Database Users

[REQ] i9100T nv_data & .nv_core.bak Need Another Set

I'm currently trying to assist Odia from XDA in SIM unlocking this phone.
He needs another set of nv_core.bin
Use Root Explorer app to get the following files:
/efs/.nv_core.bak
/efs/nv_data.bin
In order to get these off, you will need to copy them to your SDCARD. Make sure to Rename .nv_core.bak to nv_core.bak as windows doesn't support the character . as first character.
Then can you zip/rar/7z it up and upload to mediafire, and pm me the link, so i can pass it to him?
He says he is close, just need another one to find the code.
There is no personal data in these 2 files.

Do u need 2 sets of the files unlocked and locked... Or u after the 2 files locked...

GTIRBOSS said:
Do u need 2 sets of the files unlocked and locked... Or u after the 2 files locked...
Click to expand...
Click to collapse
Just after those 2 files on a locked device would do.
If you can get a unlocked one, that would also be beneficial I think to Odia.

Sent them to odia... Hopefully will have it unlocked this week if no solution becomes avaliable... Then will send unlocked data to odia to help

Meaning of the dot
Hello,
I would like to know is there any special meaning or purpose of the dot as the first character in the filename. Does it mean the file is a backup or is hidden?
Thank you!

Update Ativ S to the last DFP and last Samsung firmware without BootLoop

Follow the guide in the immage.
Guide from Marass82 from WindowsMania.pl
First download this:
https://www.mediafire.com/?5alhewa553gbgao
You can have:
SO 8.10.14219.341
Firmware 2424.14.9.3
Without BootLoop
After the update revert the registry key to the original value and reboot your Ativ S and all retutn normally
Default values are:
HKLM \ SOFTWARE\Microsoft\MTP
"DataStore" = C:\Data\Users\PUBLIC
HKLM\SYSTEM\Platform\DeviceTargetingInfo
"PhoneManufacturer" = SAMSUNG
HKLM\SYSTEM\Platform\DeviceTargetingInfo
PhoneManufacturerModelName = GT-I8750
You must to revert to default because you have a small icon and keyboard with PhoneManufacturerModelName = RM-937_eu_euro1_970 because is for Lumia 1520 that have a 6" screen

Can you post please the link for the dsm files?
THX

Selkmann said:
Can you post please the link for the dsm files?
THX
Click to expand...
Click to collapse
https://www.mediafire.com/?5alhewa553gbgao

Please don't use semi-sketchy third-party sites like MediaFire for small files. XDA allows you to attach files (including ZIPs, even ones much bigger than yours) for download directly on a post, without having to deal the scum that is MediaFire.

When I copy Dsm files I have to delete all existing files before? Or I have to keep them all together the new ones?
Sent from my Ativ S with Tapatalk 2

lukas_ita said:
When I copy Dsm files I have to delete all existing files before? Or I have to keep them all together the new ones?
Sent from my Ativ S with Tapatalk 2
Click to expand...
Click to collapse
Replace old file with the new

So I delete all the elder files and copy the new ones?
Sent from my Ativ S with Tapatalk 2

hello,
i tried to follow steps but after changing registry keys and try to copy the dsm files phone tells me it's impossible to copy
this trick needs full fs access?

tyler200298 said:
hello,
i tried to follow steps but after changing registry keys and try to copy the dsm files phone tells me it's impossible to copy
this trick needs full fs access?
Click to expand...
Click to collapse
Same problem for me...can someone help us?

lukas_ita said:
Same problem for me...can someone help us?
Click to expand...
Click to collapse
Mmmmmm I don't Know, ask to @marass82, For me work probabily without FS access

Ok i edit the registry and replace the file then i search for the update and the phone is downloadig. the phone install the update but i get an error " the update is downloaded but he can not opened 8018830f.
can someone help me????

Mattemoller90 said:
Mmmmmm I don't Know, ask to @marass82, For me work probabily without FS access
Click to expand...
Click to collapse
then waiting for marass82 help )

Selkmann said:
Ok i edit the registry and replace the file then i search for the update and the phone is downloadig. the phone install the update but i get an error " the update is downloaded but he can not opened 8018830f.
can someone help me????
Click to expand...
Click to collapse
you havn't enough sys space
hard reset cannot free much memory as upgrade need
you have to flash a clean rom and repeat upgrade
---------- Post added at 12:17 AM ---------- Previous post was at 12:13 AM ----------
lukas_ita said:
Same problem for me...can someone help us?
Click to expand...
Click to collapse
***solved
hard reset the device and then tried to copy dsm files with success
then i got the (in)famous 8018830f error
so i flash gdr2, and repeat all the process again with success

Re-upload rom gdr3 remove errors(8018830f)

marass82 said:
Re-upload rom gdr3 remove errors(8018830f)
Click to expand...
Click to collapse
follow all steps several times and comes back also to gdr3 then reupdate
but still on 2424.13.10.1
cortana with italian language on board but notlast firmware

Back from GDR3 CMJ, then set the 000-AT - firmware Samsung wp8.1

[XAP] vcREG:Lumia Reg Editor+Jailbreak WP8 version NO LONGER SUPPORTED

WP8 version no longer supported by me, but if others offer fixes, I will post them here. W10M version is discussed in this thread here http://forum.xda-developers.com/win...creg-lumia-reg-editor-interop-unlock-t3451723
WP8/8.1 MixRadio easy method working with instructions from @xboxmod
https://forum.xda-developers.com/showpost.php?p=64350590&postcount=318
WP8/8.1 HERE Maps method working with instructions from @slavanap
WP8.1 instructions (SD card needed)
1.Do device registration to allow sideloading of apps
2. Install HERE Maps (microsoft.com/en-us/store/p/here-maps/9wzdncrfhw6b) from the store, and move it to sd card. Download installation file manually ( wpsnitch.appspot.com ), if you want to install it from SD card.
3.Install Windows Explorer, keep it on phone
https://www.microsoft.com/en-us/stor...r/9wzdncrdrl4w
4.Sideload WPSystem_Folder_Unlocker_Release_ARM.xap(thanks @djamol and @contable),keep it on phone
5.Extract Install.zip from below , and put the extracted "Install" folder on the root of your sd card. The Install folder should have 4 files in it.
6.Open WPSystem Folder Unlocker app. Hit Unlock WPSystem Folder(sd card) button. It should say Success. Now close it
7.Open Windows Explorer.
8.Hit the app bar, go to "access folders",hit the +, choose sd card, then click the check mark
9.Navigate to D:\WPSystem folder. Rename the Apps folder to Apps1. Now open Apps1 folder
10. Navigate to {EFA4B4A7... or {6C28635B-... (I got the second GUID after reinstall)
11. Delete all directories here except Install . Then navigate to Install folder. Delete following 3 files from there: AppManifest.xaml NokiaRegistryUtils.dll NokiaRegistryUtils.winmd
12.Navigate to D:\WPSystem folder and rename Apps1 back to Apps
13. Navigate to the root of your sd card. Get into "Install" folder we put here earlier. Choose all 4 files from there to Copy.
14.Navigate to D:\WPSystem\Apps\{EFA4B4A7-74...}\Install folder. Hit the app bar then paste.
15. Go to your apps list and run HERE Maps. vcREG should open. Apply unlock.
16. After you apply the unlock, you can sideload vcREG_1_2_SIDELOAD.xap to have the app available in your applist for future use.
Q&A
HOW TO USE THE APP TO CAP UNLOCK
now that the app is open, you want to unlock all capabilities. hit the app bar, and tap "templates". here we see two options, interop/caps unlock, and full fs access through MTP. check your options, and click apply. Reboot for MTP.
HOW TO USE THE REGISTRY EDITOR
the main registry editor is pretty straightforward. put the correct path, the key name and value if its a write.
string: it will read as one string. writing is the same,write a string, no spaces, hit write
multistring: multiple strings are read as strings separated by spaces. to write multiple strings, separate each string by a space, hit write.
dword: it will read as 8 characters of ascii. so a value of 1 will read as 00000001. writing is the same. you MUST write 8 characters or it wont write it,so a 1 is 00000001 and B0000 is 000B0000. all bytes are hex, not decimal.
binary: when you read, the app will return 20 bytes, regardless of how long the binary is. if the whole binary sequence is 11 22 33, it will read as 112233 and then 17 00s. the reason for this is that there isnt a method to know how long the binary sequence is,so i hardcoded it to read 20. even if its longer than 20 bytes, you will only get 20 bytes back. i can up the limit at a later time if its something people need.
writing binary is also limited to a max of 20 bytes. if you are writing less than 20 bytes though, dont put the extra zeroes. if you are writing 4 bytes such as 11 22 33 44, then simply write it like this 11223344(no spaces) then hit write.
DO THESE REGISTRY CHANGES PERSIST AFTER A HARD/FACTORY RESET?
no. if you hard reset, you will revert back to the stock rom and any changes you made to the registry will be lost. you will have to make the changes again after a hard reset. file system changes, especially in the windows folder can persist though.
[/HIDE]

Work with me very fine.
THANKS

Is there a way to sideload marketplace apps such as tetra lock screen 1.2.0.0 ? I loved that app.
---------- Post added at 08:11 PM ---------- Previous post was at 08:10 PM ----------
And thanks for bringing us another option. It brings our community closer together

followed your steps. thank you. not sure how to do this though:
"Once completed, you can remove the app and put extras+info back". How to remove it....
never mind. renamed apps folder on SDCard to appx, deleted the app, renamed the folder back to apps, rebooted, changed time to 2115 and was able to uninstall and reinstall.
cheers

derausgewanderte said:
followed your steps. thank you. not sure how to do this though:
"Once completed, you can remove the app and put extras+info back". How to remove it....
never mind. renamed apps folder on SDCard to appx, deleted the app folder, renamed the folder back to apps, rebooted, changed time to 2115 and was able to uninstall and reinstall.
cheers
Click to expand...
Click to collapse
updated the first post with a dead easy method I use

Ok did everything from the package you PM'ed me and ya phn is now interop unlocked.. Changed the MaxUnsignedApp to 170(thats enough for me) I didn't have time to check the homebrew apps I'll try them later. Thnx for this

Pretty Awesome Bro !!!
So what i was looking for... Good job mate.
NTDK Server is a great more than Samsung RPCComponent.
I hope that you can expand it to the more API's.
Like File System API and much more.
Other people's. Please do not spam such thread with your questions. Leave it completely for development related.
Your Q/A goes Here.

@vcfan
So this is similart to what root access on android phone? What is the main advantage if we do this, what do we gain? For me on android the bes thing was customization of the look, and the possibility to block ads in free applications . The ads in windows phone aplications are really annoying when the pop up through whole screen, it would be great if there was a way to block them with host file or something, like in android.

I wonder if we can add an extra quick action. I tried editing the "AllowedQuickSettingsElements" registry but it reverts back to 4 as soon as I pull down the action bar.

MultiPDev said:
I wonder if we can add an extra quick action. I tried editing the "AllowedQuickSettingsElements" registry but it reverts back to 4 as soon as I pull down the action bar.
Click to expand...
Click to collapse
Same happens with my 630 .

Will this work on W10 TP?
As im trying to ,the system wont grant WPCustomSystem access to change the name of the "Apps" folder so that the data can be patched

surya467 said:
Will this work on W10 TP?
As im trying to ,the system wont grant WPCustomSystem access to change the name of the "Apps" folder so that the data can be patched
Click to expand...
Click to collapse
No it doesn't work with wp10 tp . You should get unlocked before going for 10 tp.

irshad2809 said:
No it doesn't work with wp10 tp . You should get unlocked before going for 10 tp.
Click to expand...
Click to collapse
I did it, but i cant deploy some apps, maybe something went wrong, thanks

surya467 said:
I did it, but i cant deploy some apps, maybe something went wrong, thanks
Click to expand...
Click to collapse
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?

Has anyone tried to replace black background under All apps (the list of all apps) with some custom wallpaper?

Can anyone with a Lumia 830 confirm this is working?

irshad2809 said:
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?
Click to expand...
Click to collapse
What I did was,
I had Windows Phone 8.1 Update 2 installed with developer unlock
I unlocked the phone with Interop Unlock but did not hard reset
Then i updated WP 8.1 to Win 10 TP and then i hard reset
it seems the unlock worked.
I can deploy ,
App data manager which WORKS
CustomWPsystem which works but cannot patch because Win10 TP doesnt allow permissions to WPSystem folder
I deployed vcREG: Lumia Reg Editor too
but since i hard reset developer unlock should be removed, so im guessing its interop unlock
The only issue is i cannt deploy io explorer, wphtweaks and accept colors app
Is this only bcuz of power tools ? IDK because i have VS 2013 on home PC and it still gives manifest file error.
---------- Post added at 11:13 AM ---------- Previous post was at 11:11 AM ----------
irshad2809 said:
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?
Click to expand...
Click to collapse
XDRdaniel said:
Can anyone with a Lumia 830 confirm this is working?
Click to expand...
Click to collapse
Yes ofcourse it is
https://onedrive.live.com/redir?res...08447&authkey=!AAkZG-uRpRAzdbM&ithint=folder,
take the data.bin file from here, depends on your RM though

surya467 said:
What I did was,
I had Windows Phone 8.1 Update 2 installed with developer unlock
I unlocked the phone with Interop Unlock but did not hard reset
Then i updated WP 8.1 to Win 10 TP and then i hard reset
it seems the unlock worked.
I can deploy ,
App data manager which WORKS
CustomWPsystem which works but cannot patch because Win10 TP doesnt allow permissions to WPSystem folder
I deployed vcREG: Lumia Reg Editor too
but since i hard reset developer unlock should be removed, so im guessing its interop unlock
The only issue is i cannt deploy io explorer, wphtweaks and accept colors app
Is this only bcuz of power tools ? IDK because i have VS 2013 on home PC and it still gives manifest file error.
---------- Post added at 11:13 AM ---------- Previous post was at 11:11 AM ----------
Yes ofcourse it is
https://onedrive.live.com/redir?res...08447&authkey=!AAkZG-uRpRAzdbM&ithint=folder,
take the data.bin file from here, depends on your RM though
Click to expand...
Click to collapse
Nope, the same. Crash right after i press "Aply XAP" :'(

XDRdaniel said:
Nope, the same. Crash right after i press "Aply XAP" :'(
Click to expand...
Click to collapse
its not an unlock issue, your not able to patch the app, that is an sd card issue
I think u can do it manually or format SD card and try again

thanks for the app but I can't write any reg key? i wonder if it did not send me the confirmation notification or it just can't?

(6/12/15)Again Interop/cap Unlock in lumia and temporary solution for WPINTERNALS.

Edited - Added A new procedure and no more reset anymore.
:good::good::good::good::good::good::good::good:
people who have audio problem after "root unlock" can use this trick temporary.in this trick there is no issue in audio..and i think the audio fix option will come soon.
ok here is The latest trick for interop unloking listed lumia devices.i will write the post shortly.the 60% work will do the wpinternal app.so u have to read the post.
Device supported:
Lumia 520,521,525,620,625,810,820,822,920,925,1020,720 (Other devices is not suported in WPINternals that's why those devices owner have to wait).
**1st a big thanks to "Heathcliff74" for his awesome tool.and 2nd Big thanks to "AndroidXsK" for the SBL3 partitions.
ok here is the procedure.
1st follow this link to unlock ur bootloader.The wpinternals app has all Answers of ur questions.
http://forum.xda-developers.com/windows-phone-8/development/windows-phone-internals-unlock-t3257483
1st download the tool and read the getting started section carefully. (don't do anything just read).
2nd download the SBL3 Partion files from this link. --- http://forum.xda-developers.com/showpost.php?p=64100811&postcount=267
now with the Wpinternals app unlock ur bootloader with the supported SBL3 partitions.
here u have to choose exact partition which match with ur phone..
well if u have a same cpu which matches with sbl3 partion supported phone u can use that for ur phone also..suppose u r using lumia 521/525 but there is no sbl3 partition for those phone then u can use 520 sbl3 partition .bcz 520 has the same processor.i think u understood.
after unlocking bootloader ur phone will reboot to normal mode..keep connected ur phone with pc by USB ..now from the wpinternal app go to manual mode and select "mass storage mode" in the app.the phone will boot again and will go black(unresponsive) ..don't worry.then u will find a new mounted drive partition in ur pc.it's ur phone mainos partition.
go to that drive and u will se some folders .if u don't know pls don't play with those folders.just go to (windows>packages>registry files) folders..u will find many reg files just copy the "Software.reg" file in ur desktop.we will work with that file.
now open 7zip file manager (don't have just download or install)
select the software reg file from desktop.
after clciking on software reg u will see a file named software without any extension.
right click on the file and click "edit".
now a notepad tab will open with many lines..
now add these quoted(add without quotes) lines from the attachment at the end of the software file lines.
View attachment 3566593
now save the file by pressing "Ctrl+S"
now a msg box will appear on 7z file manager just click yes...
after that put/replace the modified software.reg files in the (new mounted drive>windows>packages>registry files) folder.
now soft reset ur phone by clicking "volume down+power button" for 10 second.
then the phone will boot up normally..now u have to must give a hard reset ur phone to get the new capabilities unlocked...
2nd Procedure(No reset anymore) :
Thanks to @_wook_
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
attachment Link - forum.xda-developers.com/attachment.php?attachmentid=3563171&d=1449110333
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...
N.B.-
somethings u must be remembered that the unlock will be parmanent.and i will not responsible for any kind of harm in ur phone.and devices which (like 720) doesn't have sbl3 partitions,u can also unlock ur device by dumping ur phone partition.for this u have to read WPinternals getting started section.
******Sorry for my bad english**************

audio working?

reksden said:
audio working?
Click to expand...
Click to collapse
Yes..thats why i said temporary solution..

Riyad_ said:
Yes..thats why i said temporary solution..
Click to expand...
Click to collapse
okay, but i have lumia 720(((

The version of 7z that you use ?

reksden said:
okay, but i have lumia 720(((
Click to expand...
Click to collapse
No rpoblem..u can try this by dumping ur phone mainos partition.check wpinternals.net

titi66200 said:
The version of 7z that you use ?
Click to expand...
Click to collapse
version 9.34..also works with version 9.20

Thanks

Riyad_ said:
No rpoblem..u can try this by dumping ur phone mainos partition.check wpinternals.net
Click to expand...
Click to collapse
okay, this instruction is older, i get interop unlock with oem setting and system and other reg(huawei w1 with 8.0 05420). but i flashed dump with interop unlock.

Why not writing reg values directly here ?
"C:\Windows\System32\Config"

Thank you so much Riyad_,
this a great notice and I will use now the toturial in my lumia 520

Riyad_ said:
:good::good::good::good::good::good::good::good:
people who have audio problem after "root unlock" can use this trick temporary.in this trick there is no issue in audio..and i think the audio fix option will come soon.
ok here is The latest trick for interop unloking listed lumia devices.i will write the post shortly.the 60% work will do the wpinternal app.so u have to read the post.
Device supported:
Lumia 520,521,525,620,625,810,820,822,920,925,1020,720 (Other devices is not suported in WPINternals that's why those devices owner have to wait).
**1st a big thanks to "Heathcliff74" for his awesome tool.and 2nd Big thanks to "AndroidXsK" for the SBL3 partitions.
ok here is the procedure.
1st follow this link to unlock ur bootloader.The wpinternals app has all Answers of ur questions.
http://forum.xda-developers.com/windows-phone-8/development/windows-phone-internals-unlock-t3257483
1st download the tool and read the getting started section carefully. (don't do anything just read).
2nd download the SBL3 Partion files from this link. --- http://forum.xda-developers.com/showpost.php?p=64100811&postcount=267
now with the Wpinternals app unlock ur bootloader with the supported SBL3 partitions.
here u have to choose exact partition which match with ur phone..
well if u have a same cpu which matches with sbl3 partion supported phone u can use that for ur phone also..suppose u r using lumia 521/525 but there is no sbl3 partition for those phone then u can use 520 sbl3 partition .bcz 520 has the same processor.i think u understood.
after unlocking bootloader ur phone will reboot to normal mode..keep connected ur phone with pc by USB ..now from the wpinternal app go to manual mode and select "mass storage mode" in the app.the phone will boot again and will go black(unresponsive) ..don't worry.then u will find a new mounted drive partition in ur pc.it's ur phone mainos partition.
go to that drive and u will se some folders .if u don't know pls don't play with those folders.just go to (windows>packages>registry files) folders..u will find many reg files just copy the "Software.reg" file in ur desktop.we will work with that file.
now open 7zip file manager (don't have just download or install)
select the software reg file from desktop.
after clciking on software reg u will see a file named software without any extension.
right click on the file and click "edit".
now a notepad tab will open with many lines..
now add these quoted(add without quotes) lines from the attachment at the end of the software file lines.
View attachment 3562770
now save the file by pressing "Ctrl+S"
now a msg box will appear on 7z file manager just click yes...
after that put/replace the modified software.reg files in the (new mounted drive>windows>packages>registry files) folder.
now soft reset ur phone by clicking "volume down+power button" for 10 second.
then the phone will boot up normally..now u have to must give a hard reset ur phone to get the new capabilities unlocked...
N.B.-
somethings u must be remembered that the unlock will be parmanent.and i will not responsible for any kind of harm in ur phone.and devices which (like 720) doesn't have sbl3 partitions,u can also unlock ur device by dumping ur phone partition.for this u have to read WPinternals getting started section.
******Sorry for my bad english**************
Click to expand...
Click to collapse
I get the black screen with sad face reboot loop.

into the ffu ? How ?

There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...

_wook_ said:
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
Click to expand...
Click to collapse
Have you tested this?.

Rivo17 said:
Have you tested this?.
Click to expand...
Click to collapse
Of course, but, i recommend you to try first post. As I wrote, I have a crazy phone...

In that case, you must better edit your post for avoid confusion. Just saying.

_wook_ said:
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...
Click to expand...
Click to collapse
Loading hive and searching for capabilities i think it's more complicated...just adding some line is much more easier .but ur tut is good too.

djamol said:
Why not writing reg values directly here ?
"C:\Windows\System32\Config"
Click to expand...
Click to collapse
i was confused about it that's why i used software.reg. ..

Rivo17 said:
I get the black screen with sad face reboot loop.
Click to expand...
Click to collapse
i also got this 1st time. try again resetting or flash the ffu again.

Lumia 950/950XL Service level execution

Hi,
I've been able to use vcREG 1.5 on a 950XL to execute any exe file via services.exe, except it's getting stopped by Code Integrity. That's also why putting older NdtkSvc.dll doesn't work on the newer phone (aside from the fact that it has to be in c:\windows). I thought oh maybe any valid arm executable signed by microsoft would be enough, so I copied some executables from the Raspberry Pi Windows 10 IoT image, but I could only get them to run inside the app sandbox because they weren't in the system catalog :'(
Example:
21-March-2016 15:04:08.339601 0x000003D4 0x00000F88 Verbose Microsoft-Windows-CodeIntegrity Code Integrity completed validating file hash. Status 0xC0000428.
21-March-2016 15:04:08.339631 0x000003D4 0x00000F88 Error Microsoft-Windows-CodeIntegrity Code Integrity determined that a process (\Device\HarddiskVolume37\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume39\WPSystem\ftpd.exe that did not meet the Windows signing level requirements.
So now the trick is to find an executable on the system that currently exists, that can be used to gain further access... I've been trying various things like OOBE stuff etc without any luck so far.
Hoping someone else has some ideas... maybe even executing a dll function to import registry from a file or something directly, then we could unlock interop on 950's..
Thanks

Great work
maybe you can MTP your 950/950xl and look for the files in the \windows folder
micheal

Can you tell me how to execute a exe via services.exe ? Thanks?

naiple said:
Can you tell me how to execute a exe via services.exe ? Thanks?
Click to expand...
Click to collapse
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.

megasounds said:
Great work
maybe you can MTP your 950/950xl and look for the files in the \windows folder
micheal
Click to expand...
Click to collapse
Actually using MTP isn't the best thing for that, because you are missing out on more than half of the available executable files as they are not viewable via MTP on 950/XL due to permissions. It's best to mount the FFU image and look around that way.
I have already looked and tested most of them, thus why I was asking if anyone else had some ideas.

darkfires said:
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.
Click to expand...
Click to collapse
Thanks! I will try it on my lumia

darkfires said:
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.
Click to expand...
Click to collapse
I can't find NlpmService because my lumia730 don't have a Glance screen ... is there any way else to run a exe?

naiple said:
I can't find NlpmService because my lumia730 don't have a Glance screen ... is there any way else to run a exe?
Click to expand...
Click to collapse
I only decompiled the NdtkSvc on 950XL, the one on 730 might be different. But to answer your question there is only one other way, and it will kill USB so you won't be able to connect to it via PC at all until you reverse the change. If you post your NdtkSvc.dll I can check it for you.
HKLM\SYSTEM\ControlSet001\Services\NokDeviceHubSvc\ImagePath

darkfires said:
I only decompiled the NdtkSvc on 950XL, the one on 730 might be different. But to answer your question there is only one other way, and it will kill USB so you won't be able to connect to it via PC at all until you reverse the change. If you post your NdtkSvc.dll I can check it for you.
HKLM\SYSTEM\ControlSet001\Services\NokDeviceHubSvc\ImagePath
Click to expand...
Click to collapse
Ahh, i find the Nlpmservice. Don't know why i cant find it yesterday... And if you need any thing(unlocked bootloader, uefi...) from 730 or 540 i can post it, both are prototype and can enter massStorage. Hope i can help you. Thank you for the answer

naiple said:
Ahh, i find the Nlpmservice. Don't know why i cant find it yesterday... And if you need any thing(unlocked bootloader, uefi...) from 730 or 540 i can post it, both are prototype and can enter massStorage. Hope i can help you. Thank you for the answer
Click to expand...
Click to collapse
I'm trying to do something different and I found this topic so if you still have these devices can you extract NlpmService.dll file from System32 and upload it here for me?