Develop Bugs

OEM SDK

I've gone to a couple WP7 training courses and whenever the developers ask about having access to parts of the OS and things of that nature, the microsoft rep mentions theres a OEM SDK. That SDK is unavailble to normal developers and only available to OEMs. If any very resourceful xda members got ahold of that SDK and leaked it, we would see some very interesting apps! It would be a great start to a jailbroken/rooted app store or something of that nature. Just offer all the great apps that wouldn't normally get approved by MSFT. ie wifi tethering, emulators....

Unless you can magically make sideloading happen, this will not work.

Skatingn330 said:
[...] It would be a great start to a jailbroken/rooted app store or something of that nature. Just offer all the great apps that wouldn't normally get approved by MSFT. ie wifi tethering, emulators....
Click to expand...
Click to collapse
I think that the OP is counting on some kind of "jailbreak" will solve that problem
(and so am I)

Actually if you have your phone registered as a dev phone, you kind of have a jailbroken one. Because you have the freedom to put any xap on you want.

It's just going to be the standard WindowsCE dev environment, right? All the WinCE libraries are on the phone, anyway. If you have Visual Studio, I think you can download the WindowsCE version from Microsoft, at least the trial version. Look around, you'll find it.

There's still a limit on the number of apps you can load. I believe it's 10 apps.
Skatingn330 said:
Actually if you have your phone registered as a dev phone, you kind of have a jailbroken one. Because you have the freedom to put any xap on you want.
Click to expand...
Click to collapse

Iridox said:
Unless you can magically make sideloading happen, this will not work.
Click to expand...
Click to collapse
Wait, but it will still require you to stay in the silverlight/XNA jailbox, right?

Remove limit of 10 unsigned app

I've finally reach 10 unsigned app on my phone. Took way longer that I thought...
This is not new for anyone who's not spending time asking for unlock key, but I've made a small app to automate the process of pushing the limit to 100000.
Here it is: http://bit.ly/qpVyR4
Work on my HTC, may work on other device as well (let me know).
Warning: At least one person had problem deploying app on his Samsung after running this app.
Edit: Updated version with rollback button (which already exists but was hidden )

this has been out for like a month now..... but good job of creating one!
http://forum.xda-developers.com/showthread.php?t=875885

Exactly what I said... nothing new but packaged as a XAP

Advanced Configuration Tool for WP7 Beta
http://forum.touchxperience.com/viewtopic.php?f=11&t=590&p=2349
has an option to remove the limit, plus set as many colour schemes as you like, and add single registry keys directly.
Its still beta but works a treat so far on my HD2, and comes with about 50 colours for the theme, or input your own with hex codes.

This tools works only on HTC. Minne should work on Samsung too, maybe on LG.
But if you have an HTC, AdvConfig is probably easier to use.
I'm not spending much time making pretty app

I ran this earlier (along with setting the key manually before), and it doesn't work. I still was limited to 10 apps.
But now, frighteningly, I'm unable to deploy -some- apps from Visual Studio (limit reached). I have a real dev unlock, never messed with Chevron.

Thanks, (nico)! I've removed this (stupid!) limit on my Focus (officially unlocked), everything works fine including deployment/debug from VS 2010. Good job!

davux said:
I ran this earlier (along with setting the key manually before), and it doesn't work. I still was limited to 10 apps.
But now, frighteningly, I'm unable to deploy -some- apps from Visual Studio (limit reached). I have a real dev unlock, never messed with Chevron.
Click to expand...
Click to collapse
I'm also officially unlock.
Like with folks with Chevron, I think the limit will be reseted periodically by Zune.
What do you mean by "some" apps?

You can't install more than 10 apps?

Not sure what do you mean, but I'll try to answer.
Using (official) unlock method, you won't be able to deploy more than 10 unsigned apps. 3 if you have a student account.
Chevron also have the same 10 limit (because they intentionally keep MS limit).
This registry tweak try to remove that limit.
In either way, this don't modify the number of app you can install though Marketplace, which is not limited.

(nico) said:
I'm also officially unlock.
Like with folks with Chevron, I think the limit will be reseted periodically by Zune.
What do you mean by "some" apps?
Click to expand...
Click to collapse
I set the key manually in the code Rusty released for the Samsung devices the other day. I wasn't able to deploy the 11th app via VS. I continued dealing with it until I got your XAP, I ran that yesterday and now sometimes I have trouble deploying in VS, even with <10 apps. Restarting VS and the phone doesn't have any effect.
Not that I'm blaming you or anything - just figured I'd note my experience. Some projects will still deploy, not sure of the pattern yet.

Thanks, that the kind of feedback I'm looking for. I'll add this to the first post to warn people.
If you have more infos, please share so we can have something more stable.

Thanks!
* Works on [Europe] Omnia 7

Ah this is the tool that some XDA user was trying to pass off as his own tool.

The big Athiest said:
Ah this is the tool that some XDA user was trying to pass off as his own tool.
Click to expand...
Click to collapse
What are you talking about?

(nico) said:
What are you talking about?
Click to expand...
Click to collapse
Look up the RRTool in this forum that I wrote, he is basically saying I rebranded the Chevron Tool as my own, even though my Tool runs on the device not from desktop and only prevents relocking, it doesnt actually unlock a device like chevron does. He only has 2 posts and tried to ruin my credability! Not Happy!

He is a lame troll. Don't pay attention. Thank you both guys! Great job!
P.S. Just a small remark: after using your tools (first I've tried (nico)'s tool, later (toady) RRTool. Both works good but behavior of VS 2010 a little bit changed. Now I can't deploy project via Zune - must close it first and use WPConnect.

Did you try to restore the original value (probably 10 for most users) and see what happends?

Nope, I didn't. Just have no time to browse for Samsung's registry editor or reflect back your's or lyriquidperfection app. Could you add an option to restore back an original values? Anyway, it's not a real problem. MS limitation of 10 app (or 3 for student account) it's just stupid and unfair. What, if I have more than 10(3) homebrew projects to debug and run? What, if I want to recreate all apps I need by myself? But of course the "MS greediness sux!" is not a topic for this thread

sensboston said:
Nope, I didn't. Just have no time to browse for Samsung's registry editor or reflect back your's or lyriquidperfection app. Could you add an option to restore back an original values? Anyway, it's not a real problem. MS limitation of 10 app (or 3 for student account) it's just stupid and unfair. What, if I have more than 10(3) homebrew projects to debug and run? What, if I want to recreate all apps I need by myself? But of course the "MS greediness sux!" is not a topic for this thread
Click to expand...
Click to collapse
Sorry I thought I did it but the button was hidden
Here is an updated version with a restore button to 10 apps: http://bit.ly/gKZDgj

[Q] REAL hacking.

Hello there to all the souls of the xda forums.
im new to wp7. never used one before like 3 days ago. i like it, great device my surround is. but im not here to tell you about how good it is. we all know its good.
im here to ask if theres any real hacking going on with this thing yet. im looking for at least some kind of command line.
from there i could use tools such as aircrack, nmap, metasploit, SET, etc.
ive had an iphone for about 3 years, booting iOS and Android. i am used to hacking from that, but at the same time i know there a bigger user base for those devices, so theres more devs for it. i just wanted to know if anyone has already started on such a project before i dedicate alot of my time to developing this for you all.
BTW i am not interested in pirating apps, cracking apps

With enough effort, command-line interface *might* be possible - the OS technically supports such things - but the underlying core is Windows CE. Even less so than NT, CE really isn't meant for a CLI; apps are written with the intent of being run on a graphical interface. Also, having no POSIX compatibility and only partial Win32 compatibility, a lot of apps that you're used to from the desktop (or from POSIX-based phone OSs like iOS and Android) aren't going to be available.
That said, if you want to get started in the WP7 hacking space, there's certainly plenty to do. One project that I have on the back burner until I get some more urgent stuff out of the way is a SSH client. There are a number of things that are required here. First of all, we have homebrew Socket support, but the official SDK lacks it so you'd need to use a native Homebrew DLL. Second, there's no official command line interface, so you'd need to write one. The second point is all sorts of fun, since what you're really writing is a terminal emulator.
Other interesting projects include getting a unified cross-platform approach to writing to the filesystem, or even reading from all of it (instead of the relatively small portions currently accessible) or figuring out how to make third-party apps run in the background.

thanks man. I think I'll work on getting a full file browser for the phone. That should happen , i think, before anything else. As far as a terminal emu, it sounds like its going to be more of a chalange for me. Again, I'm used to more Linux and UNIX systems than I am windows. I had to reinstall windows 7 onto a partition just so I could sync the phone with the Zune software Microsoft insisted I use.
So is anyone currently working on the file browser? Has there been any progress with it? If so, who should I contact so I can help?

sea_bass said:
thanks man. I think I'll work on getting a full file browser for the phone. That should happen , i think, before anything else. As far as a terminal emu, it sounds like its going to be more of a chalange for me. Again, I'm used to more Linux and UNIX systems than I am windows. I had to reinstall windows 7 onto a partition just so I could sync the phone with the Zune software Microsoft insisted I use.
So is anyone currently working on the file browser? Has there been any progress with it? If so, who should I contact so I can help?
Click to expand...
Click to collapse
TouchXplorer. Do a bit of searching. A lot of homebrew has already been in the works.

thesecondsfade said:
TouchXplorer. Do a bit of searching. A lot of homebrew has already been in the works.
Click to expand...
Click to collapse
Thanks. Just found that page

idea how to hack zune to make install wp7 apps

Hi all,
I was wondering if it's possible to inject into zune app and make it install another app instead of the one you choose using zune.
Using fillder, I briefly tried to look what requests are made by zune but I could not see anything which looks like downloading the app.

Just sideload its a whole lot easier and I don't think something like that exists otherwise it would be on Android and iPhone.
Sent from my GT-I5800 using XDA App

andreiuc said:
I was wondering if it's possible to inject into zune app and make it install another app instead of the one you choose using zune.
Click to expand...
Click to collapse
Hmm, I can say - interesting idea! But I am afraid it's a very difficult to implement. You need to emulate whole MS store server...

I think all requests go via secure connection and checked by trusted certificates on device.
same with dev unlock.

Cotulla said:
I think all requests go via secure connection and checked by trusted certificates on device.
same with dev unlock.
Click to expand...
Click to collapse
Not at all, some requests are non-secure. I'm able (with WireShark) to catch xap requests, store/app info etc. Actually, we have a lot of marketplace replacements (even I have my own implementation ).

sensboston said:
Not at all, some requests are non-secure. I'm able (with WireShark) to catch xap requests, store/app info etc. Actually, we have a lot of marketplace replacements (even I have my own implementation ).
Click to expand...
Click to collapse
I tried with Fiddler to catch xap requests but I was not able to see any.
My idea is to to write an app which injects code in Zune to hijack calls to download a XAP from zune and download from my location instead(or get it from local disk).

it's good to hear this. but marketplace XAP files are signed and it also makes a problem. unsigned will not work. (it's not deploy, it's installation!)

Cotulla said:
it's good to hear this. but marketplace XAP files are signed and it also makes a problem. unsigned will not work. (it's not deploy, it's installation!)
Click to expand...
Click to collapse
Right. They are signed with developer key.
Not sure if WP7 OS checks this and how would it know if it's the real app?
I mean, I can sign my own XAP which I make Zune to get it and deliver it to WP7.

andreiuc said:
Right. They are signed with developer key.
Not sure if WP7 OS checks this and how would it know if it's the real app?
I mean, I can sign my own XAP which I make Zune to get it and deliver it to WP7.
Click to expand...
Click to collapse
Looking to the requests responses when you select to install an app, I was able to see this response XML:
Code:
<a:entry>
<a:updated>2011-09-08T18:03:25.3198784Z</a:updated>
<a:title type="text">3D Paperball 1.3.0.0</a:title>
<a:id>urn:uuid:1ea47c77-79c1-4c5a-b441-549b4e93dcea</a:id>
<version>1.3.0.0</version>
<url>http://apps.marketplace.windowsphone.com/E0C15284-972B-41D3-B245-8C16AAF73A66/CurrentBinary.xap</url>
<packageSize>9235456</packageSize>
<installSize>19616768</installSize>
<clientTypes>
<clientType>WinMobile 7.0</clientType>
<clientType>WinMobile 7.1</clientType>
</clientTypes>
<supportedLanguages>
<supportedLanguage>English</supportedLanguage>
</supportedLanguages>
<deviceCapabilities><capability><id>ID_CAP_NETWORKING</id><string>data services</string><disclosure>Disclose</disclosure></capability><capability><id>ID_CAP_SENSORS</id><string>movement and directional sensor</string><disclosure>Disclose</disclosure></capability><capability><id>ID_CAP_IDENTITY_USER</id><string>owner identity</string><disclosure>Disclose</disclosure></capability><capability><id>ID_CAP_IDENTITY_DEVICE</id><string>phone identity</string><disclosure>Disclose</disclosure></capability></deviceCapabilities>
<averageLastInstanceUserRating>0</averageLastInstanceUserRating>
<lastInstanceUserRatingCount>0</lastInstanceUserRatingCount>
</a:entry>
<a:author>
<a:name>Microsoft Corporation</a:name>
</a:author>
As you can see, the XAP URL is right there.
However, with Fiddler, I am not able to see any requests to this URL.
Maybe someone can share some info using more advanced tools like WireShark.

LOL, my hunch is it's actually the WP7 OS which is doing the download of the file

yeah. but it seems signed with own MS certificate ?
so developers push app to MS and they verify and sign it? (I don't know much about market space publishing)

andreiuc said:
LOL, my hunch is it's actually the WP7 OS which is doing the download of the file
Click to expand...
Click to collapse
I believe you are right as it's been discovered already that it's pacmaninstaller.exe (I think that's the spelling) on device that prevents the sideloading of homebrew apps with INTEROPSERVICES.

andreiuc said:
However, with Fiddler, I am not able to see any requests to this URL.
Maybe someone can share some info using more advanced tools like WireShark.
Click to expand...
Click to collapse
Did you "reverse tether" your phone to PC? I believe, handset is responsible to download and install xap...
BTW, all these talks is about "warez" I don't see any other reasons to do that kind of hack (or may be, for research purposes only).
To get a "prove of concept", we need:
- download MS signed xap;
- using some kind of filtering proxy, replace request to http://apps.marketplace.windowsphone.com/{GUID}/CurrentBinary.xap to the local server;
If phone will be able to download and install that xap (what is impossible by using MS or third-party deployers), we'll get a solution or at least prove of solution

Cotulla said:
yeah. but it seems signed with own MS certificate ?
so developers push app to MS and they verify and sign it? (I don't know much about market space publishing)
Click to expand...
Click to collapse
Yep, "Ed Zachary" (c) Dave Barry, "Big Trouble"

The WindowBreak Project

"What am I doing, why am I here, what is this about, and where am I going with this."
Hello all. After dealing with rumors, rumors of rumors, and the like, I've finally managed to disclose something I hold very dear to me: the WindowBreak project.
As the name suggests, this is a jailbreak project for Windows Phone 7. I started something a while back that had little success, but through the months, I've managed to figure out something that should bring light into the Windows Phone jailbreaking scene.
Real quick, though:
What this is: A project, with information about some interesting exploits I found, and a call for the community to dive in.
What this isn't: A full fledged jailbreak. Please don't post replies such as "when will XXXX device be supported". It just wastes time, and I assure you, I want every device included.
It also is not a full unlock. Just interop.
The details
So here's the sitch. We all know how Heathcliff74's interop unlock works. XAP files are just ZIP files, and ZIP files can have entries that allow extracting in parent directories.
Interesting thing is, this can be done using the ZipView application, which normally stores data in \Application Data\Volatile\Zipview\<random id>
Thus, creating a directory in a ZIP file called ../../../../provxml will copy all those files into the \provxml\ folder upon extraction.
See what I did there?
Limitations
Of course, there are limitations.
1) We cannot extract into \Windows\. There's a policy that prevents it.
2) The bad one: We can only extract known MIME types, at least to my knowledge. This is because the files are only extracted when they are clicked on in ZipView. And clicking on a .dbz file, for example, will just say the file type is not supported. Bummer.
What we can do...
As mentioned above, this can be used for a fresh out of the box jailbreak for Samsung devices, using provxml. Here's a video of that:
Try it yourself: with a Samsung device, go to http://windowsphonehacker.com/windowbreak and press WindowBreak Me.
In theory, this would be all we need to jailbreak most Windows Phone devices. Unfortunately, Nokia and HTC devices block the registry entries in provisioning files. I'm not sure what the extent of this "whitelist" (or is it a blacklist?) is, and details/tests on this would be appreciated.
What needs to be done...
Nokia: I don't have a Nokia device, but I've been working a great deal on figuring out how to crack it's shell, and have a couple of ideas. If I'm able to get my hands on a Nokia device soon, I'll try some of these unorthodox exploits out, otherwise I'll need some daring volunteers.
HTC: I do have an HTC device, but I can't figure out how to extract the files for the Connection Setup program. If someone can give me details on what the password encryption is on it, etc, for the HTC interop unlock, that would be much appreciated.
Other devices: Not a lot of demand for these (and LG needs no jailbreak, since it has MFG), but if something comes up, feel free to share where the provisioning files exist and I'll see about "windowbreaking" them.
So this is my little project, and I hope the details I'm sharing will lead to further development. My personal device (Samsung Focus) is easily interop unlocked now, without costing me a cent. I'd really like this to be the case for everyone; I'm not saying the $9 unlock for Chevron Labs is bad, in fact, it's greatly supported homebrew. What I am saying, though, is that freedom is still possible, and regardless, any developments made here will further support interop unlocking on Chevron/apphub unlocked devices. With that in mind...
Merry Christmas.
Special thanks to: Heathcliff74 for much of the research and idea behind the exploit
All the supporting members of XDA, who bring appreciation for what we do. Thank you.

Cool! Ridiculous that I didn't think of this myself
I will send you the password of the dbz files when I get home. I don't have it here.
But the real problem for HTC and NOKIA are the whitelists. I've been working on this for the past time. And today I made more progress. I developed a new way of debugging native 3rd party dll's/drivers. U can isolate functions and call them from a test app for unit-testing. This makes testing a lot easier. This will help me find exploits much faster. I can even call the whitelist functions of HTC and NOKIA on my Samsung now Working on it right now.
Good find!!
Heathcliff74

Heathcliff74 said:
Cool! Ridiculous that I didn't think of this myself
I will send you the password of the dbz files when I get home. I don't have it here.
But the real problem for HTC and NOKIA are the whitelists. I've been working on this for the past time. And today I made more progress. I developed a new way of debugging native 3rd party dll's/drivers. U can isolate functions and call them from a test app for unit-testing. This makes testing a lot easier. This will help me find exploits much faster. I can even call the whitelist functions of HTC and NOKIA on my Samsung now Working on it right now.
Good find!!
Heathcliff74
Click to expand...
Click to collapse
Haha, I knew you would say that when you saw this. Most credit of this goes to your work, in fact, which gave me much of the idea.
As for the whitelists, do you know exactly how it's blocking? Is just registry blocked, or all non-APN related settings?

^-- This is why I nominated you guys for those free Nokia Lumias. Keep up the good work!

Jaxbot said:
Haha, I knew you would say that when you saw this. Most credit of this goes to your work, in fact, which gave me much of the idea.
As for the whitelists, do you know exactly how it's blocking? Is just registry blocked, or all non-APN related settings?
Click to expand...
Click to collapse
Both brands have very similar mechanisms. They both have a driver dedicated to provisioning. The whitelists are implemented in those drivers. HTC has whitelisted only specific registry keys for APN's and stuff. NOKIA does not have the registry on the whitelist at all.
Heathcliff74

Heathcliff74 said:
Both brands have very similar mechanisms. They both have a driver dedicated to provisioning. The whitelists are implemented in those drivers. HTC has whitelisted only specific registry keys for APN's and stuff. NOKIA does not have the registry on the whitelist at all.
Heathcliff74
Click to expand...
Click to collapse
Shame it's a whitelist instead of a blacklist :\
Do you know which CSPs are allowed? I've managed to move files around using provxml on my Samsung, but it seems to allow just about anything.

Yeah I want you two to get the free Nokia Lumia's too! You both do great work - thank you keep giving love to the Omnia 7 too please since it's my girlfriend who has the Lumia 800 (dammit!)

Indeed a very cool solution ! Thanks button pressed.
Is it limited to 1st gen samsung devices or does it work on 2nd gen devices too ?

contable said:
Indeed a very cool solution ! Thanks button pressed.
Is it limited to 1st gen samsung devices or does it work on 2nd gen devices too ?
Click to expand...
Click to collapse
Both first and 2nd gen will work, though some interop won't work on 2nd gen devices (e.g., last I heard, registry editors were all read only)

DBZ Password
030D681B-1DFC-4bd0-A72A-A9B3CCCDA653
---------- Post added at 10:30 AM ---------- Previous post was at 10:29 AM ----------
Oh and it was found here http://forum.xda-developers.com/showthread.php?p=18916888

When I go to http://windowsphonehacker.com/windowbreak/
I don't get any buttons, just these text :
WindowBreak
By WindowsPhoneHacker
WindowBreak is a project with the goal of enabling true jailbreaking on Windows Phones.
We believe in freedom, both in gratis and in libre.
For details on WindowBreak, see here [add XDA link here].
BTW Nice worrk, hope to see more nice hacks these Xmas!

DJSave said:
When I go to http://windowsphonehacker.com/windowbreak/
I don't get any buttons, just these text :
WindowBreak
By WindowsPhoneHacker
WindowBreak is a project with the goal of enabling true jailbreaking on Windows Phones.
We believe in freedom, both in gratis and in libre.
For details on WindowBreak, see here [add XDA link here].
BTW Nice worrk, hope to see more nice hacks these Xmas!
Click to expand...
Click to collapse
You visit it on your phone, silly
And thanks, forgot to add the XDA links to that page.

Damn, purchased yesterday chevron labs-.-
But great work! I appreciate that!

Jaxbot said:
You visit it on your phone, silly
And thanks, forgot to add the XDA links to that page.
Click to expand...
Click to collapse
Yep Had desctop version in settings
10X it worked like a charm

Wait and hope for a solution for HTC devices

yea I can't wait for this. I have a HTC HD7.

Well done man, exactly what worked also with calling provxml files from the iso storage in DiagProvXML. Just do "../the entire path to iso storage/provxml.ext" this worked also on htc. Although of course your mechanism is different as you have to copy it to the correct folders while we just needed to change the default paths of the drivers to a custom folder.
Well done and nice creative solution. It would be great if you manage to get this working for more devices.
Maybe somebody can somehow find the exact provisioning the Developer Registration Tool makes, so you can use that one as that should be white listed I assume.

The Registration tool actually uses a socket connection to send a partly modified cookie string to the phone. The phone then goes and checks that against microsoft's servers and goes OK.

hey ii was just wonderiing, as nobody rarely mentions the dell venue pro, if something was going to be actually done for it. I know you said dont post stuff liike this but its just that ive never heard something like this or anything done about the Dell Venue Pro.
Thanks

Is the point of this for it to go from out of the box to interop unlocked, or from chevron/dev unlock to interop?
In /Classes Root/ registry part you can add the file type so it's known...