Database Users

WP8 SYSTEM registry files from FFU

I found where the system registry files are stored inside the ffus. This is from my Lumia 928 factory ffu.
Code:
\Windows\System32\config - DEFAULT, DRIVERS, FP, ProvisionStore, SAM, SECURITY, SOFTWARE, SYSTEM
\Windows\System32\config\MOUNTMGR - SYSTEM
\Windows\System32\config\unmodified - BCD, DEFAULT, DRIVERS, NTUSER.DAT, SAM, SECURITY, SOFTWARE, and SYSTEM
\EFIESP(Different Partition)\Windows\System32\config\unmodified - BCD, DEFAULT, DRIVERS, NTUSER.DAT, SAM, SECURITY, SOFTWARE, and SYSTEM
BCD, DEFAULT, DRIVERS, NTUSER.DAT, SAM, SECURITY, SOFTWARE, and SYSTEM
All of these files contain regf as the first few characters in hex. Beyond that, the files are mostly garbage looking at them in Notepad++.
I haven't been able to find any registry editors yet that can edit them, including ones built for Windows CE/Mobile or even Win7/8.
Anyone know of something that can display it in a normal fashion? (without needing a WP8 device to attempt to edit it on.)
EDIT: The files from \Windows\System32\config have been zipped for simplicity reasons (for those of you who don't have a ffu handy)
EDIT2 (August 22): The files from the GDR2/Amber update from my phone's rom have been added.
WalkingCat said:
OK, this is a reply to this thread, but apparently I can't post in that forum yet.
So, you've found registry file inside \Windows\System32\config, and this is the way to open and edit it.
No third-party tools needed, just use regedit.exe in your Windows system
1. Run regedit.exe
2. Click on any root key, like HKEY_LOCAL_MACHINE
3. Open File menu, select Load Hive
4. Select a file in your mounted ROM \Windows\System32\config, like SOFTWARE or SYSTEM, open it
5. In the dialog asking for a name, input any text, like WP8Software
6. Registry is now loaded under HKEY_LOCAL_MACHINE\WP8Software, you can edit it.
7. Open File menu, select Unload Hive, then its written back to disk.
reference: http://technet.microsoft.com/en-us/library/cc732157.aspx
Click to expand...
Click to collapse

Check this post : http://forum.xda-developers.com/showpost.php?p=44312736&postcount=41
I used 7zip to extract the file

vivekkalady said:
Check this post : http://forum.xda-developers.com/showpost.php?p=44312736&postcount=41
I used 7zip to extract the file
Click to expand...
Click to collapse
That works fine for .wim or a .zip, but these files are the complete registry store that's same format that Windows 2000, XP, Vista, ect. uses to store the settings for hardware/drivers, windows itself, and other apps that have that kind of access (e.x. Tier3 Applications)

If it's same format as XP/Vista type it should be easy openable, look for the application on the internet.

GodlikePL said:
If it's same format as XP/Vista type it should be easy openable, look for the application on the internet.
Click to expand...
Click to collapse
Apparently it isn't. I used RegistryEditorPE, that's supposed to work with offline registries for 2000 to 7, but it kept erroring out.
Sent from my RM-860 (Lumia 928) using the OFFICIAL Tapatalk app.

This is good stuff to know. Something that should be good to note is that while I decompiled the .NET for a few of the Verizon Xaps from the 928 ROM, I discovered some Nokia-specific COM Interop that interfaces with the registry. I'm hoping I can try something out and put up a test program within the next few days and make some registry changes.

Hi
I found a registry key
[HKEY_LOCAL_MACHINE\Software\Microsoft\Office Mobile\SPMC\Action\doc]
"Application"=dword:00000005
"ApplicationCommand"="app://5B04B775-356B-4AA0-AAF8-6491FFEA5617/Default?CmdLine=-url %s"
"Action"=dword:00000003
this is for Microsoft office Word
I think we can open word using the link i guess (app://5B04B775-356B-4AA0-AAF8-6491FFEA5617/)
so is this part useful?
can external commands executable through this part (CmdLine=-url %s) ??
something like this
http://dotnet.dzone.com/articles/windows-phone-7-tip-day-know

@snickler: Let me know if you succeed with that. I managed to sideload an app using one of those libraries (after removing nearly all the interesting capabilities...), but immediately got an error about the component not being registered. I didn't try running regsvr or anything, though...

GoodDayToDie said:
@snickler: Let me know if you succeed with that. I managed to sideload an app using one of those libraries (after removing nearly all the interesting capabilities...), but immediately got an error about the component not being registered. I didn't try running regsvr or anything, though...
Click to expand...
Click to collapse
Hmmm, which phone do you have?
Edit: I tried to deploy just a sample app with one of the .winmds referenced, and got the 0x81030120 error
Holy fuzzle.. ANOTHER EDIT: I was able to do it. I had to remove all the damn Capabilities that I added from the Nokia Maps xap though.
I referenced the NokiaRegistryUtils.winmd and just ran this sample code
MessageBox.Show(NokiaRegistryUtils.Registry.IsChinaFirmware().ToString());
It returned "false" as expected.
I'm going to try something else now.
Something to note, in the WMAppManifest.xml, the following needs added after the <Tokens> declaration
<ActivatableClasses>
<InProcessServer>
<Path>NokiaRegistryUtils.dll</Path> <-- or whatever dll you're adding
<ActivatableClass ActivatableClassId="NokiaRegistryUtils.Registry" ThreadingModel="both" />
</InProcessServer>
</ActivatableClasses>

vivekkalady said:
Hi
I found a registry key
[HKEY_LOCAL_MACHINE\Software\Microsoft\Office Mobile\SPMC\Action\doc]
"Application"=dword:00000005
"ApplicationCommand"="app://5B04B775-356B-4AA0-AAF8-6491FFEA5617/Default?CmdLine=-url %s"
"Action"=dword:00000003
this is for Microsoft office Word
I think we can open word using the link i guess (app://5B04B775-356B-4AA0-AAF8-6491FFEA5617/)
so is this part useful?
can external commands executable through this part (CmdLine=-url %s) ??
something like this
http://dotnet.dzone.com/articles/windows-phone-7-tip-day-know
Click to expand...
Click to collapse
Where did you find that key?

in ffu file
location <ffu mount>\Windows\Packages\RegistryFiles\Microsoft.Office.Word.reg

Perfect. That's what I'm doing now, but just from my 920 ROM dump. I can access the registry sections that Nokia provides in their app, but I can't from the one you provided me. I'm going to do more tests to see if this is using HKCU rather than HKLM. It could also be that the registry keys have permissions placed on them.

Hmm,
I'm able to get the value of SOFTWARE\Classes\MIME\Database\Codepage\1254 -> BodyCharset

I may write a simple app that reads registry from Lumia devices... I think that's going to happen today.

found these things dont know it is of any use
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3]
"$DLL"="C:\\Windows\\System32\\WINTRUST.DLL"
"CallbackAllocFunction"="SoftpubLoadDefUsageCallData"
"CallbackFreeFunction"="SoftpubFreeDefUsageCallData"
"DefaultId"="{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1]
"$DLL"="C:\\Windows\\System32\\WINTRUST.DLL"
"CallbackAllocFunction"="SoftpubLoadDefUsageCallData"
"CallbackFreeFunction"="SoftpubFreeDefUsageCallData"
"DefaultId"="{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2]
"$DLL"="C:\\Windows\\System32\\WINTRUST.DLL"
"CallbackAllocFunction"="SoftpubLoadDefUsageCallData"
"CallbackFreeFunction"="SoftpubFreeDefUsageCallData"
"DefaultId"="{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3]
"DefaultId"="{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1]
"$DLL"="C:\\Windows\\System32\\WINTRUST.DLL"
"CallbackAllocFunction"="SoftpubLoadDefUsageCallData"
"CallbackFreeFunction"="SoftpubFreeDefUsageCallData"
"DefaultId"="{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"
Click to expand...
Click to collapse
http://support.microsoft.com/kb/287547

vivekkalady said:
found these things dont know it is of any use
http://support.microsoft.com/kb/287547
Click to expand...
Click to collapse
I did find THIS..
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7FFFFFFF"
That translates to the value of InterOp unlock by default which means we should be able to sideload more than 10 apps at a time.
I also found these within policy xml files
Code:
Microsoft.BaseOS.SecurityModel.policy.xml
<Capability ElementID="2EF45E94A01864DE3387212D6E73AEA885E709AD0F24FB97FE2E84728CB09D14" AttributeHash="49B8EC80A54998B68D7F65A44A340FD28B535494B7A41D650FD94851E38A6B6B" Id="ID_CAP_DEVELOPERUNLOCK" AppCapSID="S-1-15-3-1024-2489250862-3731101856-757172019-2830005102-2903107461-2549818383-1921265406-345878668" SvcCapSID="S-1-5-21-2702878673-795188819-444038987-1443" FriendlyName="Enable bearing chamber to load unsigned modules" Visibility="Internal" />
<Capability ElementID="BAFBED1970753822A266C1985F4A2CA2BA7A97CCE149F874743D00F678643C26" AttributeHash="54A2744DE064E139FD4403623C2AB9F1E130BC5C0786F56C1CE39AC814DC3F03" Id="ID_CAP_DEVELOPERUNLOCK_API" AppCapSID="S-1-15-3-1024-435026874-574125424-2562811554-2720811615-3432479418-1962428897-4127210868-641492088" SvcCapSID="S-1-5-21-2702878673-795188819-444038987-1450" FriendlyName="Enable setting of registry key protecting developer unlock mode." Visibility="Internal">
<CapabilityRules>
<Rules>
<RegKey ElementID="F0921CC3ADB2FEE5B7DC90F9F2BBDDB6E4D7BFAF9CE189C1585A90CD71E36882" DACL="(A;CI;KRKW;;;S-1-15-3-1024-435026874-574125424-2562811554-2720811615-3432479418-1962428897-4127210868-641492088)(A;CI;KRKW;;;S-1-5-21-2702878673-795188819-444038987-1030)(A;CI;KRKW;;;S-1-5-21-2702878673-795188819-444038987-1450)" Flags="515" Path="HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager" />
</Rules>
</CapabilityRules>
</Capability>
<Capability ElementID="BAFBED1970753822A266C1985F4A2CA2BA7A97CCE149F874743D00F678643C26" AttributeHash="54A2744DE064E139FD4403623C2AB9F1E130BC5C0786F56C1CE39AC814DC3F03" Id="ID_CAP_DEVELOPERUNLOCK_API" AppCapSID="S-1-15-3-1024-435026874-574125424-2562811554-2720811615-3432479418-1962428897-4127210868-641492088" SvcCapSID="S-1-5-21-2702878673-795188819-444038987-1450" FriendlyName="Enable setting of registry key protecting developer unlock mode." Visibility="Internal">
<CapabilityRules>
<Rules>
<RegKey ElementID="F0921CC3ADB2FEE5B7DC90F9F2BBDDB6E4D7BFAF9CE189C1585A90CD71E36882" DACL="(A;CI;KRKW;;;S-1-15-3-1024-435026874-574125424-2562811554-2720811615-3432479418-1962428897-4127210868-641492088)(A;CI;KRKW;;;S-1-5-21-2702878673-795188819-444038987-1030)(A;CI;KRKW;;;S-1-5-21-2702878673-795188819-444038987-1450)" Flags="515" Path="HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager" />
</Rules>
</CapabilityRules>
</Capability>

Need a Nokia Device?
snickler said:
I may write a simple app that reads registry from Lumia devices... I think that's going to happen today.
Click to expand...
Click to collapse
Thats great! If anyone needs a Nokia device to test on, Nokia has Remote Device Access to those who need it. Its a free service to anyone who has a Nokia DEVELOPER account, which is separate but free as well. The devices they mostly have are Lumia 820s, but the have a few others (620, 720, 920 and the 928.) The great thing about them, you can deploy an xap and run the apps. Some of those phones have sims in them and some of them have a "Nokia On-Device Diagnostic Tool". The only drawback, is that the connection can be SLOW.

Huh, you had to add the InProcServer manually? That may be the problem, then. I'm not sure why they're using COM - it works just fine to simply use the native Win32 APIs (add references to ADVAPI32LEGACY.LIB and/or KERNELBASE.LIB; that's what my NativeAccess library does and it works fine) - but it's good to know that COM is, in fact, usable.

Yeah, I already found those policy files. As I've said in other posts, if you can find a way to sideload an app that uses them, we can do a lot more than is currently possible - the internal and private capabilities (and some of the so-called public ones, most of which still won't install) have all kinds of cool potential.
One advantage of the WP8 app model, as opposed to the WP7 model that used ID_CAP_INTEROPSERVICES for everything, is that an app like you're making may well work on other devices. The fact that you got the interop-lock error means that the app did have ID_CAP_INTEROPSERVICES specified, so it may use it for some things, but the registry access is probably not one of them.

GoodDayToDie said:
Yeah, I already found those policy files. As I've said in other posts, if you can find a way to sideload an app that uses them, we can do a lot more than is currently possible - the internal and private capabilities (and some of the so-called public ones, most of which still won't install) have all kinds of cool potential.
One advantage of the WP8 app model, as opposed to the WP7 model that used ID_CAP_INTEROPSERVICES for everything, is that an app like you're making may well work on other devices. The fact that you got the interop-lock error means that the app did have ID_CAP_INTEROPSERVICES specified, so it may use it for some things, but the registry access is probably not one of them.
Click to expand...
Click to collapse
The best part is that the Nokia CityLens uses ID_CAP_INTEROPSERVICES, but I can't find anything that references it.
The winmds use System.Runtime.InteropServices though.
The Nokia app I got the RegistryRT from didn't use the INTEROP Capability at all, but I did notice that I had to add that extra stuff in the AppManifest.

[REQUEST] latest extras+info

I need for someone to possibly dump the latest version of the app from their development/pre-production edition of their Nokia Lumia. I don't think it matters if its a BUILD 920 or if its a developer 822, or whatever. I have a few ideas of some things that can be done via this app, as almost all of the dial codes on the 928 launch extras+info. One of them involves launching the service tools (including EPST) menu and stuff of that nature. I could probably just experiment with the one that launched with the 928 GDR2 rom, but its probably missing some "features" that have been worked on, but still incomplete.
Its also possible that these are baked inside the rom and completely inaccessible to the app and will only be updated when Nokia Black update releases.
ANY HELP WOULD GREATLY APPRECIATED!!!
Sent from my RM-860 using Tapatalk

dumped from ROM .
but I don't know whether it is the latest one or not.
Also, I think you won't be able to deploy it to any NOKIA devices cause it requires INTEROP UNLOCK which is impossible on NOKIA now.

hjc4869 said:
dumped from ROM .
but I don't know whether it is the latest one or not.
Also, I think you won't be able to deploy it to any NOKIA devices cause it requires INTEROP UNLOCK which is impossible on NOKIA now.
Click to expand...
Click to collapse
did you extract it from GDR2 (Amber Rom) ?
It's not the last version .
maybe we have to wait for GDR3 then we can extract last version of Extras + Info.
or maybe someone who have Samsung Ativ S can try proxy and try to download Extras + Info from market place using Sysapp Pusher (to find market link)
Then Using Full File Access to copy app files.

ngame said:
did you extract it from GDR2 (Amber Rom) ?
It's not the last version .
maybe we have to wait for GDR3 then we can extract last version of Extras + Info.
or maybe someone who have Samsung Ativ S can try proxy and try to download Extras + Info from market place using Sysapp Pusher (to find market link)
Then Using Full File Access to copy app files.
Click to expand...
Click to collapse
That's essentially why I said I needed it from a developer lumia, I don't even think it will install on ATIVs, due to OEM drivers required. Those devices have the option to have their full filesystem exposed when changed via the "Diagnostics" app that only available on developer/pre-production handsets.
Besides that what ROM did you dump this from hjc?

thals1992 said:
That's essentially why I said I needed it from a developer lumia, I don't even think it will install on ATIVs, due to OEM drivers required. Those devices have the option to have their full filesystem exposed when changed via the "Diagnostics" app that only available on developer/pre-production handsets.
Click to expand...
Click to collapse
I haven't read your posts here, so not sure if my post is still relevant, but one great chinese guy asked me to send this to you:
from R&D Lumia
https://www.dropbox.com/s/pf31egysniuschp/extras-hongkong.zip

Is your dump from the first GDR2 that appeared on NCS for the 928 or the actual release? I have the 2nd update but not sure if extras&info updated since then??? Found this in a wim which gives me new hope that the tool is buried somewhere in this mess...
RegKeyName="$(hklm.microsoft)\Shell\OEM\Start"
RegName="AltLayoutID"
RegType="REG_DWORD" />
<!-- -->
<SettingMapping Name="FeatureTileID"
RegKeyName="$(hklm.microsoft)\Shell\OEM\Start"
RegName="FeatureTileID"
RegType="REG_DWORD" />
<!-- -->
<SettingMapping Name="DiagnosticEnabled"
RegKeyName="$(hklm.microsoft)\Shell\OEM\Start"
RegName="DiagnosticEnabled"
RegType="REG_DWORD" />
</SettingsGroupMapping>
</ComponentMapping>
Click to expand...
Click to collapse

Guys a little question
Why don't we use the first lumia 920 rom ?
maybe we can find something that can help us to Interop Unlock but Microsoft and Nokia delete that in next rom releases .
Then we can Prevent Re-lock and update phone again !
I'm not sure but it seams to be some different between GDR2 rom of Nokia Lumia 920 (Apac Malaysia White is mine) and it's first Rom .
I have some problems in these days and I don't see all the differents but In first view you can find that there is no test folder in first rom but GDR2 have a folder named test and includes "QCFMFTMApp.exe"
or another thing is all of the programs are listed in :
PROGRAMS\CommonFiles\Xaps
but in GDR2 there's some xap files in this address too :
PROGRAMS\CommonFiles\OEM\Public\PreloadedApps\tier3Apps
did anyone checked the older Roms?

Thats it! I needed ver. 3.0.6.1 (because I can't deploy this to it and I'm not reflashing to just have an older version) to first see if there were any changes to Nokia.FUE.WinPRTRegistry, and possibly launch that registry script that's been embedded in it. Now all I need to do is see if there is a URI that links to the page, but I believe all bets are off. Nokia has been good about cleaning up their tracks.
THe version from the other extras was 2.6.1.18.

ngame said:
Guys a little question
Why don't we use the first lumia 920 rom ?
I have some problems in these days and I don't see all the differences but in first view you can find that there is no test folder in first rom but GDR2 have a folder named test and includes "QCFMFTMApp.exe"
or another thing is all of the programs are listed in :
PROGRAMS\CommonFiles\Xaps
but in GDR2 there's some xap files in this address too :
PROGRAMS\CommonFiles\OEM\Public\PreloadedApps\tier3Apps
did anyone checked the older Roms?
Click to expand...
Click to collapse
QCFMTMApp.exe seems to be a driver level executable that physically tunes the FM Radio in Nokia's various phones.
tier3apps, seem to be xaps that need additional permissions that essentially use provxml like in WP7 days. The NFL app that @tonbonz had done some looking into had a settings page that changes the WAP address for Verizon devices.It was interesting at the very least to see the differences between HTC and Nokia. The difference? @wap vs no @wap

Dump files from 2nd 928 GDR2 .... http://sdrv.ms/1hnqgNA

This package(extra+info) contains a silent installer and it is worth doing some research around it.
I opened it using ilspy only to find it called AddPackageAsync(), which is available in Windows Runtime to deploy enterprise xap and nobody knows how it works. @GoodDayToDie @ultrashot how do you think about it? Nokia use this API to install and update xap in settings page. It seems to be a service agent,too ,which is very interesting. How did it call the API silently...when we call the API, user will notice a notification asking whether he/she wants to install the enterprise app but no matter how you call it, the deployment won't succeed

hjc4869 said:
This package(extra+info) contains a silent installer and it is worth doing some research around it.
I opened it using ilspy only to find it called AddPackageAsync(), which is available in Windows Runtime to deploy enterprise xap and nobody knows how it works. @GoodDayToDie @ultrashot how do you think about it? Nokia use this API to install and update xap in settings page. It seems to be a service agent,too ,which is very interesting. How did it call the API silently...when we call the API, user will notice a notification asking whether he/she wants to install the enterprise app but no matter how you call it, the deployment won't succeed
Click to expand...
Click to collapse
I am also wondering about details of Enterprise deployment - I haven't looked into it too much, but as i remember you have to install .cer provided by MS to device and then sign your xap with it, and such apps will get installed.
(I was wondering if such signing can "unlock" any of interesting capabilities)

Sadly, enterprise apps (CAPABILITY_CLASS_ENTERPRISE_APPLICATIONS) just uses the same capability list as CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS; nothing useful there. It's a shame.

GoodDayToDie said:
Sadly, enterprise apps (CAPABILITY_CLASS_ENTERPRISE_APPLICATIONS) just uses the same capability list as CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS; nothing useful there. It's a shame.
Click to expand...
Click to collapse
After diving into a Lumia 521 ROM, I am not 100% sure that's the case....
I was poking around in the tier3apps directory (\PROGRAMS\CommonFiles\OEM\Public\PreloadedApps\tier3Apps\), and I noticed that some of these apps ("Nokia Accessories" and "Network Settings" apps) have interesting capabilities such as <Capability Name="ID_CAP_CELL_API_OEM_PASSTHROUGH"/>, <Capability Name="ID_CAP_INTEROPSERVICES"/>, and <Capability Name="ID_CAP_OEM_DEPLOYMENT"/>. These apps can be installed/updated via Nokia's "SilentInstaller" app. Nokia's "SilentInstaller" app just calls into AddPackageAsync(), which is available to us "normal folk" for Enterprise app deployment.
I am wondering if we could create some sort of a "shell" xap with a giant "Install button" that contains a payload such as an unaltered copy of the Samsung Diagnostics xap and appropriate license file. Clicking on the Install button would then install the signed "elevated app" onto any device. We could then launch a toast that will launch the "Registry Editor" page in the Samsung app, allowing for us to interop unlock.
The only thing that I can think of that would make this fruitless is if somehow "AddPackageAsync()" is being called "elevated" by Extras + Info (maybe it inherits whatever capabilities the parent process launched as?), and that is why Nokia can deploy things like this.
What do you guys think? This is all speculation, but I think it could be worth exploring.
**EDIT**
My phone will be back from service Wednesday, so maybe I will whip something up next weekend, if no one tries before then.

compu829 said:
After diving into a Lumia 521 ROM, I am not 100% sure that's the case....
I was poking around in the tier3apps directory (\PROGRAMS\CommonFiles\OEM\Public\PreloadedApps\tier3Apps\), and I noticed that some of these apps ("Nokia Accessories" and "Network Settings" apps) have interesting capabilities such as <Capability Name="ID_CAP_CELL_API_OEM_PASSTHROUGH"/>, <Capability Name="ID_CAP_INTEROPSERVICES"/>, and <Capability Name="ID_CAP_OEM_DEPLOYMENT"/>. These apps can be installed/updated via Nokia's "SilentInstaller" app. Nokia's "SilentInstaller" app just calls into AddPackageAsync(), which is available to us "normal folk" for Enterprise app deployment.
I am wondering if we could create some sort of a "shell" xap with a giant "Install button" that contains a payload such as an unaltered copy of the Samsung Diagnostics xap and appropriate license file. Clicking on the Install button would then install the signed "elevated app" onto any device. We could then launch a toast that will launch the "Registry Editor" page in the Samsung app, allowing for us to interop unlock.
The only thing that I can think of that would make this fruitless is if somehow "AddPackageAsync()" is being called "elevated" by Extras + Info (maybe it inherits whatever capabilities the parent process launched as?), and that is why Nokia can deploy things like this.
What do you guys think? This is all speculation, but I think it could be worth exploring.
**EDIT**
My phone will be back from service Wednesday, so maybe I will whip something up next weekend, if no one tries before then.
Click to expand...
Click to collapse
Samsung Diagnosis uses RPC (Remote Procedure Call) to access high privileged functions. We are not sure if Server exists on other phones.

-W_O_L_F- said:
Samsung Diagnosis uses RPC (Remote Procedure Call) to access high privileged functions. We are not sure if Server exists on other phones.
Click to expand...
Click to collapse
I don't know is it that thing you want or no but check it :
http://d-h.st/Me3

ngame said:
I don't know is it that thing you want or no but check it :
http://d-h.st/Me3
Click to expand...
Click to collapse
Yep! That's it. But I'm not sure it'll work.

-W_O_L_F- said:
Yep! That's it. But I'm not sure it'll work.
Click to expand...
Click to collapse
No problem I can test for you . my device is a Lumia 920 with Malaysia GDR 3 (Developer test) rom. and surely it's dev unlock
please tell me what can I do and how can I help you ?

I could test too... I don't know if the fact this is a dual CDMA+GSM device will change any parts of the app, but I can always try!
Sent from my RM-860 using Tapatalk

I have uploaded Extras And Info v3.0.6.1.xap here:
https://hotfile.com/list/2278056/5476aae

SUCCES! Adding content to HTC 8S stock Rom

Hey guys, I don't know if this is of any use for you, but I think it won't hurt to share it.
Based on some posts and ideas I read in different threads, I managed to write to the EFIESP and the PLATpartition of the stock rom of my HTC 8S. I changed the bootimages in the PLAT partition to a custom one,flashed the image and it worked. I'll attach a picture to prove it and if that's not enough, I will post a video.
So, the first step is to download the stock rom (obviously...) and extract the .exe file. (I use 7-ZIP) Then there is a file called "RUU_signed.nbh". If you open it with a Hex Viewer, like HxD, you can find multiple partition Headers. I found 4 that I can use, the rest is encrypted with what appears to be Bitlocker, hence the different headers. Now, what I did was mark the area of the first partition (starts approximately at offset 228BEF90 and is a FAT16 Partition) and continued the selection until the end of the file. Then I created a new one and pasted it. I ddid the same with the rest, always selecting and copying from where the partition starts until the end of the whole file and pasted it into a new one. Then I mounted the files using OSFMount and voilà, you can put stuff and files in there! If you finished, you just unmount the files. Then I opened each file again with HxD, selected EVERYTHING and pasted it
to the according area in the original RUU_signed.nbh. I started with the first one, then the second and so on, so you don't overwrite the changes you have made if you start in reverse order. After packing the file, I tried to flash it and to my surprise, IT WORKED! After rebooting I saw my custom bootimage! Downside of this is obviously that it requires you to use the stock firmware and it will be overwritten once you update your device. But I hope our skilled Devs here have some use for those 2 partitions. Theres 2 more that are usable, but I don't know their names, but you can still put files in them.
Now again, I don't know if this is of any use for you devs, but I still felt kind of obligated to share it
Stupid thing, I put my HTC 8S into Diag Mode and THEN flashed it, now it doesn't connect as MTP but as HTC Diagnostic Interface and I can't change it back because I can't deploy anything to the device. It works perfectly, boots and everything, but no USB Connection via MTP. So be very careful before flashing, since the mode is determined by a NV value which you can't edit afterwards.
This is not a tutorial to be followed by everyday users, but something ment for developers. You do everything at your own risk! And keep in mind that this has only been tested on an HTC 8S!
cheers, hutchinsane_

Yeah, I heard that it is possible, though I hadn't had a chance to test it on my 8X.
As for EFIESP: you can edit \efi\Microsoft\Boot\BCD to enable Kernel Debugger functionality and it is basically enough to hack the whole OS even with actions currently performed.
The most interesting partitions are MainOS (second to last), and Data (last one). Interop Unlock can be done in MainOS.
Thing is that newest ROMs are encrypted (not hard to crack but still)

Darn, hoped I was the first to come up with the idea. I do have acces to the file you're talking about. MainOS seems to be encrypted with Bitlocker since their headers start with -FVE-FS-. I could take a look into the 8X Rom aswell, I expect the situation to be the same. So is there a thread on the Kernel Debugger thing?
EDIT: I just did what you set, although I used a program called "Visual BCD Editor" since I don't know about editing the BCD Store just YET. Now I edited some values from "False" to "True" and for 1 second it showed me what appeared to be a windows boot selection. Now when I boot up, and once the "Windows Phone" blueish logo appears, it shows "Not for resale", meaning that we actually can edit BCD on this device!

Very nice Work
I run in Nokia Lumia 920 RM-821 APAC Malaysia Amber ROM
I find the same
Maybe we can edit Lumia 920 FFU and get first Custom ROM

that's enough to enable WinDbg operopability.
Code:
bcdedit /store F:\EFIESP\efi\Microsoft\Boot\BCD /dbgsettings usb targetname:woatarget
bcdedit /store F:\EFIESP\efi\Microsoft\Boot\BCD -set {default} debug on
bcdedit /store F:\EFIESP\efi\Microsoft\Boot\BCD -set {default} dbgtransport kdusb.dll

Sorry for my Question but how can we find that here is the end of a file in HxD .
I'm now looking for it to flash a Custom Rom on my Lumia 920 but I can't build images correctly using HxD and OSFMount.
Thanks .

@ngame Thanks If you look at your first 2 screenshots, you didn't select the "ë" You MUST select and copy it aswell, it's always the start of a partition, fot FAT aswell as for NTFS. After that, you should be able to mount. For finding the end, I didn't. I just Selected until the end of the file and pasted it back in. It should work, Afterall, my HTC has a "custom" rom aswell now, since there's a custom bootimage
@ultrashot Thanks! I used the commands and it worked succesfully. Waiting on the phone to flash now
EDIT: It doesn't boot once you set a) the target b) the type or something else. but enabling the kernel debugger itself works. Trying to figure out which value makes it unbootable.

ngame said:
Sorry for my Question but how can we find that here is the end of a file in HxD .
I'm now looking for it to flash a Custom Rom on my Lumia 920 but I can't build images correctly using HxD and OSFMount.
Thanks .
Click to expand...
Click to collapse
u must ask me dude .
zimone die

amir323b said:
u must ask me dude .
zimone die
Click to expand...
Click to collapse
PM Me please if you know
Thanks
hutchinsane_ said:
@ngame Thanks If you look at your first 2 screenshots, you didn't select the "ë" You MUST select and copy it aswell, it's always the start of a partition, fot FAT aswell as for NTFS. After that, you should be able to mount. For finding the end, I didn't. I just Selected until the end of the file and pasted it back in. It should work, Afterall, my HTC has a "custom" rom aswell now, since there's a custom bootimage
Click to expand...
Click to collapse
I will test again

Sorry in advance if this is a stupid question ...
Here is a list of partitions from my 928 .ffu but which ones are needed to edit? Just the FAT and NTFS partitions? Are any of the others of any interest?

As far as I know, you have to look for the specific headers, since some are encrypted with Bitlocker, therefor have the "-FVE-FS-" header. Easiest way is to use the search function of HxD and search for NTFS, FAT12 and FAT16 partitions Also, there are no stupid questons

hutchinsane_ said:
As far as I know, you have to look for the specific headers, since some are encrypted with Bitlocker, therefor have the "-FVE-FS-" header. Easiest way is to use the search function of HxD and search for NTFS, FAT12 and FAT16 partitions Also, there are no stupid questons
Click to expand...
Click to collapse
:highfive: Here's a better list including the device layout and read and write partitions if it helps anyone. Also when mounting FAT16 or FAT12 partitions it says it needs to be formatted or is unsupported. What am I doing wrong???

Can you ost a screenshot of the file you use as a partition? I don't know if it even works with Nokia Roms. Which one are you using exactly? I might be able to have a look at it.

feherneoh said:
Don't try it on Lumias, as your phone will stuck in Quallcomm HS-USB QDLoader mode, like my L520 did
Click to expand...
Click to collapse
You tried this way ?
now you can't flash your Phone using Care Suite ?
did you try Reffbox or ATF to repair your Boot Loader and flash your phone again ?

Hey, Lumia owners, get out of here!
By the way, Huawei W1 has same access to partitions. You can join forces and develop one hack for both phones.

-W_O_L_F- said:
Hey, Lumia owners, get out of here!
By the way, Huawei W1 has same access to partitions. You can join forces and develop one hack for both phones.
Click to expand...
Click to collapse
I think @reker can help us . he created a W1 Custom Rom

ngame said:
I think @reker can help us . he created a W1 Custom Rom
Click to expand...
Click to collapse
Not rom any more, I'm making tool can directly operate NTFS, so I can modify everything without losing any data. A hard work XD

reker said:
Not rom any more, I'm making tool can directly operate NTFS, so I can modify everything without losing any data. A hard work XD
Click to expand...
Click to collapse
Can't you publish it ? or Private send it to me ?
This tool can modify every NTFS Partition ?

@-W_O_L_F- They do? Didn't know that, thanks for the info! Yeah, might be a good idea, actually.
@reker how do you plan on doing this? adding the tool to the rom or deploying it as a xap? I actually need a way to use hidden pages without the toast launcher, or to include the toast launcher into the rom since I can't deploy it anymore

ngame said:
Can't you publish it ? or Private send it to me ?
This tool can modify every NTFS Partition ?
Click to expand...
Click to collapse
Proto-type now, NTFS is a biiiiiig thing. I will release it when finish.

[MOD] Ad blocker

Hi guys,
I tried to implement good old method to block unwanted ads by adding advertising sites to the HOSTS file, on the Sammy ATIV Odyssey (full FS unlock) and it works perfectly But I'm still unsure ('cause I'm developer and do have some ad-based apps in store) - should I post this info? BTW, we do have mods, lets give 'em the rights to decide, delete this thread or not...
So, this method is pretty simple (he-he, same as my very-very first WP7 hack):
1) You muist have an interop-unlocked handset with full FS access
1) Download the latest "blocking" hosts file, for example, from here
2) Rename your download from hosts.txt to HOSTS
3) Connect your handset to PC, navigate to \Windows\system32\drivers\etc folder
4) Paste downloaded HOSTS file, choose "replace" in the copiyng dialog.
5) That's all folks!
You don't need to reboot (like on Android phone with AdAway app) - now your handset is ads-free...
If you wanna revert back, just delete \Windows\system32\drivers\etc\HOSTS file.

Nice! I will try it! ?
Sent from my Ativ S with Tapatalk 2

@sensboston:
Am I right in assuming that there's no way to interop-unlock a WP8.1 phone like the Lumia 930? At least I couldn't find one...
After some years I did the 2nd attempt to adopt to WP. The first one lasted for a day or so. Now, after some days of using the Lumia 930, I really really love it. Not only the device, but also WP8.1. But the fact that there is no way to block ads in browsers is really really annoying. I have no problems with ads in apps, because if I like an app, I purchase it anyway. But I can't "buy away" ads in browsers, and lots of sites get more or less unusable in mobile view and without ads being blocked.
Unfortunately there's not even an alternative browser for WP that would have the capability to block ads...

Worked on Lumia
I did this on my Lumia 1520 without Interop unlock
Works fine, thanks

I did this AGES ago on my 8X. Didn't think it was post-worth lol.

djamol said:
I did this on my Lumia 1520 without Interop unlock
Click to expand...
Click to collapse
How exactly did you do that? My assumption was that you need interop-unlock in order to access the file system, including the hosts file. If you are not interop-unlocked, I would assume you have some other kind of unlock. Developer-unlock?

compu829 said:
I did this AGES ago on my 8X. Didn't think it was post-worth lol.
Click to expand...
Click to collapse
You know, right after my first "hack" for WP7 (also it was my first post here ), a lot of websites and forums are announced this hack without reference to me or xda. But (he-he ) , just AFTER my post...
This hack (from the user experience) is one of the most useful hacks for WP. But as a developer with ads-based apps, I was in a quandary - should I post it here or not...

BigBlue007 said:
How exactly did you do that? My assumption was that you need interop-unlock in order to access the file system, including the hosts file. If you are not interop-unlocked, I would assume you have some other kind of unlock. Developer-unlock?
Click to expand...
Click to collapse
No Interop Unlock, nor developer unlock, I used my own "Root Tool" app from windows store. Which is capable of all second party capabilities.
My pleasure.

djamol said:
No Interop Unlock, nor developer unlock, I used my own "Root Tool" app from windows store. Which is capable of all second party capabilities.
My pleasure.
Click to expand...
Click to collapse
Is there a way you can walk me through the process to use your app

Oh, I've got your "Root Tool" - still no luck for handsets without SD-card
P.S. He-he, I believe, I'll get WP10 Lumia-940 before someone will release hack for the Lumias without sd-card...

@djamol: I'm curious, how'd you manage to replace the HOSTS file on a non-Samsung phone? Root Tool doesn't allow moving files out of Windows directory, or copying or moving files in, unless you're using the Samsung CRPComponent.
Similarly, while you can get read access to the Windows directory via MTP when using Root Tool, you can't get full FS access; most of the file system (like the Windows dir) will be read-only or even totally unavailable.
I edited the HOSTS file on my Samsung - in fact, I wrote an app to do it, because I had to do it for work sometimes - but that was using CRPComponent or Full FS Access via MTP, neither of which are currently possible on a Lumia using any public hack I know of...

GoodDayToDie said:
@djamol: I'm curious, how'd you manage to replace the HOSTS file on a non-Samsung phone? Root Tool doesn't allow moving files out of Windows directory, or copying or moving files in, unless you're using the Samsung CRPComponent.
Similarly, while you can get read access to the Windows directory via MTP when using Root Tool, you can't get full FS access; most of the file system (like the Windows dir) will be read-only or even totally unavailable.
I edited the HOSTS file on my Samsung - in fact, I wrote an app to do it, because I had to do it for work sometimes - but that was using CRPComponent or Full FS Access via MTP, neither of which are currently possible on a Lumia using any public hack I know of...
Click to expand...
Click to collapse
He used this http://www.windowsphone.com/en-in/store/app/root-tool/f4acc009-ea1e-4063-9bab-fec50195aa1e

GoodDayToDie said:
@djamol: I'm curious, how'd you manage to replace the HOSTS file on a non-Samsung phone? Root Tool doesn't allow moving files out of Windows directory, or copying or moving files in, unless you're using the Samsung CRPComponent.
Similarly, while you can get read access to the Windows directory via MTP when using Root Tool, you can't get full FS access; most of the file system (like the Windows dir) will be read-only or even totally unavailable.
I edited the HOSTS file on my Samsung - in fact, I wrote an app to do it, because I had to do it for work sometimes - but that was using CRPComponent or Full FS Access via MTP, neither of which are currently possible on a Lumia using any public hack I know of...
Click to expand...
Click to collapse
So what i told you before a many times. I've mentioned you a lots of time in my posts.
http://forum.xda-developers.com/showthread.php?t=3014867
http://forum.xda-developers.com/showpost.php?p=58925177&postcount=7
On Lumia device there is a lots of some pretty well arbitrary resources that can allow us to access the "SYSTEM" resources.
I think we had a big miss-understanding about the RPCComponent. because of RPCComponent uses "DeviceIOControl" for registry access and not the RPC functionality. (forgive me if i wrong in my knowledge. I'm a student and new to WP/.Net Platform)
On Lumia Device there is .winmd component known as "Nokia.SilentInstaller.Runtime.winmd" uses "DeviceIOControl" API.
For the "FileSystem" API it works fine without any restrictions which is implemented in "Nokia.SilentInstaller.Runtime.winmd"
But registry access could not getting a well token privileges. we need to find some unlocking trick for registry access (like NonProductionErrors.txt) for that .winmd component to handle the "CreateFileW" function for "DeviceIOControl" API.
About the "Root Tool" App.
There is no update for "Root Tool" app. It is still on the FIRST Release.
Currently I'm working for the "Root Tool Beta" update and I've implemented such resources in my "BETA" build.
I can't do a fast development because of my less/poor Programming knowledge and due to my college busy scheduled.
Thanks.

Can someone make a tutorial how to make it work on lumia 735 please ? i'm new on WP and doesn't understand everything for now

@djamol: My apologies, I somehow missed that you'd managed to get file access working. That's great!
Looking at the APIs that NdtkClient.dll imports, I'm pretty sure it's using RPC, not DeviceIoControl (IOCTL). That's not really important, though; both require INTEROPSERVICES. It's just easier to write our own code using IOCTLs than using RPC, but since we already have a client library, hopefully that won't be needed...

@GoodDayToDie, @djamol: guys, could you please be a little bit more specific? Do you have a .winmd for this dll or function prototypes (not just exports)? NdtkClient.dll library is already on \Windows\system32? Or it should be ingested to the app package? (in this case, the app will be banned on automatic certification process).
As for the "Root Tool" (published in store), it's not using NdtkClient.dll (as far as I know). The file access via FileSystem.winmd/FileSystem.dll to system areas is read-only...
Could you share your finds to general public here or (at least) in private mail? Thanks!

@GoodDayToDie
Yes, Both requires ID_CAP_INTEROPSERVICES.
Can you send me FileSystem's code which is you developed base on the RPCComponent ?
I'll try to port it for lumia using NtdkSvc as possible.
I hope you can port it also for lumia in minutes but I'll try though.
@sensboston
There is no .winmd file for "NtdkClient.dll". You will find that .dll in extras+info app.
and "NtdkSvc.dll" in this path "C:\Windows\System32\NdtkSvc.dll".
There is a very simple trick to bypass the Store Submission process including with kernel libs.
sensboston said:
FileSystem.winmd/FileSystem.dll to system areas is read-only...
Click to expand...
Click to collapse
Even those cap's cant write here until using any System Resources.
"C:\Data\Users\PUBLIC"
But can write here.
"C:\Data\SharedData\OEM\Public"
"C:\PROGRAMS\CommonFiles\OEM\Public"

FileMoveEdit alpha-ish thing
Here you go. It's not been updated in ages, aside from some really minor tweaks I made just now. It's a WP8.0 app; it'll run on a sufficiently-unlocked 8.1 phone, but uses no 8.1 APIs. It also has some known bugs that I really ought to fix, though I'm working on other stuff at the moment.
You can probably get at least some of its tricks working on Lumias, though you may need to drop the symlink functionality as that both requires full capability-unlock and requires editing the NTFS configuration settings in the registry (the same key that, on desktop Windows, is edited by the "fsutil" program).

@GoodDayToDie
Sad thing happened for me. My device screen got broken
So I'm opening a new thread for "Root Tool" app public development.
It would be great for everyone.
Can anyone suggest me for which is best method for public development or any github/codeplex useful ?

@djamol, github is allright.

need an help to interop n unlock cap WP8.1

before some days extra+info get upadated WP10TP and also on Wp8.1. aftrer update we can't install extra+info to SDcard..now how to mod vcreg with extra+info.. for WP8.1 ..
any one can give me the list of cap. and path of cap_ so i will try to edit CAp_ with modded PDF 3. i think this might be worked

you cant do anything... be patient and wait news...

I think it's better to wait for w10 .

ngame said:
I think it's better to wait for w10 .
Click to expand...
Click to collapse
ya we understand:::;;
waiting for new tweaks:::
done:good::good::good::good::good::good:

A AJAY said:
ya we understand:::;;
waiting for new tweaks:::
done:good::good::good::good::good::good:
Click to expand...
Click to collapse
You are not alone my friend T_T

ciao!! Good news for you, some weeks ago i patched an old version of extra & info, deploy and move it to sd!! try!!
https://mega.nz/#!R5YmVTLI!NpzDEkY80rcqYKaDV94UmFbDagvatsH2IzMTWDA5wQk

canapo92 said:
ciao!! Good news for you, some weeks ago i patched an old version of extra & info, deploy and move it to sd!! try!!
https://mega.nz/#!R5YmVTLI!NpzDEkY80rcqYKaDV94UmFbDagvatsH2IzMTWDA5wQk
Click to expand...
Click to collapse
no luck with the windows application deployment tool, error 0x81030120
I believe this error is related to having interop capabilities in one of the libraries included in your XAP.
is there another deployer tha would work? (i already tested WPV xap deployer, also, no luck with that)

i'm not correct, maybe it's impossible to move e&i into sd, sorry

rickastillo said:
no luck with the windows application deployment tool, error 0x81030120
I believe this error is related to having interop capabilities in one of the libraries included in your XAP.
is there another deployer tha would work? (i already tested WPV xap deployer, also, no luck with that)
Click to expand...
Click to collapse
Have you tried with wppt ??? Or with this modified version of deployment tool http://forum.xda-developers.com/windows-phone-8/development/tool-appdeploy-8-1-capabilities-t3158053

ca_guri01 said:
Have you tried with wppt ??? Or with this modified version of deployment tool http://forum.xda-developers.com/windows-phone-8/development/tool-appdeploy-8-1-capabilities-t3158053
Click to expand...
Click to collapse
nah, tested both tools and nothing

I tried full FS access by patching an old version of CustomPFD to see if i could replace extras&info directly from phone memory.
I think some directories are hidden so i could not find the directory where the apps use to be installed.
However, i found a directory with the OEM apps (touch, extra&info, etc), but it seems that it's there only to be applied after a hard reset or something like that, so just replacing files wasn't enough. Extras&Info wasn't the only app with Interop Caps, but almost any app that is under settings has that cap.
So i unistalled touch settings and downloaded it from SD then i used MetroCommander to replace the SD files the old way (before CustomWPSystem was created, lol). Got nothing but an endless "Loading..." screen, but i guess i did something wrong.
But technically (someone correct me if i'm wrong) we can do Interop+Caps unlock using some other app from settings, right?
I'm pretty sure i've seen a settings app with a lot of capabilities in the manifest, not just InteropCapabilities, i don't remember exactly but it had something to do with SMS

TheBITLINK said:
I tried full FS access by patching an old version of CustomPFD to see if i could replace extras&info directly from phone memory.
I think some directories are hidden so i could not find the directory where the apps use to be installed.
However, i found a directory with the OEM apps (touch, extra&info, etc), but it seems that it's there only to be applied after a hard reset or something like that, so just replacing files wasn't enough. Extras&Info wasn't the only app with Interop Caps, but almost any app that is under settings has that cap.
So i unistalled touch settings and downloaded it from SD then i used MetroCommander to replace the SD files the old way (before CustomWPSystem was created, lol). Got nothing but an endless "Loading..." screen, but i guess i did something wrong.
But technically (someone correct me if i'm wrong) we can do Interop+Caps unlock using some other app from settings, right?
I'm pretty sure i've seen a settings app with a lot of capabilities in the manifest, not just InteropCapabilities, i don't remember exactly but it had something to do with SMS
Click to expand...
Click to collapse
Well , i think that we just have to remain with vanilla wp 8.1 until they fix wp10 annoying bugs, everytime i think i found a work around for a bug, there appear more bugs, my fault though, i chose the fast ring...

Now that Groove supports gapless playback, i'm considering going back to W10M (downgraded last week to WP8.1). But it's a hard choice, it sure has nice features but some bugs are just too annoying.
Did they fix the screenshots not appearing in Messenger/WA bug in 10549?

any updates on this? i have WP8.1 Update 2 and i'm having the same issues, not being able to install extras&info to SD card. i read somewhere on reddit (i think) that someone found a method that works currently, but searching around, i can't seem to find out the procedure..

cpshelley2 said:
i read somewhere on reddit (i think) that someone found a method that works currently, but searching around, i can't seem to find out the procedure..
Click to expand...
Click to collapse
And marmot puts it chocolate in the alu-foil...

dxdy said:
And marmot puts it chocolate in the alu-foil...
Click to expand...
Click to collapse
thank you for that wholly worthless response to an honest inquiry..

Try to push this cab using this metod: http://forum.xda-developers.com/win...ile/guide-deploying-astoria-packages-t3214481
Read this http://forum.xda-developers.com/showpost.php?p=63446863&postcount=58 , in cab folder put this unarchived :

augustinionut said:
Try to push this cab using this metod: http://forum.xda-developers.com/win...ile/guide-deploying-astoria-packages-t3214481
Read this http://forum.xda-developers.com/showpost.php?p=63446863&postcount=58 , in cab folder put this unarchived :
Click to expand...
Click to collapse
not work .gives an error and not restart as like project astoria cabs..so it not work.