Finally de-brand AT&T Lumia 1020 (RM-877) successfully, this method may also work on any other Lumia Windows Phone!
Warning: This method is not fully tested, may brick your phone! Back up all data, and do not use this method to flash any incompatible ROMs!
Method A
Update your AT&T Lumia 1020 to Windows 10 mobile and interop unlock it.
Change the registry value of “DataStore” to “C:\EFIESP\efi\Nokia” in “HKLM\SOFTWARE\Microsoft\MTP”.
Connect the phone to PC, open “Phone\PCONF”, copy “config.pcn” to your HDD and use a HEX editor to open it.
Change P5217_ATT (HEX: 50 35 32 31 37 5F 41 54 54) to P5217 (HEX: 50 35 32 31 37 00 00 00 00) at offset 0x10, then save it.
Copy modified “config.pcn” back to “Phone\PCONF” and overwrite it.
Restart your phone and use flashing tools like “thor2.exe” to flash unbranded RM-875 rom!
Method B
Download the update cab (Lumia 1020 ONLY)
Then copy the cab file to an empty folder, e.g. “c:\cab”.
Download and install the tools (Thanks WojtasXda!)
Connect the phone to PC, then run cmd and go to “iutool.exe” folder (default: Program Files (x86)\Windows Phone Kits\8.1\Tools\bin\i386), type
Code:
iutool.exe -p c:\cab -V
The phone should restart and install updates automatically (ignore ERROR: 0x8024a110)
Flash unbranded RM-875 rom!
My AT&T Lumia 1020 is carrier unlocked, the method does not relock my phone.
We knew AT&T changed the Platform ID (P5217_ATT) to avoid flashing RM-875 rom (P5217). The flashing tools check the platform info values of the phone and the DevicePlatformID string from the rom. Lumia 635/820 has SD card, and the device info in the registry can be changed. After the phone checking and installing updates, it is unbranded. Thus the updates can change the Platform ID info of the phone. (Thanks pankaj981 for this guide)
I find the update cabs of an unbranded RM-876 phone (flashed RM-875 rom). Then using the iutool.exe to update AT&T RM-877 manually. After that, I flashed RM-877 with RM-875 rom successfully (Method B). Finally, I find “config.pcn” contains Platform ID. Thus for an interop unlocked phone, Method A may be easier.
Post here if you have any questions!
Lumia 640 AT&T
I can't seem to find the config.pcn on Lumia 640 AT&T, but I got access to EFIESP by using "C:\EFIESP" or "\EFIESP" (both work) for the DataStore.
I see from another forum users can edit the xml files found in "Windows Phone\Phone\Windows\Packages\DsmFiles", so is there anything else I can edit to remove the _ATT for Lumia 640 AT&T?
qodexc said:
I can't seem to find the config.pcn on Lumia 640 AT&T, but I got access to EFIESP by using "C:\EFIESP" or "\EFIESP" (both work) for the DataStore.
I see from another forum users can edit the xml files found in "Windows Phone\Phone\Windows\Packages\DsmFiles", so is there anything else I can edit to remove the _ATT for Lumia 640 AT&T?
Click to expand...
Click to collapse
I've download the AT&T 940 rom (RM1073_059X0B8), and I find file "pconf.bin" in "PLAT" partition has the infomation about platform ID; but i'm not sure whether the modified file takes effect.
Code:
NAME=P6204_ATT
SWVERSION=02177.00000.15184.36000
To access "PLAT" partition ,the drive letter may need to be assigned. The information about mounted drive is in registry "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices"
But the registry editors like vcREG have the limit:
binary: when you read, the app will return 20 bytes, regardless of how long the binary is.
Click to expand...
Click to collapse
The key is stored in binary and may be longer than 20 bytes.
The "PLAT" partition is FAT12, I don't know if W10M were able to read it.
If you have an international Lumia 940 and it have a lower ROM version, you could use Fiddler to find all the update cabs like this.
If there is one which has the Platform ID, you could use iutool to update your AT&T 640 with that cab. This may be a lot work to do.
If just using the way here then updating to W10M?
Lumia 640 has SD card, and the DeviceTargetInfo can be edited in WP8.1. If the edited AT&T 640 was updated to W10M, the Platform ID may be changed. I'm not sure, but this seems easy to try.
e-Pig said:
I've download the AT&T 940 rom (RM1073_059X0B8), and I find file "pconf.bin" in "PLAT" partition has the infomation about platform ID; but i'm not sure whether the modified file takes effect.
Code:
NAME=P6204_ATT
SWVERSION=02177.00000.15184.36000
To access "PLAT" partition ,the drive letter may need to be assigned. The information about mounted drive is in registry "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices"
But the registry editors like vcREG have the limit:
The key is stored in binary and may be longer than 20 bytes.
The "PLAT" partition is FAT12, I don't know if W10M were able to read it.
If you have an international Lumia 940 and it have a lower ROM version, you could use Fiddler to find all the update cabs like this.
If there is one which has the Platform ID, you could use iutool to update your AT&T 640 with that cab. This may be a lot work to do.
If just using the way here then updating to W10M?
Lumia 640 has SD card, and the DeviceTargetInfo can be edited in WP8.1. If the edited AT&T 640 was updated to W10M, the Platform ID may be changed. I'm not sure, but this seems easy to try.
Click to expand...
Click to collapse
It's definitely that pconf.bin values that needs to be edited. That plat partition is preventing me from flashing other roms, I'm getting "image targeting check failed Device: Nokia.MSM8926.P6204_ATT.1.1, Image: Nokia.MSM8926.P6204". I tried updating to Windows 10 with modified DeviceTargetInfo, but I still get this error when I try to flash a CV rom.
I don't think I can edit the registry for "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices", it showed something like "system.[]" for value. I think the only way is for someone to provide an international 640 platformid cab and use iutool.
qodexc said:
It's definitely that pconf.bin values that needs to be edited. That plat partition is preventing me from flashing other roms, I'm getting "image targeting check failed Device: Nokia.MSM8926.P6204_ATT.1.1, Image: Nokia.MSM8926.P6204". I tried updating to Windows 10 with modified DeviceTargetInfo, but I still get this error when I try to flash a CV rom.
I don't think I can edit the registry for "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices", it showed something like "system.[]" for value. I think the only way is for someone to provide an international 640 platformid cab and use iutool.
Click to expand...
Click to collapse
It seems that this registry editor can read/write binary values. But I don't have W10M phone now to test it.
PS. I tested the ffu vhd on PC. The Plat partition is hidden, it is not work even if you write the information about assigning drive letter in HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices. The drive letter will not appear until the hidden attribute been clear. It is hard to edit partition attribute on a phone. Maybe the only way is getting a cab that updating the Platform ID.
Thanks for testing and confirming the registry method doesn't work. Well there is nothing to do but wait for a .cab file.
Don't **** with the PLAT partition unless you know what you are doing.
I know someone who applied an update to PLAT partition that wasn't for their device, and doing that hard bricked it.
One thing you could try is modifying the exact same registry keys for the RM-977 as mentioned in my thread here. Now the only reason the update will kick in is if the OS/firmware version is lower than what's on your device.
Hello! When using method # 2 I get the message:
[1] Started device **********************************
[1] Transferring files started
[1] Transferred file 1/4
[1] Transferred file 2/4
[1] Transferred file 3/4
[1] Transferred file 4/4
[1] Transferring files complete: 4 files
[1] Update started
[1] Installation failed (HRESULT = 0x801882c1)
[1] Failed (0x801882c1)
ERROR: 0x801882c1
Command failed. (HRESULT = 0x801882c1)
Using Windows 10 Pro. On Windows phone 8.1 update 1
Help in this issue please
Please, explain me this method with one Nokia Lumia 1520 AT&T ?
Thank you.
someone can upload the PCONF file from a lumia 1520 NON at&T?
regards
It works.
Just wanted to say thanks to e-Pig, and let people know that this works (at least on my machine). I have an AT&T Lumia 1020, 32gb version:
I used the cab method (Method B) as described.
For flashing, I used this tutorial http://forum.xda-developers.com/showthread.php?t=2515453. Disabling driver signing in Windows 10 is a pain, so for flashing I instead emulated Windows 7 in VirtualBox. This required using the USB passthrough feature when connecting the phone to the PC.
The ROM I used was RM875_3051.50009.1424.0003_RETAIL_eu_euro1_211_03_447991_prd_signed.ffu , which I obtained from the mr.crab site mentioned in the flashing tutorial http://www.mrcrab.net/nokia.html. So, no need for Naviform+.
Everything good so far.
Fantastic, thank you!
First try using the cab file method to unbrand my ATT RM-877.
The "tools" when I install them, I don't get an i386 folder where the iutool should be. I got a zip of the i386 folder and used that. Everything I tried to do generated ERROR: 0x80070490. It was a driver issue. I tried it on a different machine, successfully unbranded an ATT 1020 and flashed it with unbranded US CV 059W473. I tried a repair of the Lumia USB drivers from Programs and Features on the original machine, tools work there now.
Question: Do you happen to have the ATT-branded cab file, in case someone wanted to reverse the process?
nunzio1961 said:
Please, explain me this method with one Nokia Lumia 1520 AT&T ?
Thank you.
Click to expand...
Click to collapse
I don't have Lumia 1520. I downloaded the RM940 rom (059V5B2) and find the Platform ID is the same as Lumia 640. It's in pconf.bin located in "PLAT" partition.
Code:
NAME=P6081_ATT
PKEY=3
SWVERSION=02540.00019.14484.37000
I haven't found a way to modify this file manually. An update cab to modify this file is needed, just as Lumia 640.
Sorry for not helping.
tyler200298 said:
someone can upload the PCONF file from a lumia 1520 NON at&T?
regards
Click to expand...
Click to collapse
This is from RM938 (059V3K8).
Code:
NAME=P6081
PKEY=3
SWVERSION=1028.3534.9200.10517
e-Pig said:
This is from RM938 (059V3K8).
Code:
NAME=P6081
PKEY=3
SWVERSION=1028.3534.9200.10517
Click to expand...
Click to collapse
Hello, thanks
so this is config.pcn code from a no brand lumia 1520.
i'll try to modify one inside the phone
---------- Post added at 06:46 PM ---------- Previous post was at 06:38 PM ----------
e-Pig said:
This is from RM938 (059V3K8).
Code:
NAME=P6081
PKEY=3
SWVERSION=1028.3534.9200.10517
Click to expand...
Click to collapse
hello, can you zip this file and upload? so i can see complete hex
tyler200298 said:
Hello, thanks
so this is config.pcn code from a no brand lumia 1520.
i'll try to modify one inside the phone
---------- Post added at 06:46 PM ---------- Previous post was at 06:38 PM ----------
hello, can you zip this file and upload? so i can see complete hex
Click to expand...
Click to collapse
Of course.
From here I find the Platform ID update cab of ATT 1520. A non-ATT 1520 is still needed to find the cab to debrand.
e-Pig said:
Of course.
Click to expand...
Click to collapse
thanks my friend
ATT L925
Hello, will it be possible to de-brand a AT&T Lumia 925 RM-893 using method B? Where can i find the cab file?
Mine is sim unlocked.
Thank you in advance.
Lumia 625
Is this same for lumia 625
Related
Found these in my dump files and was wondering if they would be of any use in "jailbreaking" the Lumia phones? At the very least would it be possible to rewrite the ffuloader.efi in order to use it to modify .ffu files?
tonbonz said:
Found these in my dump files and was wondering if they would be of any use in "jailbreaking" the Lumia phones? At the very least would it be possible to rewrite the ffuloader.efi in order to use it to modify .ffu files?
Click to expand...
Click to collapse
I'm not an expert but I think it's not possible, since there's a signature check system in uefi..so even if someone would be able to modificy the ffuloader file in the correct way, without a SIGNED .ffu the system couldn't boot anyway. And, as far as I know, nobody is able to generate a valid signature. And, of course, disabling the signature-check system is something unknown.
It isn't really Nokia - FFU is Microsoft reference format. There is currently no way to edit anything serious except Data partition
Your hope would be that there is a private key embedded in one of those files inside the ffu...then we'd be home free! ffu in of itself isn't really anything special..think of it as a zip file.
I have been doing way too much reading into the bootlaoders and how they work. I found the following quote interesting (taken from
http://forum.xda-developers.com/showpost.php?p=37245426&postcount=21):
any current qualcomm chipset with blown secure fuses require valid signature in order to execute loader from flash ( emmc,nor,nand ) or from peripheral boot ( emergency loader )
every phone producer ( sony, htc, nokia, zte, etc ) have own OEM ID number, which is blown on hardware level, so every phone model can have specific loader ( but usually manufacturers using same OEM ID for all phones on same chipset )
some manufacturer for unknown reasons use unsecure chipsets ( which accept unsigned loaders ) - perfect example nokia lumia series until 9xx
Click to expand...
Click to collapse
What I was curious about was if you edit the .ffu file with a hex editor at all it changes the CRC that the .vpl from the NCS packages looks for and when flashing you get a corrupt .ffu warning. Changing the CRC in the .vpl gets a corrupt .vpl error. What I noticed was if I unmount the .ffu, mounted using the image mounting tool from another thread,using disk manager the temp virtual disk file stays the same size as the.ffu file (4.12G). However I didn't know about the CRC check at this time. So now I remounted the .ffu, changed nothing but the registry key for interop unlock, and unmounted the disk. Once again the temp virtual disk file created is the the same size as the rom .ffu.Upon checking the CRC of the virtual disk it also remained the same as the rom's .ffu file. However you can not simply change the file name back to rm-860blahblahblah.ffu. So thought maybe these could be used in some way to open or mount the rom so when unmounted you were left with original .ffu. I'm sure there is more than the CRC that is being checked. As i've stated many times before I am still learning as I go but am highly interested in learning and spend tons of free time reading and exploring files. Just now getting around to trying to understand the boot process.
There are integrated hashtables in the FFU.
I thought about this too, but any editing to the ffu, without resiging the ffu will result in an error when you flash it, because the boot loader won't install unsigned .ffus. From what I've heard anyways.
Sent from my Nokia 521 using XDA Windows Phone 8 App
These were in the secure boot policy Certificates seen in the pictures from the first post.
WP8 version no longer supported by me, but if others offer fixes, I will post them here. W10M version is discussed in this thread here http://forum.xda-developers.com/win...creg-lumia-reg-editor-interop-unlock-t3451723
WP8/8.1 MixRadio easy method working with instructions from @xboxmod
https://forum.xda-developers.com/showpost.php?p=64350590&postcount=318
WP8/8.1 HERE Maps method working with instructions from @slavanap
WP8.1 instructions (SD card needed)
1.Do device registration to allow sideloading of apps
2. Install HERE Maps (microsoft.com/en-us/store/p/here-maps/9wzdncrfhw6b) from the store, and move it to sd card. Download installation file manually ( wpsnitch.appspot.com ), if you want to install it from SD card.
3.Install Windows Explorer, keep it on phone
https://www.microsoft.com/en-us/stor...r/9wzdncrdrl4w
4.Sideload WPSystem_Folder_Unlocker_Release_ARM.xap(thanks @djamol and @contable),keep it on phone
5.Extract Install.zip from below , and put the extracted "Install" folder on the root of your sd card. The Install folder should have 4 files in it.
6.Open WPSystem Folder Unlocker app. Hit Unlock WPSystem Folder(sd card) button. It should say Success. Now close it
7.Open Windows Explorer.
8.Hit the app bar, go to "access folders",hit the +, choose sd card, then click the check mark
9.Navigate to D:\WPSystem folder. Rename the Apps folder to Apps1. Now open Apps1 folder
10. Navigate to {EFA4B4A7... or {6C28635B-... (I got the second GUID after reinstall)
11. Delete all directories here except Install . Then navigate to Install folder. Delete following 3 files from there: AppManifest.xaml NokiaRegistryUtils.dll NokiaRegistryUtils.winmd
12.Navigate to D:\WPSystem folder and rename Apps1 back to Apps
13. Navigate to the root of your sd card. Get into "Install" folder we put here earlier. Choose all 4 files from there to Copy.
14.Navigate to D:\WPSystem\Apps\{EFA4B4A7-74...}\Install folder. Hit the app bar then paste.
15. Go to your apps list and run HERE Maps. vcREG should open. Apply unlock.
16. After you apply the unlock, you can sideload vcREG_1_2_SIDELOAD.xap to have the app available in your applist for future use.
Q&A
HOW TO USE THE APP TO CAP UNLOCK
now that the app is open, you want to unlock all capabilities. hit the app bar, and tap "templates". here we see two options, interop/caps unlock, and full fs access through MTP. check your options, and click apply. Reboot for MTP.
HOW TO USE THE REGISTRY EDITOR
the main registry editor is pretty straightforward. put the correct path, the key name and value if its a write.
string: it will read as one string. writing is the same,write a string, no spaces, hit write
multistring: multiple strings are read as strings separated by spaces. to write multiple strings, separate each string by a space, hit write.
dword: it will read as 8 characters of ascii. so a value of 1 will read as 00000001. writing is the same. you MUST write 8 characters or it wont write it,so a 1 is 00000001 and B0000 is 000B0000. all bytes are hex, not decimal.
binary: when you read, the app will return 20 bytes, regardless of how long the binary is. if the whole binary sequence is 11 22 33, it will read as 112233 and then 17 00s. the reason for this is that there isnt a method to know how long the binary sequence is,so i hardcoded it to read 20. even if its longer than 20 bytes, you will only get 20 bytes back. i can up the limit at a later time if its something people need.
writing binary is also limited to a max of 20 bytes. if you are writing less than 20 bytes though, dont put the extra zeroes. if you are writing 4 bytes such as 11 22 33 44, then simply write it like this 11223344(no spaces) then hit write.
DO THESE REGISTRY CHANGES PERSIST AFTER A HARD/FACTORY RESET?
no. if you hard reset, you will revert back to the stock rom and any changes you made to the registry will be lost. you will have to make the changes again after a hard reset. file system changes, especially in the windows folder can persist though.
[/HIDE]
Work with me very fine.
THANKS
Is there a way to sideload marketplace apps such as tetra lock screen 1.2.0.0 ? I loved that app.
---------- Post added at 08:11 PM ---------- Previous post was at 08:10 PM ----------
And thanks for bringing us another option. It brings our community closer together
followed your steps. thank you. not sure how to do this though:
"Once completed, you can remove the app and put extras+info back". How to remove it....
never mind. renamed apps folder on SDCard to appx, deleted the app, renamed the folder back to apps, rebooted, changed time to 2115 and was able to uninstall and reinstall.
cheers
derausgewanderte said:
followed your steps. thank you. not sure how to do this though:
"Once completed, you can remove the app and put extras+info back". How to remove it....
never mind. renamed apps folder on SDCard to appx, deleted the app folder, renamed the folder back to apps, rebooted, changed time to 2115 and was able to uninstall and reinstall.
cheers
Click to expand...
Click to collapse
updated the first post with a dead easy method I use
Ok did everything from the package you PM'ed me and ya phn is now interop unlocked.. Changed the MaxUnsignedApp to 170(thats enough for me) I didn't have time to check the homebrew apps I'll try them later. Thnx for this
Pretty Awesome Bro !!!
So what i was looking for... Good job mate.
NTDK Server is a great more than Samsung RPCComponent.
I hope that you can expand it to the more API's.
Like File System API and much more.
Other people's. Please do not spam such thread with your questions. Leave it completely for development related.
Your Q/A goes Here.
@vcfan
So this is similart to what root access on android phone? What is the main advantage if we do this, what do we gain? For me on android the bes thing was customization of the look, and the possibility to block ads in free applications . The ads in windows phone aplications are really annoying when the pop up through whole screen, it would be great if there was a way to block them with host file or something, like in android.
I wonder if we can add an extra quick action. I tried editing the "AllowedQuickSettingsElements" registry but it reverts back to 4 as soon as I pull down the action bar.
MultiPDev said:
I wonder if we can add an extra quick action. I tried editing the "AllowedQuickSettingsElements" registry but it reverts back to 4 as soon as I pull down the action bar.
Click to expand...
Click to collapse
Same happens with my 630 .
Will this work on W10 TP?
As im trying to ,the system wont grant WPCustomSystem access to change the name of the "Apps" folder so that the data can be patched
surya467 said:
Will this work on W10 TP?
As im trying to ,the system wont grant WPCustomSystem access to change the name of the "Apps" folder so that the data can be patched
Click to expand...
Click to collapse
No it doesn't work with wp10 tp . You should get unlocked before going for 10 tp.
irshad2809 said:
No it doesn't work with wp10 tp . You should get unlocked before going for 10 tp.
Click to expand...
Click to collapse
I did it, but i cant deploy some apps, maybe something went wrong, thanks
surya467 said:
I did it, but i cant deploy some apps, maybe something went wrong, thanks
Click to expand...
Click to collapse
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?
Has anyone tried to replace black background under All apps (the list of all apps) with some custom wallpaper?
Can anyone with a Lumia 830 confirm this is working?
irshad2809 said:
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?
Click to expand...
Click to collapse
What I did was,
I had Windows Phone 8.1 Update 2 installed with developer unlock
I unlocked the phone with Interop Unlock but did not hard reset
Then i updated WP 8.1 to Win 10 TP and then i hard reset
it seems the unlock worked.
I can deploy ,
App data manager which WORKS
CustomWPsystem which works but cannot patch because Win10 TP doesnt allow permissions to WPSystem folder
I deployed vcREG: Lumia Reg Editor too
but since i hard reset developer unlock should be removed, so im guessing its interop unlock
The only issue is i cannt deploy io explorer, wphtweaks and accept colors app
Is this only bcuz of power tools ? IDK because i have VS 2013 on home PC and it still gives manifest file error.
---------- Post added at 11:13 AM ---------- Previous post was at 11:11 AM ----------
irshad2809 said:
As I know I wasn't able to change names or access wpsystem folder with file managers other than official one . How did you do that?
Click to expand...
Click to collapse
XDRdaniel said:
Can anyone with a Lumia 830 confirm this is working?
Click to expand...
Click to collapse
Yes ofcourse it is
https://onedrive.live.com/redir?res...08447&authkey=!AAkZG-uRpRAzdbM&ithint=folder,
take the data.bin file from here, depends on your RM though
surya467 said:
What I did was,
I had Windows Phone 8.1 Update 2 installed with developer unlock
I unlocked the phone with Interop Unlock but did not hard reset
Then i updated WP 8.1 to Win 10 TP and then i hard reset
it seems the unlock worked.
I can deploy ,
App data manager which WORKS
CustomWPsystem which works but cannot patch because Win10 TP doesnt allow permissions to WPSystem folder
I deployed vcREG: Lumia Reg Editor too
but since i hard reset developer unlock should be removed, so im guessing its interop unlock
The only issue is i cannt deploy io explorer, wphtweaks and accept colors app
Is this only bcuz of power tools ? IDK because i have VS 2013 on home PC and it still gives manifest file error.
---------- Post added at 11:13 AM ---------- Previous post was at 11:11 AM ----------
Yes ofcourse it is
https://onedrive.live.com/redir?res...08447&authkey=!AAkZG-uRpRAzdbM&ithint=folder,
take the data.bin file from here, depends on your RM though
Click to expand...
Click to collapse
Nope, the same. Crash right after i press "Aply XAP" :'(
XDRdaniel said:
Nope, the same. Crash right after i press "Aply XAP" :'(
Click to expand...
Click to collapse
its not an unlock issue, your not able to patch the app, that is an sd card issue
I think u can do it manually or format SD card and try again
thanks for the app but I can't write any reg key? i wonder if it did not send me the confirmation notification or it just can't?
So atlast I permanent interop unlocked my lumia 525 and still able to install windows 10 update
Thanks to
@vcfan for the tip that we can add interop unlock files in any .reg files in windows\packages\registryfiles folder and also for his live interop unlcker..... (BTW after modifying my software.reg and interop unlocking my phone I am still able to install windows 10)
@WojtasXda for the additional_entries.reg file whick I used to unlock my phone
.And others....
BTW @vcfan I've attached my software.reg file which I used to interop unlock my phone can you add the additional capabilities unlock that you unlocked by your app other than those unlocked by WojtasXda
OTHERS DON'T USE THIS BECAUSE THIS NOT A TUTORIAL OF PURMANENT INTEROP UNLOCKING LUMIA 525 OR ANY OTHER PHONES
IF YOU USE THIS THEN I'M NOT RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR PHONE
Hi there, great discovery, I am also a user that has one of the phones that have the OEMSettings.reg file read-only and I have been trying to add the lines to lots of reg files and always got a on herd reset so would like to ask if you did a hard reset after editing the software.reg file (you probably did) and if it worked right, and if you are sure you kept your interop unlock after the reset?
Ranomez said:
Hi there, great discovery, I am also a user that has one of the phones that have the OEMSettings.reg file read-only and I have been trying to add the lines to lots of reg files and always got a on herd reset so would like to ask if you did a hard reset after editing the software.reg file (you probably did) and if it worked right, and if you are sure you kept your interop unlock after the reset?
Click to expand...
Click to collapse
Thnx dude and ya same thing happened to me 5 days ago when I tried to modify the language.reg files and failed but today when I used the software.reg file it worked
@souma_rox , im happy you got it working. sorry, I've been busy with another project so I didn't have enough time to try all the different files and see which one is the optimal one to use, but im glad you've found it.
im attaching a text file with all the reg entries to unlock all the capabilities that are programmed in a stock wp 8.1 rom. also included are some other tweaks such as full fs access.
vcfan said:
@souma_rox , im happy you got it working. sorry, I've been busy with another project so I didn't have enough time to try all the different files and see which one is the optimal one to use, but im glad you've found it.
im attaching a text file with all the reg entries to unlock all the capabilities that are programmed in a stock wp 8.1 rom. also included are some other tweaks such as full fs access.
Click to expand...
Click to collapse
so if i just paste all of these lines at the end of software.reg file like the additional_entries.reg file of wojtas it will work right?????
souma_rox said:
so if i just paste all of these lines at the end of software.reg file like the additional_entries.reg file of wojtas it will work right?????
Click to expand...
Click to collapse
it should as these are the exact entries my app appends to the end of OEMSettings.reg for the permanent unlock, and that works.
will this work on a 520 from at&t?
@vcfan it seems the lines you provided prevent the phone from getting updated to windows 10 mobile, the phone always getting stuck in the update and requiring a re-flash of the ROM,, on the other hand the lines @WojtasXda provides for his ROM Rebuilder seem to work just fine, do you happen to know what lines might cause that?
Also sorry for posting so late but I didn't want to post before testing everything (slow and fast ring) and also trying to remove the full mtp access lines from your file, it seems to not be related to that.
I updated to wm10 after vcfan permanent interopunlock.... 3 times I used vcREG templates.
augustinionut said:
I updated to wp10 after vcfan permanent interopunlock.... 3 times I used vcREG templates.
Click to expand...
Click to collapse
So the file "C:\Windows\Packages\RegistryFiles\OEMSettings.reg" is kept as is when updating the phone? From 8.0 to 8.1, too?
I think so...
The files run in LUmia 520
??
thanks..
i just replace the reg file of my stock rom with this reg file..but nothing happened..
Riyad_ said:
i just replace the reg file of my stock rom with this reg file..but nothing happened..
Click to expand...
Click to collapse
I think that only works with live unlock.
Rivo17 said:
I think that only works with live unlock.
Click to expand...
Click to collapse
No bro...i just interop unlocked my phone again..though i tried so many times..finally i got this..all i have to do is just unlock bootloader of my phone with sbl3 partition.then in mass storage mode i get software.reg file from that then i modified the file with capabilities.then put the file again in my mass storage then resetted my phone and it works ... i will write a tutorial on this. soon..
Edited - Added A new procedure and no more reset anymore.
:good::good::good::good::good::good::good::good:
people who have audio problem after "root unlock" can use this trick temporary.in this trick there is no issue in audio..and i think the audio fix option will come soon.
ok here is The latest trick for interop unloking listed lumia devices.i will write the post shortly.the 60% work will do the wpinternal app.so u have to read the post.
Device supported:
Lumia 520,521,525,620,625,810,820,822,920,925,1020,720 (Other devices is not suported in WPINternals that's why those devices owner have to wait).
**1st a big thanks to "Heathcliff74" for his awesome tool.and 2nd Big thanks to "AndroidXsK" for the SBL3 partitions.
ok here is the procedure.
1st follow this link to unlock ur bootloader.The wpinternals app has all Answers of ur questions.
http://forum.xda-developers.com/windows-phone-8/development/windows-phone-internals-unlock-t3257483
1st download the tool and read the getting started section carefully. (don't do anything just read).
2nd download the SBL3 Partion files from this link. --- http://forum.xda-developers.com/showpost.php?p=64100811&postcount=267
now with the Wpinternals app unlock ur bootloader with the supported SBL3 partitions.
here u have to choose exact partition which match with ur phone..
well if u have a same cpu which matches with sbl3 partion supported phone u can use that for ur phone also..suppose u r using lumia 521/525 but there is no sbl3 partition for those phone then u can use 520 sbl3 partition .bcz 520 has the same processor.i think u understood.
after unlocking bootloader ur phone will reboot to normal mode..keep connected ur phone with pc by USB ..now from the wpinternal app go to manual mode and select "mass storage mode" in the app.the phone will boot again and will go black(unresponsive) ..don't worry.then u will find a new mounted drive partition in ur pc.it's ur phone mainos partition.
go to that drive and u will se some folders .if u don't know pls don't play with those folders.just go to (windows>packages>registry files) folders..u will find many reg files just copy the "Software.reg" file in ur desktop.we will work with that file.
now open 7zip file manager (don't have just download or install)
select the software reg file from desktop.
after clciking on software reg u will see a file named software without any extension.
right click on the file and click "edit".
now a notepad tab will open with many lines..
now add these quoted(add without quotes) lines from the attachment at the end of the software file lines.
View attachment 3566593
now save the file by pressing "Ctrl+S"
now a msg box will appear on 7z file manager just click yes...
after that put/replace the modified software.reg files in the (new mounted drive>windows>packages>registry files) folder.
now soft reset ur phone by clicking "volume down+power button" for 10 second.
then the phone will boot up normally..now u have to must give a hard reset ur phone to get the new capabilities unlocked...
2nd Procedure(No reset anymore) :
Thanks to @_wook_
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
attachment Link - forum.xda-developers.com/attachment.php?attachmentid=3563171&d=1449110333
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...
N.B.-
somethings u must be remembered that the unlock will be parmanent.and i will not responsible for any kind of harm in ur phone.and devices which (like 720) doesn't have sbl3 partitions,u can also unlock ur device by dumping ur phone partition.for this u have to read WPinternals getting started section.
******Sorry for my bad english**************
audio working?
reksden said:
audio working?
Click to expand...
Click to collapse
Yes..thats why i said temporary solution..
Riyad_ said:
Yes..thats why i said temporary solution..
Click to expand...
Click to collapse
okay, but i have lumia 720(((
The version of 7z that you use ?
reksden said:
okay, but i have lumia 720(((
Click to expand...
Click to collapse
No rpoblem..u can try this by dumping ur phone mainos partition.check wpinternals.net
titi66200 said:
The version of 7z that you use ?
Click to expand...
Click to collapse
version 9.34..also works with version 9.20
Thanks
Riyad_ said:
No rpoblem..u can try this by dumping ur phone mainos partition.check wpinternals.net
Click to expand...
Click to collapse
okay, this instruction is older, i get interop unlock with oem setting and system and other reg(huawei w1 with 8.0 05420). but i flashed dump with interop unlock.
Why not writing reg values directly here ?
"C:\Windows\System32\Config"
Thank you so much Riyad_,
this a great notice and I will use now the toturial in my lumia 520
Riyad_ said:
:good::good::good::good::good::good::good::good:
people who have audio problem after "root unlock" can use this trick temporary.in this trick there is no issue in audio..and i think the audio fix option will come soon.
ok here is The latest trick for interop unloking listed lumia devices.i will write the post shortly.the 60% work will do the wpinternal app.so u have to read the post.
Device supported:
Lumia 520,521,525,620,625,810,820,822,920,925,1020,720 (Other devices is not suported in WPINternals that's why those devices owner have to wait).
**1st a big thanks to "Heathcliff74" for his awesome tool.and 2nd Big thanks to "AndroidXsK" for the SBL3 partitions.
ok here is the procedure.
1st follow this link to unlock ur bootloader.The wpinternals app has all Answers of ur questions.
http://forum.xda-developers.com/windows-phone-8/development/windows-phone-internals-unlock-t3257483
1st download the tool and read the getting started section carefully. (don't do anything just read).
2nd download the SBL3 Partion files from this link. --- http://forum.xda-developers.com/showpost.php?p=64100811&postcount=267
now with the Wpinternals app unlock ur bootloader with the supported SBL3 partitions.
here u have to choose exact partition which match with ur phone..
well if u have a same cpu which matches with sbl3 partion supported phone u can use that for ur phone also..suppose u r using lumia 521/525 but there is no sbl3 partition for those phone then u can use 520 sbl3 partition .bcz 520 has the same processor.i think u understood.
after unlocking bootloader ur phone will reboot to normal mode..keep connected ur phone with pc by USB ..now from the wpinternal app go to manual mode and select "mass storage mode" in the app.the phone will boot again and will go black(unresponsive) ..don't worry.then u will find a new mounted drive partition in ur pc.it's ur phone mainos partition.
go to that drive and u will se some folders .if u don't know pls don't play with those folders.just go to (windows>packages>registry files) folders..u will find many reg files just copy the "Software.reg" file in ur desktop.we will work with that file.
now open 7zip file manager (don't have just download or install)
select the software reg file from desktop.
after clciking on software reg u will see a file named software without any extension.
right click on the file and click "edit".
now a notepad tab will open with many lines..
now add these quoted(add without quotes) lines from the attachment at the end of the software file lines.
View attachment 3562770
now save the file by pressing "Ctrl+S"
now a msg box will appear on 7z file manager just click yes...
after that put/replace the modified software.reg files in the (new mounted drive>windows>packages>registry files) folder.
now soft reset ur phone by clicking "volume down+power button" for 10 second.
then the phone will boot up normally..now u have to must give a hard reset ur phone to get the new capabilities unlocked...
N.B.-
somethings u must be remembered that the unlock will be parmanent.and i will not responsible for any kind of harm in ur phone.and devices which (like 720) doesn't have sbl3 partitions,u can also unlock ur device by dumping ur phone partition.for this u have to read WPinternals getting started section.
******Sorry for my bad english**************
Click to expand...
Click to collapse
I get the black screen with sad face reboot loop.
into the ffu ? How ?
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...
_wook_ said:
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
Click to expand...
Click to collapse
Have you tested this?.
Rivo17 said:
Have you tested this?.
Click to expand...
Click to collapse
Of course, but, i recommend you to try first post. As I wrote, I have a crazy phone...
In that case, you must better edit your post for avoid confusion. Just saying.
_wook_ said:
There's easier way, no need fot 7zip at all
Just switch device to the mass storage mode, go to [MainOS mount point]:\windows\system32\config\ and copy SOFTWARE to some location on PC, then make duplicate just in case you mess up with some registry entry.
Open RegEdit.exe and click on HKLM > File> Load Hive and select file you copied from your MainOS partition drive, then type in the name - anything like lumiaSofware...
Edit what you want (probably capabilities... or something) and unload hive by selecting the lumiaSoftware > File > Unload Hive.
Close RegEdit (no need for it anymore); copy your SOFTWARE file to the place where you got it from (There will be more files, with LOG or similar extension, disregard them). Eject device and hold down power button for 10 seconds (or at least until it vibrates) and voila, you edited your registry with success.
Important notes:
You can mess up your System, but probably you will be able to repair it by re-flashing ffu again - not tested.
Maybe I skipped some step in tutorial and you will be confused what to do next, so, just in case you don't have clue what I am talking about, then this is no good tutorial for you, no good at all!
In case Explorer.exe tells you that you don't have permission to access to [MainOS MP]:\windows\system32\config just press enter (it will be ok I think). Maybe this will cause an issue for some path, or for some devices, not causing any issue to me.
I have crazy phone and a lot of things works on it...
I am using Win10 and Win 10 Mobile.
In case you don't know who is the guy named Explorer.exe forget everything you read in this post and go to some place else.
Best regards and be safe
//edit:
Uploaded attachment for detailed instructions.
Remember, this works on my device, there might be some issues with it I don't know and I haven't found any so far. Maybe it will brick your phone, mine is working good so far...
Zip file contains screenshots with steps from 0001 to 0031.
And, please, If i had nerve to write entire post, have nerve to read it too...
Click to expand...
Click to collapse
Loading hive and searching for capabilities i think it's more complicated...just adding some line is much more easier .but ur tut is good too.
djamol said:
Why not writing reg values directly here ?
"C:\Windows\System32\Config"
Click to expand...
Click to collapse
i was confused about it that's why i used software.reg. ..
Rivo17 said:
I get the black screen with sad face reboot loop.
Click to expand...
Click to collapse
i also got this 1st time. try again resetting or flash the ffu again.
Hi,
I've been able to use vcREG 1.5 on a 950XL to execute any exe file via services.exe, except it's getting stopped by Code Integrity. That's also why putting older NdtkSvc.dll doesn't work on the newer phone (aside from the fact that it has to be in c:\windows). I thought oh maybe any valid arm executable signed by microsoft would be enough, so I copied some executables from the Raspberry Pi Windows 10 IoT image, but I could only get them to run inside the app sandbox because they weren't in the system catalog :'(
Example:
21-March-2016 15:04:08.339601 0x000003D4 0x00000F88 Verbose Microsoft-Windows-CodeIntegrity Code Integrity completed validating file hash. Status 0xC0000428.
21-March-2016 15:04:08.339631 0x000003D4 0x00000F88 Error Microsoft-Windows-CodeIntegrity Code Integrity determined that a process (\Device\HarddiskVolume37\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume39\WPSystem\ftpd.exe that did not meet the Windows signing level requirements.
So now the trick is to find an executable on the system that currently exists, that can be used to gain further access... I've been trying various things like OOBE stuff etc without any luck so far.
Hoping someone else has some ideas... maybe even executing a dll function to import registry from a file or something directly, then we could unlock interop on 950's..
Thanks
Great work
maybe you can MTP your 950/950xl and look for the files in the \windows folder
micheal
Can you tell me how to execute a exe via services.exe ? Thanks?
naiple said:
Can you tell me how to execute a exe via services.exe ? Thanks?
Click to expand...
Click to collapse
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.
megasounds said:
Great work
maybe you can MTP your 950/950xl and look for the files in the \windows folder
micheal
Click to expand...
Click to collapse
Actually using MTP isn't the best thing for that, because you are missing out on more than half of the available executable files as they are not viewable via MTP on 950/XL due to permissions. It's best to mount the FFU image and look around that way.
I have already looked and tested most of them, thus why I was asking if anyone else had some ideas.
darkfires said:
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.
Click to expand...
Click to collapse
Thanks! I will try it on my lumia
darkfires said:
use vcREG1.5 to edit HKLM\SYSTEM\ControlSet001\Services\NlpmService\ImagePath
Change it to whatever executable you want, reboot and it will run as LOCAL SYSTEM, provided that it is signed correctly.
NOTE: Changing this will stop your Glance screen from working, so take note of the original value and restore it after you are done if you use glance.
Click to expand...
Click to collapse
I can't find NlpmService because my lumia730 don't have a Glance screen ... is there any way else to run a exe?
naiple said:
I can't find NlpmService because my lumia730 don't have a Glance screen ... is there any way else to run a exe?
Click to expand...
Click to collapse
I only decompiled the NdtkSvc on 950XL, the one on 730 might be different. But to answer your question there is only one other way, and it will kill USB so you won't be able to connect to it via PC at all until you reverse the change. If you post your NdtkSvc.dll I can check it for you.
HKLM\SYSTEM\ControlSet001\Services\NokDeviceHubSvc\ImagePath
darkfires said:
I only decompiled the NdtkSvc on 950XL, the one on 730 might be different. But to answer your question there is only one other way, and it will kill USB so you won't be able to connect to it via PC at all until you reverse the change. If you post your NdtkSvc.dll I can check it for you.
HKLM\SYSTEM\ControlSet001\Services\NokDeviceHubSvc\ImagePath
Click to expand...
Click to collapse
Ahh, i find the Nlpmservice. Don't know why i cant find it yesterday... And if you need any thing(unlocked bootloader, uefi...) from 730 or 540 i can post it, both are prototype and can enter massStorage. Hope i can help you. Thank you for the answer
naiple said:
Ahh, i find the Nlpmservice. Don't know why i cant find it yesterday... And if you need any thing(unlocked bootloader, uefi...) from 730 or 540 i can post it, both are prototype and can enter massStorage. Hope i can help you. Thank you for the answer
Click to expand...
Click to collapse
I'm trying to do something different and I found this topic so if you still have these devices can you extract NlpmService.dll file from System32 and upload it here for me?