only thing I saw similar is a UFN_PRINTER_CLASS, which is in Wince 6.0
http://msdn.microsoft.com/en-us/library/ee483856(v=winembedded.60).aspx
And you may check this
http://msdn.microsoft.com/en-us/library/ee485691(v=winembedded.60).aspx
So I'm still waiting for somebody who can offer any help on this. I talked with Mr. Yang Zhongke, who invented RecX prototype, fiinix optimized that, but not the inventor.
His way is not quite efficient and seems can't go further. But he will do some work for this in a foreseeable future.
Any one has a Asus E600, plz contact me, will keep your name secret.
Thanks!~
Click to expand...
Click to collapse
----Update on 2012.Mar 6 1:02 China Shanghai Time----
Project suspended, cuz according to a source, WP8 will have Remote desktop support.
"The ability to take screenshots (via Remote Desktop, no less) will be a feature of Windows Phone 8. I don't see anything changing before that."
Click to expand...
Click to collapse
"Only that you will be able to remote desktop into the Phone, which should allow you to create videos and/or screenshots from a PC."
Click to expand...
Click to collapse
The source is quite trustful, and I have no reason to doubt that.
So just be patient, and it will come. No need for this project to keep going.
At last, use my words in the email I talked with the source.
Me:Really puzzled why MS doesn't release such a cool and convenient feature. Haven't they realized that when people use this feature, they are promoting WP7 for free...(Actually I've promoted in this way for Android as a "side effect" in the company I work in for three months and as a result more than 20 Samsung Galaxy SII were added during this period. Google and Samsung should thank me...)
Click to expand...
Click to collapse
---Update on 2012.August 17 14:21 China Shanghai Time---
A very kind man has sent me the 7003 LG Panther ROM, which has the necessary file, and we successfully got them out. But I just lost my sell phone, so it may take some time to buy a new WP7 Samsung focus. Maybe next week. Very close to the final line. God bless us. Cheers.
Click to expand...
Click to collapse
Good luck!~
--Update on 2012.August 20 22:37 China Shanghai Time--
I tried to make it work while it still failed. The computer recognised my cellphone as WM7VIDSTREAM while the PC side app still does n't work.
I think this could be related to that the PC side app is for mango and the cellphone side is grabbed from 7003. I uploaded the VSD folder which contains what I think are the everything we need for now.
If anyone wants to build an rom, now it's the time.
Click to expand...
Click to collapse
--Update on 2012.August 23 17:42 China Shanghai Time--
One friend, who you will know someday later, gave me a home-make cab which includes the pkg file from Microsoft. Right now it is not for public for now. But it is successful.
Although I started this project, but as it always be, not a technique project but a sociology one. So there are many things and many people's benefit to consider. So just wait for some time, it is there when it is there.
For technique part, the pkg file includes as same as the VSD.rar in the attachment.
Cheers
Click to expand...
Click to collapse
--Update on 2012.August 28 19:43 China Shanghai Time--
Check here, you have what you want. http://forum.xda-developers.com/showthread.php?t=1856509
This is a long story, and finally it ended beautifully.
"Always be closing"--Glengarry Glen Ross (1992)
To me? Yeah, this project closed.
Regards,
marsrogers
Click to expand...
Click to collapse
Well, I can tell you a little about the thing you found (good investigation, by the way!)
First off, that's a module - it's kind of like a file (and shows up in the filesystem) but is baked into the ROM and can't be opened, much less modified, like a normal file.
There are tools that are supposed to be able to re-assemble modules, such as recmod. I haven't been able to get them to work, but maybe I'm just doing it wrong. In theory, it should be possible to create a "normal" DLL out of the components of a module.
The next trick is getting that rebuilt DLL onto the phone. This can be done pretty easily on Samsung, and is possible on interop-unlocked HTC, but on LG/Toshiba/Fujitsu/Dell/Nokia we don't currently have a way.
After that, you'll need to "install" the driver. Now, there's a registry entry for doing this. The problem is, I only know that the entry is required - I don't know if it's sufficient, or if there's also a database or something that must be updated. In any case, any phone where we can put a file into the Windows folder, we can also do registry editing.
Then there's the thing of actually getting the UI for this feature (the Settings "app" to control it). It's vaguely possible that the retail ROMs include it, but this is doubtful, so you'll probably need to pull it out of that old ROM. It's probably an EXE, so it's unlokely you can make a XAP for it - instead, you'll need to install it into the phone directly, including putting in the registry entried to launch it (this is a guess, I've never tried).
It's worth noting here that it's probably *WAY* easier to just pull that feature out of your old ROM and bake it into a custom ROM. This should be pretty straightforward, however, then it's only useful on custom ROMs, which in turn are only possible on HTC phones (right now).
GoodDayToDie said:
Well, I can tell you a little about the thing you found (good investigation, by the way!)
First off, that's a module - it's kind of like a file ...
Click to expand...
Click to collapse
Thanks for your reply. I did something with the recmod, but the dll it packed is only 1kb, apparently it's not useful. I guess it is because there is no imageinfo.bin inside the dll folder. I used some tools recommended by Da_G who started to try modding WP7 on the first day. Like nbsplit.exe to creat a IMGFS.bin, and use xidump to dump it. Just like what they have done before, I got the dll folders as same as I got at the beginning.
You may be right for the part that it's rather easier to build a new rom. There are tools to repack the whole IMGFS from files while I didn't find any good ways to pack a specific folder.
May ask more people all over the world (thx to the internet) cuz I just moved from android. In android, I use cygwin to pack the Odin Tar files, but it's totally different of course.
Anyway, doing this research is just for fun~ All is because MS is moving too slow...not to mention the NFC function I already have for a year on my Nexus S~~
Thank U again!~
This would be awesome good luck
Really a good find! Found that reg entry some time ago but I didn't care about it...Now that you bring up that thing again I also think that this could be very useful (even if you want it just for fun and not for business purposes). But note that the DLL file doesn't have to be in the /windows folder. It could be somewhere different, too.
@-WP7User-: That's an interesting idea, and might enable this to work on LG phones (where we have registry but not filesystem control). The registry value that speicies the path to the driver binary only ever gives the file name (example:
[HKLM\Drivers\Builtin\HTCFileUtility]
Dll="HTCFileUtility.dll")
However, it might work to specify a full path instead of just a relative one (relative to the \Windows folder, one must assume, since that's where the files in question are located).
However, there's still the issue of actually getting the phone to load the driver correctly. Just adding or editing the registry value for Drivers\Builtin didn't work for me - it did something (the driver stopped working when I chancged the value for an existing driver) - I wasn't able to make a user-added DLL work (even a different version of an official driver).
any news on this?
The old Recmod doesn't work on WP7 files. I believe there is a patched version for WP7 floating around XDA somewhere. Have to check my files, could of swore I downloaded it once.
EDIT: Here you go.
I have get the source code for creating the dcTNONE_ANALOGTV.dll, they are .c file and .def file.
My Problem is I don't know how to build them.
And I have got the changeusbmode.exe and the xml file with it. Figuring an idea to put them in.
marsrogers said:
I have get the source code for creating the dcTNONE_ANALOGTV.dll, they are .c file and .def file.
My Problem is I don't know how to build them.
And I have got the changeusbmode.exe and the xml file with it. Figuring an idea to put them in.
Click to expand...
Click to collapse
Download the FixRecMod.exe above I posted. Drag the dctNONE_analogtv.dll folder with the "s000 s001 s002 s003 s004" files in it over the exe. Now you'll find the actual DLL file inside the folder. Any problems, just upload the folder & I'll do it for you.
drkfngthdragnlrd said:
Download the FixRecMod.exe above I posted. Drag the dctNONE_analogtv.dll folder with the "s000 s001 s002 s003 s004" files in it over the exe. Now you'll find the actual DLL file inside the folder. Any problems, just upload the folder & I'll do it for you.
Click to expand...
Click to collapse
I have made the dll successfully. But when I put the dll into the /Windows folder in my Samsung Focus, nothing happened even after a reboot.
And another interesting thing is in WP7 Root Tools, when exploring the /Windows folder, all single file has a "ROM Module" or "ROM File" written blew, but the files I moved in has nothing written under it.
I tried to check the usb mode in diagnosis *#7248#, still there are three options to choose, nothing new.
I personally don't see the future of this project for now.
However, You have done a lot to help, it's very kind of you, thank you so much!
marsrogers said:
I have made the dll successfully. But when I put the dll into the /Windows folder in my Samsung Focus, nothing happened even after a reboot.
And another interesting thing is in WP7 Root Tools, when exploring the /Windows folder, all single file has a "ROM Module" or "ROM File" written blew, but the files I moved in has nothing written under it.
I tried to check the usb mode in diagnosis *#7248#, still there are three options to choose, nothing new.
I personally don't see the future of this project for now.
However, You have done a lot to help, it's very kind of you, thank you so much!
Click to expand...
Click to collapse
It wouldn't have ROM FILE/MODULE under it as it wasn't cooked in. You probably need some registry for it to work. Also, try opening the DLL in PEexplorer & checking to see it it has a cert attached.
Example of a DLL/EXE with a cert;
Gonna cook it into my rom and try it out...Do you have an idea which reg entry it could need?
I think of something for the settings page. Because if you haven't got a settings page for it, how can you activate it?
And maybe another entry which points it to the DLL file...?
-WP7User- said:
Gonna cook it into my rom and try it out...Do you have an idea which reg entry it could need?
I think of something for the settings page. Because if you haven't got a settings page for it, how can you activate it?
And maybe another entry which points it to the DLL file...?
Click to expand...
Click to collapse
Next weekend I may upload the dcTNONE_ANALOGTV.dll folder which I found in the leaked ROM for HTC Surround even before the WP7 was officially to public, the source code which is .c and .def for it, which is to remove some limits for QSD8250 CPU, and the changeusbprofile.exe and changeusbprofile.xml from Asus E600 (the only dev phone has the display mirror feather in 7720 for now)someone Mr X, who I am very grateful to gave me.
I ain't major in this level of computing techs, so I think in order to make the project alive, it's better to share what I have to those who has the ability to do it. Let them holding in my hand is a great waste at present stage.
The QSD8250 is a very old cpu, so there should be no problem with NDA.
P.S
There should be a manual installed usb driver on PC and a client application on PC but I don't have them right now. If you have friends or friend's friend who is a dev, holding a e600 dev phone, try ask them to share something, appreciated.
drkfngthdragnlrd said:
It wouldn't have ROM FILE/MODULE under it as it wasn't cooked in. You probably need some registry for it to work. Also, try opening the DLL in PEexplorer & checking to see it it has a cert attached.
Example of a DLL/EXE with a cert;
http://i105.photobucket.com/albums/m240/drkfngthdragnlrd/Untitled-31.png
Click to expand...
Click to collapse
I've uploaded all my files so you can make the check yourself.
After all I'm major in management not IT techniques so I don't want to pull the path down.
Thank You for the help you offered!~~~
Thanks for uploading your files. But it seems like I can't find the reg key...
There isn't a single reg entry which points to the uploaded .dll. At least not in the official Mango Update for the HD7.
But if you post the whole entry, I could try to cook the .dll into my rom and see what happens.
-WP7User- said:
Thanks for uploading your files. But it seems like I can't find the reg key...
There isn't a single reg entry which points to the uploaded .dll. At least not in the official Mango Update for the HD7.
But if you post the whole entry, I could try to cook the .dll into my rom and see what happens.
Click to expand...
Click to collapse
has this registry something to do With that ? :
Local Machine\Drivers\Display\TV\
PanelDLL=string:"dcTNONE_ANALOGTV.dll"
-WP7User- said:
Thanks for uploading your files. But it seems like I can't find the reg key...
There isn't a single reg entry which points to the uploaded .dll. At least not in the official Mango Update for the HD7.
But if you post the whole entry, I could try to cook the .dll into my rom and see what happens.
Click to expand...
Click to collapse
Just like @tessut posted. It's it. And I think you'd better try to build the dcTNONE_ANALOGTV.dll yourself from the source, it should be more reliable than using fixedRecmod. I can't do that cuz there seems to need many head files that do not exist in computer even I have vs2010...
Sent from my SGH-i937 using XDA Windows Phone 7 App
Okay, if someone wants to try that, too: The exact reg key (just copy and paste) is
[HKEY_LOCAL_MACHINE\Drivers\Display\TV]
"PanelDLL"=string:"dcTNONE_ANALOGTV.dll"
Didn't flash the rom on my device yet, but that's soon going to happen
The dctNONE_analogtv.dll is in the windows folder, the changeusbprofile.exe and .xml are in there, too. I hope it works!
EDIT: Didn't work at all...The ChangeUSBProfile.exe didn't get installed (although I'm 100% sure that it is there and of course in the right folder). Wasn't there a license xml around or something? Because normally a Windows Phone 7 App needs a license file to get installed when starting the phone for the first time. Don't know if this applies to .exe files though.
Has someone got an idea?
-WP7User- said:
EDIT: Didn't work at all...The ChangeUSBProfile.exe didn't get installed (although I'm 100% sure that it is there and of course in the right folder). Wasn't there a license xml around or something? Because normally a Windows Phone 7 App needs a license file to get installed when starting the phone for the first time. Don't know if this applies to .exe files though.
Has someone got an idea?
Click to expand...
Click to collapse
Thanks for the work! Is it possible if we extract the official .cab update file to get a licence and patch it to the exe?
I used a PE Explorer to open the changusbprofile.exe and found a license called"Windows Mobile TCB signing cert" in it.
Another thing is I used a way to open .exe in IE (use IE in WP7 to open this thread and download the usbvideoout.zip and you can have the chance to open changeusbprofile.exe directly) but it failed in Mango. Maybe we should try this in 7004 because this is really an old file. Or we should find a .cab file that contains a exe file in it and this .cab must be announced after mango update.

[Q] jailbreak rt 8.1,possible?

still wondering how to jailbreak rt 8.1,seems that cdb no more works..
A jailbreak for 8.1 isn't possible yet.
Sent from my SCH-I535 using xda app-developers app that has now replied to millions of stupid questions
hjc4869 said:
still wondering how to jailbreak rt 8.1,seems that cdb no more works..
Click to expand...
Click to collapse
*sigh*. Use search, or even just open your eyes and read through the development and hacking section which is basically full of this single statement: "8.1 does not have a jailbreak yet"
SixSixSevenSeven said:
*sigh*. Use search, or even just open your eyes and read through the development and hacking section which is basically full of this single statement: "8.1 does not have a jailbreak yet"
Click to expand...
Click to collapse
Making a jailbreak is a complicated task. I'm working on it...
Melissa
surface rt 8.1 jailbreak
Myriachan said:
Making a jailbreak is a complicated task. I'm working on it...
Melissa
Click to expand...
Click to collapse
hello my name is mike clery I was wondering any info on a 8.1 jailbreak I really want to install legacy apps on my surface rt so if you can tell me anything its December 26 and still no info on it
Dude. Don't pester the devs. Don't post questions that have already been asked and answered over and over again. Don't, ever, ask for ETAs or similar concerning hacks like this. Leaving aside the simple fact that it's impossible to predict anything of that nature (and thus asking is simply useless and annoying spam), people on here are volunteers doing this stuff in our own time. You are not our boss, to ask for regular status reports or some such thing. It'll be posted when it's ready. No point asking for anything else.
There has been plenty of discussion regarding an 8.1 jailbreak. I get that you're new, but time was, new members of a community had the courtesy to observe, and emulate, the behavior of the older members of the community. At a minimum, check the forum rules... the very first of which is: Search before posting!
cameyo ? work with jailbreakoen surface rt ????
Have you guys heard about cameyo ?????
Its pre pacakge apps taht dont need to be installed to run.
download them and run them, wonder if we be able to use those apps after the RT is jailbroken? any idea ?
search for online . cameyo . com / public - (no spaces)
here is the link to hugh list of apps that can be downloaded as n exe file and run on any PC, offcourse not on rt . i tried. Anyone with a 8.0 surface RT jailbroken devce, wanna try and let us know if they are working ?
MrAsimOnline said:
Have you guys heard about cameyo ?????
Its pre pacakge apps taht dont need to be installed to run.
download them and run them, wonder if we be able to use those apps after the RT is jailbroken? any idea ?
search for online . cameyo . com / public - (no spaces)
here is the link to hugh list of apps that can be downloaded as n exe file and run on any PC, offcourse not on rt . i tried. Anyone with a 8.0 surface RT jailbroken devce, wanna try and let us know if they are working ?
Click to expand...
Click to collapse
Nope. Cameyo is for x86 not ARM and would need porting, as it is not open source that is not possible.
Possible alternitve?
Is is possible to just get a developer license on an rt device and then use your own signing certificate to sign some application (like audacity) then import the certificate into the trusted root authority list using certmgr.msc? If that worked then we could get something going that would work with few risk of problems. Also for anyone else who might find this useful, you can download a windows rt debugger and it has a built In kernel debugger (maybe could be used to jailbreak???).
... And we come full circle. @johndc7, thanks for your suggestion but did you really think that wasn't among the very first things we tried?
The requirement isn't that the binaries are signed. It's that they're signed by Microsoft. Your suggestion does actually work if the tablet is in Testsigning mode - which means, basically, treat any trusted signature as if it's a MS signature - but putting the tablet in Testsigning mode requires editing the BCD (Boot Configuration Database) and the SecureBoot feature prevents any modification to the SecureBoot flag in the BCD. We even have tried complex steps like exporting the BCD, enabling Testsigning on it, marking it read-only, and re-importing it. No dice. Feel free to experiment more yourself, though...
Oh, and as for kernel debug, that's definitely another way to disable the signature enforcement... and it's just as unusable as your last suggestion. Secure Boot blocks the Debug flags in the BCD. You don't need any special software to perform kernel debugging of RT - any build of kdb or windbg from the last few years can do it - but you do need to be able to put the tablet in debug mode to begin with. Again, if you find a way to do *that*, then that would be very valuable.
Another idea........
Hopefully this is something that is actually somewhat realistic..... I have been wanting to run audacity (mainly) on windows rt. Does anyone know if it would be possible to recompile it to run full screen in metro? Even though this method isn't really ideal, it would be something to temporally use instead of having nothing until somebody finds a better way of doing it. I understand that it probably wouldn't be able to be released to the windows store but a developer license could be installed to run it.
Well, at a bare minimum, you would need to re-write the entire UI. Metro apps don't (can't) use the standard Windows GUI frameworks, so any graphical app that isn't completely DirectX-based (which is to say, pretty much anything except games and command-line apps) will need to have their interface re-written.
Then there's the issue of things like getting it to work within the sandbox (you can largely work around the API restrictions, but the privileges issue is a problem) and, unless it is already possible to compile it under modern versions of Visual Studio (a lot of open-source software isn't), you would need to fix it for MSVC compatibility too.
Short version: Not practically.
Possible Alternative
I did find a folder on my RT device called "CodeIntegrity". The path is "C:/Windows/System32/CodeIntegrity". It contains drivers and stl files that I assume prevent the use of unsigned exes. Permissions that are not normally granted on the Surface are needed to disable the files, but if we could somehow do it maybe it would solve the problem?
GoodDayToDie said:
The requirement isn't that the binaries are signed. It's that they're signed by Microsoft.
Click to expand...
Click to collapse
Not exactly. They can be signed by any certificate listed in the kek or db and not listed in the dbx. So microsoft (though there are different signatures in rt 8.0 and rt 8.1) and the OEM, and any third party that made drivers that are used on the platform (at least in general). But those are just technical details and don't help find a solution all that much.

Continuum for unsupported devices.

The process is simple. Put the tool in С:\.
Run as admin. Select one of the cab files-in the folder there should be only one.
Similarly with (http://forum.xda-developers.com/win...lds-update-links-collection-cab-t3234805),but
Result and cabs here : http://4pda.ru/forum/index.php?showtopic=770305&view=findpost&p=54847252
bikercat said:
The process is simple. Put the tool in С:\.
Run as admin. Select one of the cab files-in the folder there should be only one.
Almost the same (http://forum.xda-developers.com/win...lds-update-links-collection-cab-t3234805),but do not need to enter commands.
Tool :http://4pda.ru/forum/dl/post/9040582/App.zip
Cab for HTC One M8
http://4pda.ru/forum/dl/post/904001..._52a3d7175d13787ebcc722099a8b53a216c51804.zip
Cabs for others :
http://4pda.ru/forum/dl/post/9050650/CONT.zip
Result : http://4pda.ru/forum/index.php?showtopic=770305&view=findpost&p=54847252
Click to expand...
Click to collapse
Oh really, that's great
We all had that cab since long time.
bikercat said:
The process is simple. Put the tool in С:\.
Run as admin. Select one of the cab files-in the folder there should be only one.
Almost the same (http://forum.xda-developers.com/win...lds-update-links-collection-cab-t3234805),but do not need to enter commands.
Tool :http://4pda.ru/forum/dl/post/9040582/App.zip
Cab for HTC One M8
http://4pda.ru/forum/dl/post/904001..._52a3d7175d13787ebcc722099a8b53a216c51804.zip
Cabs for others :
http://4pda.ru/forum/dl/post/9050650/CONT.zip
Result : http://4pda.ru/forum/index.php?showtopic=770305&view=findpost&p=54847252
Click to expand...
Click to collapse
Tutorial?
I cant register to that forum. Who can post the microsoft.ms_docking.mainos.cbs_52a3d7175d13787ebcc722099a8b53a216c51804.zip ( 31,51 МБ )
here?
Nevermind, i didit.
augustinionut said:
I cant register to that forum. Who can post the microsoft.ms_docking.mainos.cbs_52a3d7175d13787ebcc722099a8b53a216c51804.zip ( 31,51 МБ )
here?
Nevermind, i didit.
Click to expand...
Click to collapse
upload it to chinese cloud server this time please
bikercat said:
The process is simple. Put the tool in С:\.
Run as admin. Select one of the cab files-in the folder there should be only one.
Almost the same (http://forum.xda-developers.com/win...lds-update-links-collection-cab-t3234805),but do not need to enter commands.
Tool :http://4pda.ru/forum/dl/post/9040582/App.zip
Cab for HTC One M8
http://4pda.ru/forum/dl/post/904001..._52a3d7175d13787ebcc722099a8b53a216c51804.zip
Cabs for others :
http://4pda.ru/forum/dl/post/9050650/CONT.zip
Result : http://4pda.ru/forum/index.php?showtopic=770305&view=findpost&p=54847252
If somebody marry an unsupported phone with the original dock - will let you know !!!
Click to expand...
Click to collapse
will that make it work on any phone (lumia 920) or it'll just make the continuum app run?
Couldn't install it on 640XL. Tried all three cabs, result is the same:
ERROR: 0x8024a110
Command failed. (HRESULT = 0x8024a110)
Can't download cabs
Lumia. Deploy one cab after other. Erase .face extension...
This site can’t be reached
The webpage at http://forum.xda-developers.com/newattachment.php?do=manageattach&p=69536527 might be temporarily down or it may have moved permanently to a new web address.
ERR_CONNECTION_ABORTED
Really xda?
karaki93 said:
will that make it work on any phone (lumia 920) or it'll just make the continuum app run?
Click to expand...
Click to collapse
try Pendrive straight away too
---------- Post added at 03:52 PM ---------- Previous post was at 03:43 PM ----------
never mind you selfish *****
http://download.windowsupdate.com/c..._00d24dcb2decb8d15ecd6dd61493208136e86586.cab
http://download.windowsupdate.com/d..._debf5ea714636f4d4fb323e0fe30c14592f26589.cab
Installing the cabs will surely not be enough for it to work, and I have to say lately all those peoples giving me middle fingers doesn't really encourage me into sharing the other missing part, but as I had really *enough* of all those peoples I'm sharing it anyway, this isn't for those peoples, but only to stop all those fools from asking me the same question again and again and then insulting me everyday.
To get Continuum to work properly after installing the packages you need to do the following:
HKLM\SOFTWARE\Microsoft\Shell\Docking
create a new dword value called EnabledForTest
set it to 1,
reboot and enjoy it running on unsupported cpu types.
lets see how to manage this http://forum.xda-developers.com/win...7-miracast-t3496988/post69539385#post69539385
EDIT: managed.
By the way, to properly install the cabs you need to make sure it matches your current build, if not get back to the correct build or use the correct cab. Otherwise it may not work or break WU with deltas.
gus33000 said:
Installing the cabs will surely not be enough for it to work, and I have to say lately all those peoples giving me middle fingers doesn't really encourage me into sharing the other missing part, but as I had really *enough* of all those peoples I'm sharing it anyway, this isn't for those peoples, but only to stop all those fools from asking me the same question again and again and then insulting me everyday.
To get Continuum to work properly after installing the packages you need to do the following:
HKLM\SOFTWARE\Microsoft\Shell\Docking
create a new dword value called EnabledForTest
set it to 1,
reboot and enjoy it running on unsupported cpu types.
Click to expand...
Click to collapse
Gus, I'm not able to add this EnabledForTest value at this key path, it just won't write. I'm using Interpol Tools 1.8 and already restored NDTKSvc. What I am doing wrong?
Use custompfd.
gus33000 said:
By the way, to properly install the cabs you need to make sure it matches your current build, if not get back to the correct build or use the correct cab. Otherwise it may not work or break WU with deltas.
Click to expand...
Click to collapse
You're absolutely right; this should written on any OP with the tweak that require old .cab deploying.
BTW, as far as I know, MS is not using "binary patching" method; all .cab contains full version of binaries and other files (provisioning etc.). I believe (I don't have enough knowledge) installer API on the phone is checking files(s) checksum.
Do you know the trick (maybe, some registry change) how to bypass that check?
SolariXxX said:
Gus, I'm not able to add this EnabledForTest value at this key path, it just won't write. I'm using Interpol Tools 1.8 and already restored NDTKSvc. What I am doing wrong?
Click to expand...
Click to collapse
Add it using the registry editor, not the browser... It fails because the browser isn't allowed to list. So use the editor. Also, try the newest versions, that version you're using is old.
djtonka said:
try Pendrive straight away too
---------- Post added at 03:52 PM ---------- Previous post was at 03:43 PM ----------
never mind you selfish *****
http://download.windowsupdate.com/c..._00d24dcb2decb8d15ecd6dd61493208136e86586.cab
http://download.windowsupdate.com/d..._debf5ea714636f4d4fb323e0fe30c14592f26589.cab
Click to expand...
Click to collapse
which one is for lumia??or should i have to install both cabs??pretty confusing because @bikercat only gave*one cab which is almost 35mb
1 - Main cab : microsoft.ms_docking.mainos.cbs_debf5ea714636f4d4fb323e0fe30c14592f26589.cab
2 - Update cab : microsoft.ms_docking.mainos.cbsu_00d24dcb2decb8d15ecd6dd61493208136e86586.cab
And those actual cabs for last build on fast ring?

Categories

Resources