Database Users

Engineering mode

I have been playing with my tmobile MDA (wizard) and in HKLM/software/HTC/engineermode there are some keys I find interesting. On mine LaunchEngineerModeAppDialStr is set to *#*#364#*#* (364 maps to 'eng' which is probably why it was chosen).
Has anyone played with this at all? I tried but I get 0 mobile srevice her eand got a message back saying 'please try you call later' (sms style) which I am certain came from the phonei tself. Normally I get just 'failed' rather than 'please try your call later'.
At any rate, it might be something fun to look at I know that some people were looking to get the tower IDs and other info, and usually engineering mode includes that.

update
I have an update to this. I have 2 SIMs both tmobile US. The old one is at least a year old, maybe more. It is totally inactive. The new one came with the phone. When I use the old one I get 'please try your cal llater' with the new one it goes into engineering mode and displays cellid and other bits of info. of course its not highly useful for me right now becuase I have no cell signal, but ...
The title bar reads 'gsm test mode' and there are 3 tabs. GSM, AMR and GPRS. At least now the key to get the dial string is known, if it wasnt before (I didnt see anything) and the fact that you can get tower IDs and other stuff (something someone wanted elsewhere).
the gsm test mode app appears to be a totoally different app as well (according to start->system->memory->running programs. I do not have good tools yet to see exactly where this app is and how to access it. But I am sure that if that program were located a debugger could provide useful info on extracting the syscalls or whatever is done to get access to the cellid and other bits of info.
Note cellids can be used to track location, they are fixed and reported, at least in the US., While you may not know exactly where someone is, by knowing which tower they are on you can guess. RSSI can be used in conjunction with this as the far field (where most radio communications occur) falls off at the inverse square, you can guess at the distance (but not direction). Multipath and other issues can affect this reading, so its not highly accurate but ...
Now does anyone know of a good tool like ps in unix that shows me not only the full program name but also any arguments given for WM5?

GSM Test Mode..
An easier way is to look in your \windows dorectory and look for the "GXM Test Mode.exe" ....

Yet Another CellID Application

yes, but based on a flexible set of methods
-Using RIL (GSMTestMode)
-Using RIL_GetCellTower
-Using RIL Notifications
-Using RIL (fieldtest) -> reply structure has to be found
-Using offset method (few structures included)
-Using COM port
The project is based on:
-cellguardian.dll and cellguardian.xml : How to get CELLID on devices
-cell2latlon.dll and cellDb.xml : Calculate lat/lon using CELLID
-gsmcelluloz.exe : the main exe
-gsmcellulozCF.exe : the same, as PoC, in CF, but very simple
http://usuc.dyndns.org/tv/gsm/gsmcelluloz/
DEBUG mode creates a lot of log in \Temp
The device method configuration is in a file called "cellGuardian.xml"
Offset version works only with the "ALL" parameter (I don't know what defines the offset, which component version?)
Many things should be incomplete (like documentations )
Here is a google map (result from logging) made using a GSMTestode compatible device:
http://usuc.dyndns.org/tv/gsm/releve_poly.php
I'll write a quick documentation on how using cellguardian.dll (the brain from the cellid-getting), and cellguardian.xml.
I'm also working in antenna position interpolation but it's an harder process... (for now the cell2latlon works but uses a very simple barycentric algorithm)
Sample walk:
http://usuc.dyndns.org/tv/gsm/testParcours.php
Have fun, I hope to have some fieldtest compatible device log in order to decrypt the structure
If your device is still not working... Tell me!
The source will be released as soon as the modaco challenge will be finished (I hope to win a device with cellguardian.dll... or a sticker )

Did not work for me Tornado with Crossbow-Rom, i think you may ask maniac for the Offsets, he created CellProfileSwitcher, an very useful SmartPhoneTool with a huge list of compatible devices.
In Combination with your Tool it may be useful to create my own "CellMap", to see my Homezone or some other kind of zones, switched by CPS,yea.
But the Screenshots looks nice,...
Thank your for another nice way to waste my time with my lovely Phone,hehe...but i need the offsets...dont know how...

Have you tried "Find offset" in the 8FFB0000-8FFC0000 range?
8FDC0000-8FDD0000
8F1D0000-8F1E0000
8A3B0000-8A3C0000
8A4B0000-8A4C0000
8C0D0000-8C0E0000
Are other possible ranges.
The result will be contained in a file located on \Temp
Possible structures (if you define your configuration in cellguardian.xml)
TORNADO
TYPHOON
IPAQ
MPX220
WIZARD
Offset method will be activated once you'll have removed other options (COMPORT...) from the config file.
Remember that as long as I don't know what defines the offset, the only version that works is "ALL". This field will be used once I'll be quite sure the component version defines really the offset.
I hope to improve it, but also to let a chance to the user to configure it by himself.

Quick help page
I made a quick help page to help ppl finding the offset until I find some cleaner way to find it...
http://usuc.dyndns.org/tv/gsm/help/
After this, just modify \Program Files\cellguardian.xml
and replace
<device name="HTC Tornado">
<OEMID>Qtek 8310</OEMID>
<method type="RILHTC1"></method>
<method type="RILTOWER"></method>
<method type="COMPORT"><port>COM9:</port></method>
</device>
Click to expand...
Click to collapse
by
<device name="HTC Tornado">
<OEMID>Qtek 8310</OEMID>
<method type="OFFSET">
<offset version="ALL" structure="TORNADO">YOUROFFSET</offset>
</method>
</device>
Click to expand...
Click to collapse
Where YOUROFFSET is the offset you found (try the adresse ranges I suggested above)

Let me be your tester
Hello!
I have found your excellent project and I am going to test it and share with you results. My phone is smartphone - HTC S310 (know also as HTC Oxygene, SPV C100).
When I am launching the application I get error:
Cannot load \Program Files\GSMCelluloz\CellGuardian.dll:0x7e126
Is your app suitable for smartphones? I have downloaded the
GSMCelluloz_SP5_R.CAB.
Maybe I should use:
GSMCelluloz_WM5_R.CAB?
What offsets sould I put to test my phone and which method?
Best greetings and congratulations for your job!
RA

Solved
abramq said:
When I am launching the application I get error:
Cannot load \Program Files\GSMCelluloz\CellGuardian.dll:0x7e126
Click to expand...
Click to collapse
Hi again!
The problem was because I've installed app on card, not on device memory.
Cell searching works excellent, on my phone works GSMTestMode method (I am going to find out the differences between methods, but don't know where).
By the way - user interface for smartphone (non-touch display) looks like not fnished - 'backspace' keys doesn't work and it is difficult to leave edit mode too.
Will test it more and make some enhancement
Best greetings and please keep working
JA
P.S.
What Compact Framework needs the CellulozCF? I have the 2.0 and the app doesn't work (I get the unexpected error: Microsoft.AGI.CommonMISC.HandleAr() in System.Windows.Forms.Control._InitInstance.

I think the best cell id application from all times ever would be that which can change phone profile depending from location. I saw someone here is trying to do it, but will not be free, so no use. An app like that will eclipse all other... it will be like the next step in mobile evolution. Probably japanese already have it.

You are outDated...this idea is really old...lookat maniacs Homepage;
Maniacs SmartPhoneTools
...but for now not useable on devices without TiOmapProcessor
But PhoneAlarm by PocketMax supports different [email protected],too.. but cost money and hard to configure,no learningfunction,no neighbourcells and you have to add every Cell one by one...
but youre right,too; Actions by Locations are always missed in Apps with Notifications or ProfileChangingFunction.

fieldtest users: need help!

Hi, I'm developping a sublayer to abstract the way the developpers use CellID, and the methods to get the datas from different devices.
I reverse engineered fieldtest.exe and would like to test it. I contacted some of you, and none gave me the informations I was needing. The problem is: I think I have the correct request, but don't know what kind of structure it is. If you could provide a screenshot, it would be a great help to quickly identify the structure.
I don't have a Hermes, and I cannot try it by myself.
Could you please test this in debug version (D and not R)
http://usuc.dyndns.org/tv/gsm/gsmcelluloz/
Here you'll see the result (maps of signals per cellid)
http://usuc.dyndns.org/tv/gsm/
Thanks to send me the \Temp\gsmcelluloz.txt files (stop it after a minute, could quickly become very big!) to: [email protected]
This way, you'll be able to use a DLL to get cellid which will work on many devices, because it uses COM port method, GSMTestMode method, offset method and soon (I hope) fieldtest method.

I will try it when get home, so i can run a backup in case the worst happens and i need to hard reset

It's just an application, it won't brick your device
Anyway, It reminds me to make one.... It's always useful to have a recent backup...
It will show only "0" for now, because I don't have the gsmcelluloz_log.txt files made on HERMES to understand how the answer looks like. But shortly after I'll have those files, it will show the real values.
Please add a fieldtest screenshot to help me identify the fields
Thanks

i've mailed you the log file and the screen shot.

Here are my logs. Hope it helps.

CellID & Rxlev & GPS

The program updated. free to use ...
Hi all, I write a simple program for Telecom. Engineeger:
1) It can show CellID, Rxlev & LAC
2) base on the database (txt file), show cell site info.
3) GPS function
4) Open log file to record
The Log file format in :
Latidute,Longitude,CurrentTime,CellID,Rxlev
And you need to copy the files 2G.txt,3G.txt & site.txt to the root directory.
the text file at the main program directory ( eg. program file\fieldtestv1.2\).
Note:
Only test at my HTC P3600i phone, not sure for others ...
And sorry for my poor english ..

New Version ,It's surprised,But My PPC(model:O2 atom Life) Cell Id is Error。
Picture ：

I have this error on my "Tornado" smartphone (WM 6.1).Why ?

By default, the program will read the files "2G.txt", "3G.txt", "site.txt" & "SiteNo.txt" when startup. so if you missing one of file , it will show the error message. you should create the 4 txt file to the root directory.
If you are a telecom engineer, you may entry the field data to each txt file or just create a empty file, it should be work !!!

that's a brilliant program.
btw what's the file format for the SiteNo.txt and is there a way to change the frequency of the log file to every minute or 30 seconds.
It would be great if you could do the site info match using the cellid ( CI ) and LAC. due to certain telco would recycle the cellid due to the 65536 limit.
Few more suggestion for the Log file.
1. Log file can be saved to storage card
2. BCCH info from the cells not from the txt file included in the log file
3. Logging frequency i.e 10 secs , 30 secs , 1 minute
4. LAC included in the log file
It is actually 8 to 10 db more when compared with an actual test tools.
bravo it's a good program.

Almost works, it crashes when i hit start or update, on my 8525 with ATT Wm6, files attached.

How do you read CELL ID ?
It is in the registry? where ?

could you show some code how to get cellid? which serial port to be opened?
On My HTC9000 PPC, I couldn't open COM2, No Com ports could be send AT
Cmd successfully

Some source code here ...
public static CELLINFO GetCellTowerInfo()
{
IntPtr res = IntPtr.Zero;
res = RIL_GetCellTowerInfo(hRil);
if ((System.Int32)res > 0)
{
rilCmd.CmdId = (System.Int32)res;
rilCmd.CmdType = RIL_CMD_TYPE.CELLTOWERINFO;
......................
.......................
if (!RIL.isInitialized)
RIL.Initialize();
RIL.CELLINFO CID = RIL.GetCellTowerInfo();

I have just started using this program as I am a telecommunications engineer.
I have emailed Frank for assistance and he has been most helpful.
The TXT files must be placed in the / directory - ie the "My Device" directory.

I have also noticed that if I use 2G or 3G mode on my phone, the program only looks in the 2G.txt file.

Try on my Hermes, on 3G band it shows only Cell ID, other failed, on 2G it shows MCC-MNC, Cell ID and LAC, but not signal level neither SC? Just reporting

Unsure why this is not receiving signal level, but the program does not yet have the functionality to extract BCCH/PSC.
All this program tries to match is the CellID - you need to have the BCCH/PSC in 2G.txt or 3G.txt
I am currently speaking with the developer to see if he wants some assistance to work on this program (i can test) - I am using a Touch Diamond

Thanks!
Dear Frank8080,
Thank you for your cellid sample program. I download and try it. This program run into my cht9100 very fine. I need one program to get cellid on wm6. Can you email your source code to me ? Thank you very much!

Does it work on wm2003 for my 818?

It does NOT work on O2 Atom, windows mobile 6 ...

hmmm... It crashed in my atom wm5.0.

Thanks for the bug reporting:
1) For the program can't read 2G or 3G txt, due to the program read the txt file base on the MNC(Network Code), so it seens that I need to add a setup page to fix the problem.
2) For can't decode the signal level (erwinpiero), I have tested on Dopod 838 Pro, it works ok. But I don't know why it's not work on your 838Pro.
3)For BCCH/PSC decoding, I still try ....
I am a mobile engineer in HongKong and the program just developed for my team use to perform the field measurement of the daily operation, so the most of function just base on the needs of my job. So if any other information you need, you may email to me, I will try to add the extra function to the program.

Hi frank, Top program, well done!! it's running on my TyTN II fine.
Could you post up some examples of how the 4 txt files should be built and a "few" examples of the info they should contain.
Also I see you're using RIL ... does your program update the CellID etc whilst the phone is "In Call". I have used CellTrack before and once "in call" the phone never updates apart from the RX level.
Thanks!!
Phil

Hi,
I haven't tried this sw, but I will do it soon (as soon as I have a PDA).
Just wondering if is possible to select what variables should be on the log (e.g.: active set, the cells that are being measured)...
thanks

[XAP][SOURCE] WP8 Registry Tools

Rebranded to WP8 Registry Tools from Lumia Registry Modifier
This is a basic registry viewer/editor demonstration using Registry dlls pulled from Nokia xaps within the latest FFUs.
First, a few things to note.
1) This only retrieves values from HKEY_LOCAL_MACHINE
2) It CAN read DWORD values now, but can't write. (Hell you probably won't be able to write ANYWHERE, but the code is there)
Instructions are quite simple.
To Read Values:
1) Put the Registry key in the first box (ex. SOFTWARE\Classes\MIME\Database\Codepage\1254
2) Put the Registry Value in the second box (ex. 1254)
3) Press Get Value.
To Set Values:
1) Put the Registry key in the first box (ex. SOFTWARE\Classes\MIME\Database\Codepage\1254
2) Put the Registry Value in the second box (ex. 1254)
3) Put the new registry value result in the Set Value box.
4) Press Set Value.
This is very very basic, but I wanted to just show off something using what Nokia has provided us.
We can't write dword values unfortunately so hopes of using this to change the MaxUnsignedApp value are lost. This MAY be possible with @GoodDayToDie 's WP8NativeAccess library, but with this it isn't.
In case everyone wondered what that key is... SOFTWARE\Microsoft\DeviceReg\Install
Side load away

Hmm... I get Access Denied in my library on most keys that I've tried to write. If you can write the codepage, that's interesting (generally speaking, HKLM has stronger protections). I'll double-check whether I can write there myself. If not, but you can, then we have an elevated privilege attack vector...
Also, we should see whether the app runs on non-Nokia devices. I suspect that it will, if it works the way I think it does, but in that case it also won't have much in the way of permissions.
Getting DWORDs to work is a good project, I'm sure it's possible (works fine in NativeAccess, incidentally).
EDIT: Any chance you could include the source?

snickler said:
This is a basic registry viewer/editor demonstration using Nokia's Native Registry dll pulled from one of their apps.
First, a few things to note.
1) This only retrieves values from HKEY_LOCAL_MACHINE
2) DWord values aren't supported.
Instructions are quite simple.
To Read Values:
1) Put the Registry key in the first box (ex. SOFTWARE\Classes\MIME\Database\Codepage\1254
2) Put the Registry Value in the second box (ex. 1254)
3) Press Get Value.
To Set Values:
1) Put the Registry key in the first box (ex. SOFTWARE\Classes\MIME\Database\Codepage\1254
2) Put the Registry Value in the second box (ex. 1254)
3) Put the new registry value result in the Set Value box.
4) Press Set Value.
This is very very basic, but I wanted to just show off something using what Nokia has provided us.
This doesn't seem to work with dword values unfortunately so hopes of using this to change the MaxUnsignedApp value are lost. This MAY be possible with @GoodDayToDie 's WP8NativeAccess library, but with this it isn't.
In case everyone wondered what that key is... SOFTWARE\Microsoft\DeviceReg\Install
Side load away
Click to expand...
Click to collapse
atleast its a start.

GoodDayToDie said:
Hmm... I get Access Denied in my library on most keys that I've tried to write. If you can write the codepage, that's interesting (generally speaking, HKLM has stronger protections). I'll double-check whether I can write there myself. If not, but you can, then we have an elevated privilege attack vector...
Also, we should see whether the app runs on non-Nokia devices. I suspect that it will, if it works the way I think it does, but in that case it also won't have much in the way of permissions.
Getting DWORDs to work is a good project, I'm sure it's possible (works fine in NativeAccess, incidentally).
EDIT: Any chance you could include the source?
Click to expand...
Click to collapse
ah yes, sorry about that. Let me load up my laptop
EDIT: Source added.

Hi I found the Registry item
(File path : <ffu>\Windows\Packages\RegistryFiles\SOFTWARE.REG)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap
where we can set extensions and their types.so is it possible to add a new extension so that it will also be supported and visible in sdcard ?

vivekkalady said:
Hi I found the Registry item
(File path : <ffu>\Windows\Packages\RegistryFiles\SOFTWARE.REG)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap
where we can set extensions and their types.so is it possible to add a new extension so that it will also be supported and visible in sdcard ?
Click to expand...
Click to collapse
It doesn't support creating new key values, only modifying existing ones. If the data is within one key value and it's able to be read, then it should be able to have things added to it.
EDIT: From what I've seen, what you're trying to do won't be possible with this. Each extension has a different key value.

We may need to start an "interesting registry values" thread here, similar to the one for WP7. Of course, it'll be more interesting if we can actually change any of them.
Oh, and the app works on my ATIV S, just by the way. Need to find some interesting paths to test it on, though.
EDIT: Have you been able to write to *any* values using this? It fails for me every time, but I haven't tried that many yet.

GoodDayToDie said:
We may need to start an "interesting registry values" thread here, similar to the one for WP7. Of course, it'll be more interesting if we can actually change any of them.
Oh, and the app works on my ATIV S, just by the way. Need to find some interesting paths to test it on, though.
EDIT: Have you been able to write to *any* values using this? It fails for me every time, but I haven't tried that many yet.
Click to expand...
Click to collapse
it has failed for me also. The only values I could write to were the ones that corresponded to Nokia. I'll look through the code again and make another update. I'm going to also rebrand it since it works for non Lumia phones.

Interesting about the Nokia paths working. That could be some characteristic of the DLL you use having better permissions or something specific to OEM stuff, but I actually suspect it's just that Nokia didn't bother to lock down the ACLs on their parts of the registry. You can easily adapt the app to my NativeRegistry class to test this, if you want.

Hmm that's a good idea. I just rebranded it to WP8 Registry Modifier. I'll add in your NativeRegistry class to work along with the RegistryRT class to see what comes about.

DWORD support
For DWORD support, take a look at the Nokia.SilentInstaller.Runtime.wim... The "CSilentInstallerRuntime" class contains multiple methods to interact with the registry including:
CreateKey
GetRegDWORDValue
GetRegSZValue
GetRegSZValueL
IsRegistryDWORDValueExists
IsRegistryKeyExists
IsRegistryREGSZValueExists
SetRegDWORDValue
SetRegSZValue
A bit off topic, I found a way to launch any URI... Literally, ANY URI (app:// http:// or anything). I can launch any application (using the GUID - so it must be a registered application but doesn't have to be one that you see in your programs list) and go to a specific page within that application. I can also pass any kind of query string that could unlock some hidden features in an application (such as the Extras+Info application - I can launch it using any dial string even though my ROM has that particular dial string disabled). I do so by launching a Toast message which allows me specify a launch uri and once it pops up, I click it. If anyone's interested, I can post a code sample for that...

@GoodDayToDie I'm able to read DWORDs with your NativeRegistry framework. I haven't been able to write though (I've only looked at the MaxUnsignedApp reg value).
What I think I'm going to do is possibly scrap the RegistryRT framework and just use yours. I can then make an even more robust app.

cpuguy said:
For DWORD support, take a look at the Nokia.SilentInstaller.Runtime.wim... The "CSilentInstallerRuntime" class contains multiple methods to interact with the registry including:
CreateKey
GetRegDWORDValue
GetRegSZValue
GetRegSZValueL
IsRegistryDWORDValueExists
IsRegistryKeyExists
IsRegistryREGSZValueExists
SetRegDWORDValue
SetRegSZValue
A bit off topic, I found a way to launch any URI... Literally, ANY URI (app:// http:// or anything). I can launch any application (using the GUID - so it must be a registered application but doesn't have to be one that you see in your programs list) and go to a specific page within that application. I can also pass any kind of query string that could unlock some hidden features in an application (such as the Extras+Info application - I can launch it using any dial string even though my ROM has that particular dial string disabled). I do so by launching a Toast message which allows me specify a launch uri and once it pops up, I click it. If anyone's interested, I can post a code sample for that...
Click to expand...
Click to collapse
I was actually looking at the SilentInstaller not long ago. I got sidetracked by the fact that I could use the NativeRegistry read DWORD values. I'll check that out and upload a new build in a few

GoodDayToDie said:
We may need to start an "interesting registry values" thread here, similar to the one for WP7. Of course, it'll be more interesting if we can actually change any of them..
Click to expand...
Click to collapse
I can write one up later. I have several registry keys that I'd like to bring attention to.
NOTE: I don't see anything editable yet, at least I can read it to compare it to the files in the ffu.

Launching a URI should be possible more directly than that, using ShellExecute, or similar, but that way is cool (and doesn't require importing unofficial native functionality).
Just a word of warning: NativeRegistry is under heavy modification. I hope to have the next Alpha release done soon, which brings a ton of changes, but in the meantime you might want to follow the changes on CodePlex; while I test every build that I push, I don't always publish the binaries.
There will be two ways to use the registry through NativeAccess soon: one is to use fairly thin wrappers around the native functions (that's mostly what's implemented now, but it will be expanded to include key and value enumeration, key creation, etc.), and the other is to use a class more akin to a .NET RegistryKey class, offering the ability to interact in a more object-oriented manner (where the object itself represents an open key).

Something I did notice when I tried to compile the NativeRegistry source (I just ended up using the binary you had for my testing) is that it kept blowing up on the include for WinReg.h. I don't have that anywhere. Am I missing something?

snickler said:
Something I did notice when I tried to compile the NativeRegistry source (I just ended up using the binary you had for my testing) is that it kept blowing up on the include for WinReg.h. I don't have that anywhere. Am I missing something?
Click to expand...
Click to collapse
I'm not sure how GoodDayToDie did it himself (probably same approach I take it) but I compiled it using the "WinReg.h" from the Windows 8 SDK and removing the desktop-only compiler "if" instruction (lines 49 and 1446). And like he mentioned, you also have to create the KERNALBASE.LIB with the required registry export functions for the linker.

cpuguy said:
I'm not sure how GoodDayToDie did it himself (probably same approach I take it) but I compiled it using the "WinReg.h" from the Windows 8 SDK and removing the desktop-only compiler "if" instruction (lines 49 and 1446). And like he mentioned, you also have to create the KERNALBASE.LIB with the required registry export functions for the linker.
Click to expand...
Click to collapse
Ah ok, thanks!

cpuguy said:
A bit off topic, I found a way to launch any URI... Literally, ANY URI (app:// http:// or anything). I can launch any application (using the GUID - so it must be a registered application but doesn't have to be one that you see in your programs list) and go to a specific page within that application. I can also pass any kind of query string that could unlock some hidden features in an application (such as the Extras+Info application - I can launch it using any dial string even though my ROM has that particular dial string disabled). I do so by launching a Toast message which allows me specify a launch uri and once it pops up, I click it. If anyone's interested, I can post a code sample for that...
Click to expand...
Click to collapse
Yes, please post your code and give yourself your own thread (at least keep it here in development ). There are a lot of underlying dialer codes that Nokia disabled when flashing the 928s. Also this could mean we could have a custom app launcher, if you wanted to customize it that way. Most of the work we have done on WP8 has occurred in the past few months; we are finally getting so close to the first InteropUnlock for Nokia/WP8.
Sent from my RM-860 (Lumia 928) using the OFFICIAL Tapatalk app.

I'm trying to figure out the correct method prototype (since this is a method that appears to be WinPhone only and isn't part of the SDK so, no details on it whatsoever)... I stumbled upon this toast functionality in "NokiaFrameworkOBAWinPRT.dll" under the "DevPropHelper" class. The method to call is "InvokeToast". This method ends up calling "Shell_PostMessageToast" in "ShellChromeAPI.dll" (this is what I'm trying to invoke directly without going through the Nokia dll).
Add a reference in your project to "NokiaFrameworkOBAWinPRT.winmd" (you can find this in newer versions of the Extras+Info app)
Add the necessary <InProcessServer> tag (to allow the "NokiaFrameworkOBAWinPRT.DevPropHelper" class) in the <ActivatableClasses> section of you WMAppManifest.xml file
In the code... Create an instance of "NokiaFrameworkOBAWinPRT.DevPropHelper"
In the code... Call the "InvokeToast" method (of the previously created object) passing it:
Application GUID (can be your local app's GUID - doesn't seem to matter)
URI to launch in string format
Toast title (can be anything)
Toast content(can be anything)
When the Toast notification pops up, click on it and that's it.