Related
this is an older tutorial i found for the evo way back. it needs to be updated..
this could possibly work on other android htc phones to that have the fm transmit capability....
the evos Broadcom chip has a built in fm receiver and also a transmitter.
according to some threads and diagrams ive seen the transmitter does have a power source, it just doesnt have and software code to actually work.
like hdmi the hardware was there but there was no code set up, therefore we didnt have full hdmi out. it had to be built from scratch.
the hardware for the fm transmitter is there we just need some one to build the code for it.
some one please take this on!!
This tutorial was originally posted in > android development and hacking > android software development.
i am reposting it here in the evo forums for guidelines
its a nice tutorial but its old. i think it was for android 2.0 ive followed the tutorial but i couldnt get it working, and i by no means have the experience to switch things up and get it working.
[TUTORIAL] Reverse engineering HTC FM Radio for noobs (on EVO 4G)
Okay, I'm writing this because I want to help any other newbies trying to learn how to reverse engineer. The technical details involved in this are extremely daunting, so the purpose of this tutorial is to first explain in layman terms exactly what you're trying to accomplish and what to expect. Then we'll go over the details. That way you're not completely blind going into this. I'm fairly new to the scene, so I'm not as knowledgeable as everyone else. If you see any errors in my post, let me know so I can change. I'm going to assume you know a little bit of Java, can find your way around a computer, and know nothing about Android. The techniques used should work with other Android phones. For this tutorial I'm using Windows 7, Cygwin, and my stock (not rooted) EVO 4G mobile phone.
The FM tuner for the Evo is run by a Broadcom chip: BCM4329. This chip is pretty amazing in that it does wireless, bluetooth, and it has an FM receiver/transmitter. We're interested in the FM receiver / transmitter.
Now, all android phones are based on a Linux kernel. Basically they're Linux running computers. The Android operating system is then installed onto the linux system. Every app is then run off of Android.
Android is based on Java but it is not a Java system. It uses a virtual machine called Dalvik. Google did this to get around licensing issues with Sun Microsystems. So they pretty much invented their own machine language (called byte code) for the Java language. This makes things complicated for the reverse engineer because from what I've read, once Java is converted into this machine language or byte code, it can't be converted back.
So let's rehash.
If you were programming strictly in Java, you would see these extensions:
Java source code = .java
Compiled Java source code = Java byte code = .class
Compressed file to package your program = .jar (Java Archive)
But since you're programming in Android and Dalvik, you will see these:
Java source code = .java
Compiled Java source code = Dalvik byte code = .dex
Compressed file to package your program = .apk
(I haven't mentioned this, but HTC further Optimizes their .dex code)
Optimized Dalvik byte code = .odex
I'm writing all of these down because it's very easy to get confused with all of the extensions. (for me at least!). remember how I said once you go dex, you can't go back to java? That's where JesusFreke comes in. He's a senior member of XDA, and he created "baksmali" and "smali", two programs that can convert the Dalvik code back into a human readable format. These files have extensions of .smali
Decompiled Dalvik byte code = .smali
But what can you do with .smali files? That's where this other senior member, brut.all comes in: He developed apktool. apktool takes JesusFreke's work to the next level. This program in conjunction with NetBeans, actually lets you trace through any program using the .smali code taken from JesusFreke's programs!
apktool does this by converting those .smali files into "fake" .java files that can be used by the NetBeans (program that compiles and makes java programs) IDE. I say "fake" because apktool embeds the .smali code into java files as comments. However, once you attach a debugger to NetBeans, you'll see that the debugger will follow line by line every execution statement found in the smali code!
So...... you can take the program you want, plug it into Net Beans using a debugger (using the default ddms command provided by Android SDK), and you can trace everything you do in the program. I have it connected to my phone, so whenever I push a button while running my HTC FMRadio app or unplug my headphones,I see the corresponding response to the HTCFMRadio code I have loaded in NetBeans. I can now see in real-time how the program operates from my own interactions... JAM.
Technical Aspects: How to get from ground zero to tracing HTCFMRadio?
1.) Download Android SDK - Go to google development site and follow instructions: Make sure to download the latest Java JDK. Once that is installed, download NetBeans 6.8. Unfortunately, smali debugging does not work with the lastest versions of NetBeans.
Download the "Java SE" version for minimal space
http://netbeans.org/downloads/6.8/index.html
You can follow the rest of Google walkthrough and download Eclipse and ADT plugin, but it's not pertinent to this. You're going to be using adb and ddms from the android SDK extensively, so make sure the path for </android SDK/tools> is included in the PATH variable in your ENVIRONMENT SETTINGS. To get here, right click My computer, click properties, Advanced Settings, ENVIRONMENT SETTINGS.
2.) Search for 7z and download it. It is an awesome and free compression tool that will be extremely useful. It can be used to "unzip" .jar, .apk, and other compressed formats.
3.) Get the Radio app. You can do this by going to "shipped-roms" website, downloading the latest Supersonic image, and following the directions in the unlockr tutorial for HTC kitchens at the unlockr website... (once you have extracted the files from the image, you can look in the system/app and system/framework directories to get the files listed below) or:
you can pull the following files from your phone:
Using the command prompt type (and with phone plugged in, and with USB debugging enabled on phone):
adb pull /system/app/HtcFMRadio.odex
adb pull /system/app/HtcFMRadio.apk
adb pull /system/framework ./framework
This will put HtcFMRadio.odex and HtcFMRadio.apk in the current directory and create a framework directory with more files. A couple of the files in the framework are needed for the HtcFMRadio app, but for simplicity, we're just going to pull the whole directory.
Now that we have the files, we have to make a few changes to make the app installable and to be viewable by the debugger. To do this we have to decompile the .odex format into a human readable format we can edit. That brings us to:
3.) Download baksmali and smali from Project Hosting on Google Code (google search smali).
Usually an Android application is made up of one file, an apk file. Inside the apk file is an AndroidManifest.xml file, a classes.dex file (compiled Java code for the program), and other folders. The other folders contain either graphics or other .xml files that tell the program how it should look to the user. We don't have to worry about those for now. This is important because APKTOOL only opens programs set up this way. But wait up? We didn't download one .apk file, we downloaded an .apk file and an .odex file! What gives? Well, if you right click the apk file and open it (using 7z), you'll see that it's missing the classes.dex file. The dex file for the app is actually the HtcFMRadio.odex file we downloaded. So, to make this system app more like a nominal app, we have to find a way to convert the HtcFMRadio.odex to a classes.dex file. That's easy with baksmali and smali!
Once you download goto command prompt and type:
java -jar baksmali-<version>.jar -d framework -x HtcFMRadio.odex
(Remember to match baksmali-<version>.jar with the filename of baksmali you downloaded)
If done correctly, you should see a newly created \out directory
This creates an out\com\htc\fm directory with many .smali files.
Now let's reverse the process and put it back as a dex file. Type at command prompt:
java -jar smali-<version>.jar out -o classes.dex
If done correctly you'll see a newly created classes.dex.
now, right click on HtcFMRadio.apk (select 7z and open). Drag classes.dex into the file. Say yes to the prompt. Now you have a normal apk file APKTOOL can read!
4.) Download APKTOOL from Project Hosting on Google Code and the helper apps for your OS. (If you're extracting files for windows OS you should have apktool.bat and aapt.exe). Extract (again using 7z, don't you love this program?) apktool.jar (keep it as a jar file, don't extract the stuff inside of it), apktool.bat, and aapt.exe to the directory you're working on. To make things neat, you can also delete HtcFMRadio.odex (you don't need it anymore) and classes.dex (make sure you put it in the HtcFMRadio.apk file first!)
If this is the first time you're using apktool, then you have to install the htc framework so apktool can baksmali the Radio app. You only have to do this once:
apktool if ./framework/com.htc.resources.apk
Alright, at the command prompt:
apktool d -d HtcFMRadio.apk
This extracts the contents of HtcFMRadio.apk and places them in the HtcFMRadio directory. However, there are two major differences between this content and the content created in step 3. If you go into the smali directory you'll see that instead of .smali files, you'll see .java files. And if you go back and edit the AndroidManifest.xml file, you will also see that it's in text! Android applications convert their xml files to binary format. Now that APKTOOL has converted everything to an IDE friendly format, we can use NetBeans to edit everything. The first thing we're going to do is edit AndroidManifest.xml (using notepad) and add the following:
android:debuggable="true" to the Application tag.
IT should now look like this:
<application android:theme="@android:style/Theme.Black.NoTitleBar" android:label="@string/fm_app_name" android:icon="@drawable/fm_radio" android:taskAffinity="android.task.fmradio" android:description="@string/htc_corp" android:allowTaskReparenting="true" android:debuggable="true">
This permission lets the debugger watch the program while it's running on the phone.
We are going to run into two problems if we try to install this program. One is that Android doesn't let you install more than one copy of a system app. The second issue is that if we change the signature of our system app, then we'll have to change the signatures of our other system apps as well! Ahh.... So, to get around that, we're going to trick Android into thinking we have a completely new program. We're going to do that by renaming the com.htc.fm class to com.htc.modradio class. Next step:
5.) Cygwin (or Linux virtual machine)
The easiest way that I can think of to replace strings in multiple files is by using linux. You can most definitely do it in WIndows, but I dont know how. If you let me know how, I can put it in this tutorial.
(update: you can use Notepad++ to easily find/replace strings in multiple files for Windows. You still, however, want to download Cygwin if you're going to develop with Android-NDK.)
For now, just search for Cygwin (Cygwin is a program that lets you run Linux commands from a command prompt using your Windows directories), and install it. Make sure to have the Perl option selected. You'll need Perl to make the following commands work.
Once you get Cygwin up and running
cd <to your HtcFMRadio directory>
in my case it's
cd /cygdrive/c/Users/Jerry/Desktop/HtcFMRadio
now type the following commands in this order:
this command changes all occurances of htc/fm to htc/modradio in your xml and .java files.
find ./ -type f | xargs perl -pi -e 's/htc\/fm/htc\/modradio/g'
this command changes all occurances of htc.fm to htc.modradio
find ./ -type f | xargs perl -pi -e 's/htc.fm/htc.modradio/g'
If you don't follow this order, your source code will get messed up.
If using cygwin, a bunch of .bak files will be created. Using windows search, find all .bak files in your HtcFMRadio directory, then select them all and delete them (Make sure they are only files with .bak!)
Now just rename the fm directory to modradio. It is located in HtcFMRadio/smali/com/htc
Now go to your windows command prompt and type:
apktool b -d .\HtcFMRadio modradio.apk
Now sign and install modradio.apk on your phone.
adb install modradio.apk
If you have never signed before, then you need to use keytool and jarsigner. These two files are in your JDK directory, so make sure you include your JDK directory in the PATH variable of your ENVIRONMENT SETTINGS. (To get here, right click on My Computer, click Properties, Advanced Settings, Environment Variables. Once you make change, open up a new COMMAND prompt to see changes).
cd to the directory which has modradio.apk
now type:
keytool -genkeypair
Answer all questions, then use the same password for all password prompts.
Next type:
jarsigner -verbose modradio.apk mykey
Type in the password you created in the above step. Your apk should now be signed.
Next install:
adb install modradio.apk
Success!
6.) Testing the app on phone
Go to your phone and you'll now see a new FMRadio icon next to your first. Click on it and watch it open. It should now be able to play music. Keep it open.
7.) Using Netbeans
Go into HtcFMRadio and delete the build directory created by APKTOOL.
Now open up Net Beans and click on File, New Project, Select Java Project with Existing Sources, click on Next
Select HtcFMRadio directory for Project Folder, rename Project Name to whatever you want. Let's type in ModRadio. click on Next
Next to "Source Package Folders" click on "Add Folder" and select the smali directory.
Click Finish. For a quick tutorial by Brut.all, search APKTOOL in youtube and click on: Apktool Demo 2 - Smali improvements
Right click on Libraries. Click on "Add Jar / Folder". You want to add Android.Jar. Since I have Android 2.1 loaded I went to /platforms/android-7 located in my android SDK directory.
Your project is now ready for editting!
8.) Running the Debugger to trace through program.
Next go back to Windows command prompt and type ddms. This runs the Dalvik Debug Monitor. A window should open up. In the left hand side you should see com.htc.modradio. That's our app! To the right you're going to see 2 numbers, you're interested in the one to the right, 4 cells away from com.htc.modradio. This number is a port number, and you're going to use it to communicate with NetBeans. (In my case it is 8603)
Go back to NetBeans and click on Debug, Attach Debugger.
In the host field type: localhost
In the Port field: type in the second number you saw. (8603)
If everything is working you'll see a bug appear next to com.htc.modradio in the Dalvik Debug Monitor. Look at the bottom bar of NetBeans for feedback. If you get errors make sure the numbers match, or try port 8700 and make sure you select com.htc.modradio in the Dalvik Debug Monitor. Port 8700 is the default port used for whatever program you select in Dalvik Debug Monitor.
9.) Setting a breakpoint
I'm making this a seperate step because it is completely arbitrary. When creating a break point be sure to follow this rule:
You must select line with some instruction, you can't set breakpoint on lines starting with ".", ":" or "#".
Rather than looking for a spot to breakpoint, though, I'll tell you where to put one so you can quickly see how the debugger traces through the code. You aren't "REQUIRED" to do the next step, but if you want to trace you have to put a breakpoint somewhere.
In Net Beans click on the Project tab, click on Source Packages, com.htc.modradio, and then doubleclick on BroadcomFMTuner.java
We're going to insert a breakpoint. Scroll down to line 3226 and on your keyboard press: CTRL-SHIFT-F8, select line in dropdown box and hit ok. (To keep it simple, I usually look for "invoke" instructions to set breakpoints at)
Now go to your phone and click on the physical "back" button on your phone. This will clear the radio,(you should still be able to listen to music). Drag your status bar down. You should see a radio icon. Click on it again. The radio backgroudn will appear, but you wont' see any text or anything. Now go back to your netbeans application. You should now see debug options highlighted! Click on Step Over (F8) to step through!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
i found a few things.
http://pdf.eccn.com/pdfs/Datasheets/Broadcom/BCM4329.pdf
http://www.broadcom.com/products/Bluetooth/Bluetooth-RF-Silicon-and-Software-Solutions/BCM4329
Mad tutorial man! You have just opened up my world even more to Android. Thank you heaps.
BTW your freakin signature got me good damn you! I thought someone had hacked my PC LOL
Any chance that this will work with JB?. Can you post app?. Thanks.
I have written a .Net app for backing up windows phone 7 via the Zune updater tool. This backup can be used by Zune to restore the device when you use the "Update" option under settings.
This is a COMPLETE backup and COMPLETE restore IF USING ZUNE 4.7AND/OR the V1.9 Tool. Your phone will be EXACTLY the same after a restore as it was when you did the backup. Any updates, file changes, registry entries, or texts will not persist that were not on the phone at the time of the backup. Sorry for the bold but I have answered this question about a dozen times in PM's or on here.
Use this at YOUR discretion. There are scenarios in which you can't use the backup you made to restore. For instance on my Samsung Focus I had the stock ROM on it and couldn’t' restore my 7720 Mango backup. I had to upgrade the phone to at least 7712 Mango BEFORE the backup would restore. But I could go from 7720 to stock. When it failed I was getting a "Version Mismatch" error. Make sure you can at least get back to the REV level you backed up from before expecting this to work or you may be sorry. Finally, NEVER trust a backup that does not say it completed properly INCLUDING a SUCCESS message!!. I also HIGHLY recommend having a stock ROM on hand to flash back to the device if necessary.
HD2 owners: See Post 2 in this thread
**New features:
Manage backups/archives. Set Paths to zune and updatewp as well as the PKS file.
Archive capability of the older backups AND restore of active backup or archives.
Will Install Support Tools and PKS file if needed.
Version 1.8 will seem quite different if you are on Vista/7 with UAC and not running as a full admin. The reason is that you can't change registry entries in HKLM or move files in program files without those rights. If you werent running as a full admin before you may have trouble if you start now. Just answer the UAC prompts when a backup starts and ends to change the files/reg entries to 4.7 and back to 4.8 values/files. I tried to consider lots of conditions like what if it fails during the backup or crashes so if you launch the app after a crash it will detect that that the changed reg entries are in place and undo them to get you back to where you were prior to the last run. The UAC prompts are there to protect you so don't get mad at me when you see 2 each time you use this to backup. If you need ZuneWMDU.DLL from 4.7 check these posts attachments:
Click here for x86 (32 BIT) os's
or Click here for x64 (64 bit) os's
You can put it with the back tool or anywhere and the program will ask you where it is and you can tell it. You can even rename it to something else. For instance I have it in my Zune folder named Zunewmdu.dll.47. Just don't replace the original 4.8 Zunewmdu.dll file.
Firstly I have to credit this to reading and putting together pieces from several threads on XDA. I read so many to be honest I am no longer sure who all to credit. There was no specific single source I just saw several things and through trial and error put together the pieces that made this possible.
This APP is a wrapper around a tool microsoft produced to perform updates to your phone via command line. Specifically the executeable "updatewp.exe" that comes from the Windows Phone Support Tools. The missing piece that eluded me for a bit was the update package itself which I found here on XDA and will link to later.
Prerequisites that need to be Installed/downloaded:
Looks like at least Phone OS version 7008 is required for the backup to work.
Zune Software Installed (I'm sure most of us have this): http://www.zune.net/en-us/products/software/download/default.htm
Windows Phone Support Tools Installed - MS Links are dead ATM.
If you are missing these prerequisites the app will tell you and even open a web page on request to the DL links.
If an error occurs you should find the text in your clipboard for easy pasting here on the forums.
To explain the process:
updatewp.exe is meant to update your phone with PKS files theoretically obtained from the device manufacturer. It will also do other things including a command line restore of a backup.
This program launches updatewp.exe with two command line arguments. One is the PKS file name and path and the second is the enablebackup switch.
What happens is the phone performs the backup first, once it completes the process the code terminates updatewp.exe before it goes further. In theory if you are using an update not compatible for your phone it would actually just say that and quit. However terminating the updater keeps it from ever getting that far.
I have used this to make a complete backup AND restore it via the ZUNE Update options under settings for my phone so I know it works.
How to use the app:
Attached to this post is a zip file with two folders. x86 and x64. Please launch the appropriate EXE for your platform.
If you do not have zune or windows phone support tools it will tell you immediately and offer to open the download URL on your computer.
If you pass those tests you will need to input a path to the PKS file in the long textbox. There is a button just above it that will open a URL to the download for the one I used here on XDA. There is also a Browse button below the textbox for you to use to browse to and set the file path via GUI.
Once the path is set click on backup and watch it go. If you already have a backup made previously this will overwrite it or offer to archive it (v1.2 & up).
Good luck and post feedback, thoughts or issues please.
Changelog:
v1.9 - I pulled 1.8 and have added 1.9. This version corrects some more bugs in 1.8, one of which doesnt show the completed success message when performing a backup. The first time you launch it you will see a prompt stating this is the first time you have launched this version and you need to choose if you want to use the 4.7WMDU file switching method or just have the program try to use what you have installed. If you choose not to use the file switching method it will still check to make sure the zune and updatewp versions match but will only warn you they don't match, you can still try to proceed with the backup/restore. I have tested this in both modes doing backups and restores (this is why it took so long to get out).
v1.8 - I changed the way the program does things so that it will use the ZuneWMDU.DLL file from Zune 4.7 to perform FULL backups. You CAN'T use the tool without that file and I am not going to include it because I am not going to redistribute Microsofts property. If you are using Vista/7 with UAC you will be seeing some extra prompts because elevation is required to change reg entries and move files around to allow you to use this with the newest Zune 4.8 and still get a complete backup. To get the older ZuneWMDU.DLL file just get it from the install path of zune and then uprade to 4.8. The program will ask you for the path to the old DLL for future use/reference. Don't get pissed at me with all the UAC prompts either, they are required if you arent a full admin on the machine. I re-released 1.8 on 9/16 to fix a few minor bugs that kept it from working correctly under certain cirumstances.
v1.7 -PULLED because the backups Zune 4.8 Makes are utterly USELESS. 1.8 is in the works that will make use of the old updatewp and some old zune 4.7 files to perform COMPLETE backup and restores as it originally did.
v1.6 - Added the ability to set all of the paths (requested by folks using languages other than english). Added some management capabilities for the backups. To archive the active one immediately or move an archived backup to the active folder.
v1.5 - This only adds proper path support for windows XP. If you are using the 1.4 version and don't have XP then there is no need to upgrade.
v1.4 - Works with Mango Beta if you have updated Zune assuming you have also updated the 4.8 support tools. It will check the versions and inform you of any issues found. Also corrected the blank error message issue some users were seeing. 4.8 support tools, check the second D/L (non) link: http://forum.xda-developers.com/showthread.php?t=1148123
v1.3 - Changed the path used for backup location to the LOCALAPPDATA environment variable rather than USERPROFILE to be more compatible with XP. If you don't have the windows phone backup tools installed the software will offer to DL and install them silently for you. The PKS file is now packed in with the software. If you don't have a PKS file set it will offer to unpack it and use it by default. I didnt add ZUNE install to this because well, if you don't have that your not really using your phone are you?
v1.2 - Added archive capabilities. If you choose to backup your device and a backup is in place you are asked if you want to archive it. If you choose to keep it then a folder in your documents called "Windows Phone 7 Zune Backup Archive" is where it goes. Each backup will go in to a folder labeled by the date/time it was created. The format will be Month-Day-Year Hour-Minute-Second so you know exactly from WHEN the backup was from.
Added a Restore Button that will use the latest restore if that is all you have, or ask if you want to browse and choose from the archived backups to restore. Whichever you choose will become the "Active" backup to zune and then the restore will take place afterwards. The former active backup is automatically placed in the archive. When the restore is completed the SAME backup you chose is still the active one so using ZUNE to do the restore will yield the same result.
***IF you have multiple devices the archive portion will work fine, however I have yet to find a way to identify which ID is which device so when you choose to restore from an archive YOU will have to pick the correct one or it won't work.
v1.1 - Updated where the code looks for the windows phone tools to accomidate installs of zune to alternate locations.
In Development:
Determine the device ID of the connected phone so I can keep multi device backup archives straight when presenting which backups from an archive to restore. I don't have two devices so this will be a feature in beta until it is proven by your feedback.
Error Code Troubleshooting:
Firstly, if you want help in this thread PLEASE tell us what your Computer OS is including if its 32/64 bit. What OS revision your phone is at and What kind of phone along with details of the problem! Thanks!
I found this link to MS for different error codes and a solution grid of sorts that relates to ZUNE etc..:
http://support.microsoft.com/kb/2484484#80072EE7_801812DD_801811C5
This is a COMPLETE backup and COMPLETE restore IF USING ZUNE 4.7!!. Your phone will be EXACTLY the same after a restore as it was when you did the backup. Any updates, file changes, registry entries, or texts will not persist that were not on the phone at the time of the backup. Sorry for the bold but I have answered this question about a dozen times in PM's or on here.
ZUNE 4.8 seems to only backup whatever Zune does not synch and things like game states! I HIGHLY recommend reverting to 4.7 zune and phone tools if you want a COMPLETE backup. Zune 4.7 cant talk to Mango but it doesnt need to for a backup. A Complete backup made by 4.7 tools WILL restore with 4.8 tools.
Known Issues:
HD2 owners. There seems to be a problem using this method to backup the phone. The current theory is that the HD2 does not use the same boot loader as other WP7 devices and is not recognized correctly in that mode so it doesnt work. I would be interested in knowing how your updates are applied as the log I got from one user indicates the phone talked to the update program once it rebooted?!
Additional tips and observances:
*You CAN'T change the memory size and perform a restore, I already know this doesnt work so forget about adding memory and just restoring
*To my knowledge you can't backup from one device and restore to another as the backup files are signed/ID'd to the device that made the backup.
How to restore a backup via ZUNE if you don't want to use the restore feature:
Make sure your phone is hooked up to the computer first then from within the ZUNE software you should see a menu near the top right-hand side labeled "Settings". Click on that. On the settings screen look near the top left and you should see "Software" "Device" and "Account". Instead of device it may say "Phone".
Click on Device or Phone, whichever you see. The left edge has several options. Near the middle you should see "Update". Click that. You should see a progress bar for a few seconds and then most likely it will tell you that the phone is up to date. At the BOTTOM of all the text it spits out should be a button labeled "Restore" with the date of the backup.
BACKUP CREATION LOCATION:
Copy & paste the following in to the run dialog box:
Vista/Win7: %LOCALAPPDATA%\Microsoft\Windows Phone Update
Win XP: %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows Phone Update
If you are running the backups with elevated privileges then you need to open a command prompt with those same privileges and paste in the above paths to find them as they may likely be in a different user account.
You will have to manuall drill down from their because the sub folder structure is named from the Phones ID.
Manual Command Line Method to Perform Backup:
All the same prerequisites apply. Zune and the windows phone support tools need to be installed.
It is easiest to have unzipped the PKS file in to folder the support tools are in. You can do this by opening the run dialog and typing: %PROGRAMFILES%\zune and hit enter or click ok. This will open explorer to that folder and you can move/copy the UNZIPPED PKS file there.
Open a command window with admin privileges. To do this in windows Vista/Win 7 with UAC enabled click on the "Start" Windows logo usually found in the bottom left corner.
In the search programs and files dialog type CMD and wait for the search to produce CMD.EXE at or near the top of the list. RIGHT click on cmd.exe and choose "Run as administrator". (hopefully you don't have to input admin credentials to do this)
At the command prompt type: cd %PROGRAMFILES%\zune (and hit enter). Your prompt should change to include the program files path and ZUNE for example "c:\progam files\zune"
Now assuming the support tools are installed correctly you can test by typing: updatewp (and hit enter) this should spam the screen with the command line options for updatewp and lets us know the rest will work.
The command to type is: updatewp.exe /iu A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks /enablebackup (and hit enter) You should be able to copy the command line as it is and right click on the DOS window at this point and choose "Paste" to save the trouble of typing that awefull string.
This is all the program I wrote does to start a backup other than kill the update process at the end since it can't happen.
I hope this works for you if the code does not!
Great!! thanks , will try .
The system cannot find the file specified
What precedes this section of the file path? and is it the same path on Windows 7?
/Library/Application Support/Windows Phone 7 Connector/Cache/Device Update/
Looks like your trying it on a Mac? Not gonna work
You can do it manually. Double check the updatewp.exe command line for a mac and if its the same as a PC then run it updatewp.exe PKSFILEPATH /enablebackup
hx4700 Killer said:
Looks like your trying it on a Mac? Not gonna work
Click to expand...
Click to collapse
I'm not. i'm on PC.
Where do i place the file from this page?
http://forum.xda-developers.com/showpost.php?p=11542700&postcount=6
I put it in the Zune folder and then my command line was:
updatewp.exe /iu "C:\Program Files\Zune\A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks" /enablebackup
open cmd.exe to the dos prompt and change to the ZUNE folder and then type or copy & paste in the above.
Perhaps I didnt specify this but you will need to unzip that file from the other post.
hx4700 Killer said:
I put it in the Zune folder and then my command line was:
updatewp.exe "C:\Program Files\Zune\A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks" /enablebackup
open cmd.exe to the dos prompt and change to the ZUNE folder and then type or copy & paste in the above.
Perhaps I didnt specify this but you will need to unzip that file from the other post.
Click to expand...
Click to collapse
Sorry, but I'm not quite sure what you mean :-/
I unzipped the "A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks" file
Then, I placed it in the zune folder: C:\Program Files\Zune\
Now I have cmd open, but I don't know what you mean by "change to the ZUNE folder and then type or copy & paste in the above."
What do I change about the Zune folder? and what am I typing into the cmd promt?
when I say change to the zune folder I mean change the current folder the command prompt is at by typing this:
cd c:\program files\zune and press enter
copy the following text in to the clipboard:
updatewp.exe /iu "C:\Program Files\Zune\A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks" /enablebackup
Then right click on the command box and choose paste and hit enter.
OR just type the above text in to the command box and hit enter.
Well, I got a little further, but I get this message in the cmd:
c:\Program Files\Zune>updatewp.exe "C:\Program Files\Zune\A0CE706D-12B7-45AC-A5FC-AD04DFCA6E86.100.pks" /enablebackup
'updatewp.exe' is not recognized as an internal or external command, operable program or batch file.
There was a prerequisite you needed that I listed. It is the windows phone support tools:
Windows Phone Support Tools:
x64 Windows: http://download.microsoft.com/downlo...Tool-amd64.msi
x86 Windows: http://download.microsoft.com/downlo...rtTool-x86.msi
updatewp.exe comes from that and is installed in to the zune folder when you install those tools.
Nice. Got the backup to work! Thanks for all the help. I'm going to hard reset and see if the backup works
quick question: does the backup process backup everything, including word documents?
The backup seems to backup anything on the phone.
For instance I used the reg hacks so I could see the phone in explorer. I put a couple of files in the video folder directory as a test and the phone could play them.
Further Zune ignored them and did not consider them as part of the sync process.
When I performed by backup and restore even those files were restored.
I can not speak to folders created that are not part of the normal hierarchy but I suspect that anything on the phone is backed up.
Adding:
I should stress again that this is the same backup that zune performs when you update your device with the update tool. This is just using one of the support tools that offers command line to trigger the backup when you have a legitimate update file. In this case however the program I wrote is terminating the update before it can begin once the backup is performed. So in other words I am just "tricking" the update program in to running and performig the backup.
Mallux,
I just figured out why you were getting that error.
The code checks for the existance of zune and then the support tools specifically by checking for the existance of the files.
The checks do the same thing so I cut & paste the zune check code in for the support tools and didnt change the path to check for updatewp.exe. So basically the code checked for zune twice and then went on.
I fixed the code and updated the DL link in the first post.
Im sure now that you have the support tools installed the code would work as written, or with the new DL link.
Hi and congrats for your work (if it works ? hehe, just kidding).
Maybe you would have better feedback in posting this to the dev and hacking section or the software one ?
Just a thought, since here are mostly apps for the phone itself.
Best regards
Andy
[APP] Working App to Backup Windows Phone 7 via ZUNE ANY TIME
I posted this in windows phone 7 apps and it was suggested that I post it here so don't hammer me for cross posting please.
I have written a .Net app for backing up windows phone 7 via the Zune updater tool. This backup can be used by Zune to restore the device when you use the "Update" option under settings.
Firstly I have to credit this to reading and putting together pieces from several threads on XDA. I read so many to be honest I am no longer sure who all to credit. There was no specific single source I just saw several things and through trial and error put together the pieces that made this possible.
This APP is a wrapper around a tool microsoft produced to perform updates to your phone via command line. Specifically the executeable "updatewp.exe" that comes from the Windows Phone Support Tools. The missing piece that eluded me for a bit was the update package itself which I found here on XDA and will link to later.
Prerequisites that need to installed/downloaded:
Zune Software Installed: http://www.zune.net/en-us/products/software/download/default.htm
Windows Phone Support Tools Installed:
x64 Windows: http://download.microsoft.com/downl...E4A-8179-9A3C5483E366/WPSupportTool-amd64.msi
x86: http://download.microsoft.com/downl...-4E4A-8179-9A3C5483E366/WPSupportTool-x86.msi
An update package from ANY phone, this one is for an HD2 that I used while working on a samsung focus. Download and Unzip:
http://forum.xda-developers.com/showpost.php?p=11542700&postcount=6
If you are missing these prerequisites the app will tell you and even open a web page on request to the DL links.
Please understand this is release 1.0 and as such may have issues depending on your platform and your computer etc.... I coded it for x86 and x64 Windows with the Microsoft .net Framework 2.0 minimum. I tried to consider several error scenarios but one never knows how an end user might use your program that wasnt anticipated and coded for.
If an error occurs you should find the text in your clipboard for easy pasting here on the forums.
To explain the process:
updatewp.exe is meant to update your phone with PKS files theoretically obtained from the device manufacturer. It will also do other things including a command line restore of a backup.
This program launches updatewp.exe with two command line arguments. One is the PKS file name and path and the second is the enablebackup switch.
What happens is the phone performs the backup first, once it completes the process the code terminates updatewp.exe before it goes further. In theory if you are using an update not compatible for your phone it would actually just say that and quit. However terminating the updater keeps it from ever getting that far.
I have used this to make a complete backup AND restore it via the ZUNE Update options under settings for my phone so I know it works.
One could most likely also archive backups by copying/moving from their storage point before creating a new one so as to have a backup that could be reverted to from a point in time further than the last one on record. If there is enough interest in such a feature and incentive I would consider adding it here.
Attached to this post is a zip file with two folders. x86 and x64. Please launch the appropriate EXE for your platform.
If you do not have zune or windows phone support tools it will tell you immediately and offer to open the download URL on your computer.
If you pass those tests you will need to input a path to the PKS file in the long textbox. There is a button just above it that will open a URL to the download for the one I used here on XDA. There is also a Browse button below the textbox for you to use to browse to and set the file path via GUI.
Once the path is set click on backup and watch it go. If you already have a backup made previously this will overwrite it.
I can not say if this will work with a debranded phone but I don't see why not. My focus is an out of the box stock AT&T phone with chevron unlock on it (which you shouldnt need) and a couple of non-marketplace apps.
Good luck and post feedback, thoughts or issues please.
***Adding Instructions on how to restore as its come up a few times:
Make sure your phone is hooked up to the computer first then from within the ZUNE software you should see a menu near the top right-hand side labeled "Settings". Click on that. On the settings screen look near the top left and you should see "Software" "Device" and "Account". Instead of device it may say "Phone".
Click on Device or Phone, whichever you see. The left edge has several options. Near the middle you should see "Update". Click that. You should see a progress bar for a few seconds and then most likely it will tell you that the phone is up to date. At the BOTTOM of all the text it spits out should be a button labeled "Restore" with the date of the backup.
You CAN'T change the memory size and perform a restore, I already know this doesnt work.
Ok first off all, I have to thanks for you for your hard work! The tool just worked like a charm. I just used the back-up tool and it succeeded made a backup of my Omnia 7. I'm just wondering a few things:
Is my phone identical the same if I use the backup tool? That means the register changes and installed apps??
I have used the zune update - Restore function and everything was the same. I have several xbox live games and after the restore I was still at the same place in my games. Further my phone is chevron unlocked and remained so after the restore.
Further, I did the reg hacks to see the phone in explorer when zune is closed and put a couple of small vid files in the video folder. Those files did not show up in Zune on my PC or in my collections but the phone could play them just fine. After the restore they were still there too. So from what I can tell the une backup tool backs up the phones memory as it is no matter what is there. I have not tested non-standard folders that are user created though but would assume they would work all the same.
Further a couple of observations:
During development I found I could unplug the phone at any time during the backup process and it would be just fine. No harm.
In Zune when the phone is hooked up I could see the "memory graph" and it had slices in it and hovering over them with the mouse would yield what each slice was... e.g. Videos, Music, pictures etc... I had a large area that said it was reserved for data "from another computer" or some such verbiage. After the restore that was gone and I had a little more memory back for my own use. The slices seemed to be gone too but had no effect on what zune synched etc... Perhaps a full resynch might change it but I havent done that.
**Adding:
Having re-read your post I am now wondering if you are asking if your phone is the same as after the backup as it was prior to the backup? It should be unchanged. The backup process is the same that would occur if you were performing a legitimate carrier update. The process says it transfers the update to the phone but does not execute it until after the backup. My code terminates the updatewp.exe program before that happens so ultimately you might have the 310k file still on your phone in some "updates" folder somewhere.
Hello xda-developers
I'm not really sure if it's already mentioned here on the forums, but today I found out that provxml-files which where written as .rgu and translated by "rgu-2-xml" don't work for Windows Phone 7. The output file is saved as ANSI file. After updating to Mango I tried a "Developer Unlock.xml" file but it didn't work. Well, all the procedure back and again but now with a UNICODE file After right-clicking the (ANSI) xml-file, "edit" and re-saving it as UNICODE file I noticed that the size of the file increased I tried the provxml-Method again and it worked! Not sure if I'm the only one with this solution and like I already said: not sure if it's already said here Please let me know if it helped you
you unlock your device on Mango build?
hd2leo_fusion said:
you unlock your device on Mango build?
Click to expand...
Click to collapse
The provxml method works on Mango as well.
Yes, I unlocked Mango But for me there are still some unanswered questions about provxml =/ Does a provxml file only work once on Omnia 7?
experience7 said:
Yes, I unlocked Mango But for me there are still some unanswered questions about provxml =/ Does a provxml file only work once on Omnia 7?
Click to expand...
Click to collapse
Ηow you will run provxml on omnia ...
I was under the impression that provxm works only with htc connection setup ...
And yes after the appl (connection setup) finish the 1rst run its deleting the provxml file.
You can also use it on Samsung devices Here is the thread where I found it: http://forum.xda-developers.com/showthread.php?t=1152422
Yes, with Connection Setup on HTC it will be deleted - but what about the GPRS Manager used for Samsung devices? After executing a command (xml-file) in the GPRS Manager, it's still there ^^ Even if I restart the app or the whole phone -> After opening the GPRS Manager again, all the entries seem to stay there
EDIT: Okay, tested it again and it seems like you can apply the xml's as often as you want with GPRS Manager I flashed a older ROM so my phone was on 7004 again I unlocked using ChevronWP7 and installed WP7 root tools. I created a file which switches the Internet Explorer's search provider to Google Well, after execution I first opened IE9, pressed search and yup.. google.com came up - then, just to be sure I opened WP7 root tools and took a look at the SearchScopes in registry. They were changed to Google, so the xml really worked. Then I manually wrote everything back to default. I opened the Internet Explorer, pressed the search button and Bing came up.. so everything's like before. I applied the "Google Search.xml" again and.. yes, it worked: Same effect like above: Registry was changed, IE9 search is now google.com
Well so at the end I can say that this is really useful for switches like in my example. I created several switches like "Enable instant resuming.xml", "Disable instant resuming.xml", "Enable lockscreen never option.xml", "Use Bing (default) search.xml", "Use Google search.xml", ... Wow, Mango with fast resuming apps is wonderful!
experience7
All of my rgu's that I've converted using xboxmods tool rgu2xml have worked just fine on my hd7.
It does kinda suck that HTC connection setup deletes the provxml everytime
Sent from my HD7 using XDA Windows Phone 7 App
Hm.. yes, maybe on HTC (with HTC connection setup) it's enough to convert them. On my Omnia 7 i had to open the provxml files, and resave them as UNICODE ".xml" files It's nice that GPRS Manager on Samsung devices doesn't delete the .xml files
Thank you for this! I was wondering why Connection Setup-applied ProvXML wasn't working. This will hopefully do it.
I've come up with a way to chain provxml files. I don't yet know if it works - it depends on how the deletion after processing the CustClear file is implemented - but it has the potential to allow you to store a "working copy" ProvXML file in My Documents as a txt file (which you can open and edit with Word), and then every time you use Connection Setup, it copies your "working copy" file to \Windows, renaming it as it does. This should make further modifications easier; just copy the XML from a website or app, paste it into Word, and run Connection Setup twice (once to copy your edited file, once to process it).
If it works, I'll post the file.
OK, I couldn't get the chaining to work. It's still in the file, just commented out, in case anybody else wants to experiment.
Oh, and I added some very convenient (if you deal with things like I do all day) registry tweaks. Open .LOG files as though they were .txt (great for attachments) and add an expansion for the , key similar to the one that the . key has.
THis really help me, That's the reason why my unlock.xml didn't worked in 7712 back then. I thought it was the 7712.
minori_aoi said:
THis really help me, That's the reason why my unlock.xml didn't worked in 7712 back then. I thought it was the 7712.
Click to expand...
Click to collapse
I'm trying to keep my HD7 unlock after updating to 7712 but the many times I tried, the Connection Setup will not run after 7712 update. If you can share the file and method with steps you used, that would be appreciated.
I don't know why your HTC connection setup didn't start after the update But maybe you did something wrong.. Okay, let's go through the steps together
Well, for Samsung devices you need a .xml file (GPRS connection manager handles with .xml files).
And on your HD7 you need an .provxml file (HTC connection setup handles with .provxml files).
Okay, first step is to be developer unlocked on NoDo - I think you are, right? [If you want to test it: Just try to sideload an app. If it works your phone is unlocked.. else it's not.]
Now uninstall HTC connection setup and install it again. Do not sideload any app found in the internet - just install the official app from the marketplace.
The next step is to get the right .provxml file. You don't need to do the following steps: I've already attached one which works. But just that you can follow me: Basically the file has to apply the following changes:
1) Developer unlock
Code:
[HKEY_LOCAL_MACHINE\Comm\Security\LVMod]
"DeveloperUnlockState"=dword:1
2) Prevent from relock
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]
"PortalUrlProd"=""
"PortalUrlInt"=""
3) Maximum sideloaded apps
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7fffffff
And to create a this file we need to open Notepad:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\Comm\Security\LVMod]
"DeveloperUnlockState"=dword:1
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]
"PortalUrlProd"=""
"PortalUrlInt"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7fffffff
Simply save this file as a .rgu file.
Then you need the tool "rgu-2-xml.exe" which converts the .rgu to a .provxml file. I've also attached this tool.
Okay, the generated file has now to be in the "Windows" directory of your phone. You can use the "WP7 mass storage" trick to get the file to your device - just search here on xda-developers. After you've copied the file to your device it will be stored in "\My Documents\Zune\Content\0400\...". Now you need a file explorer for HD7. I'm not sure if you're already using a tool but TouchXplorer should do the job. Open your tool on the phone and navigate to the folder above. There should be several folders.. just browse through them and look for a file which has got a short name and another file ending as our file (CustClear.provxml). Check the file size - it has to be the same on PC and your phone. If it's the same file rename it to "CustClear.provxml" again. Then move the file to the "Windows" folder on your HD7. The file has got the right name and is on the right place.. let's go on:
Now don't start the HTC connection setup!
Be sure to update to the highest build available at the moment. It's Mango v7720. There are tutorials here on xda-developers.com on how to update to v7720 Run HTC connection setup only if you can see that your phone is running v7720. You can see this under settings > about > more information.
Then you should be developer unlocked and sideloading apps should work again.
If anyone finds a mistake in those instructions please tell me! Thanks
And please tell me if it worked
Thanks for this but I don't need it now as as I had solved my problem.
After 7403 update, I uninstalled Connection Setup and re-installed again.
Nonetheless, I will PDF your instructions and download the 3 files to try out and learn this. Thank you very much for providing the detailed instructions. I'm sure it might be useful for some others.
experience7 said:
I don't know why your HTC connection setup didn't start after the update But maybe you did something wrong.. Okay, let's go through the steps together
Well, for Samsung devices you need a .xml file (GPRS connection manager handles with .xml files).
And on your HD7 you need an .provxml file (HTC connection setup handles with .provxml files).
Okay, first step is to be developer unlocked on NoDo - I think you are, right? [If you want to test it: Just try to sideload an app. If it works your phone is unlocked.. else it's not.]
Now uninstall HTC connection setup and install it again. Do not sideload any app found in the internet - just install the official app from the marketplace.
The next step is to get the right .provxml file. You don't need to do the following steps: I've already attached one which works. But just that you can follow me: Basically the file has to apply the following changes:
1) Developer unlock
Code:
[HKEY_LOCAL_MACHINE\Comm\Security\LVMod]
"DeveloperUnlockState"=dword:1
2) Prevent from relock
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]
"PortalUrlProd"=""
"PortalUrlInt"=""
3) Maximum sideloaded apps
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7fffffff
And to create a this file we need to open Notepad:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\Comm\Security\LVMod]
"DeveloperUnlockState"=dword:1
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]
"PortalUrlProd"=""
"PortalUrlInt"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\Install]
"MaxUnsignedApp"=dword:7fffffff
Simply save this file as a .rgu file.
Then you need the tool "rgu-2-xml.exe" which converts the .rgu to a .provxml file. I've also attached this tool.
Okay, the generated file has now to be in the "Windows" directory of your phone. You can use the "WP7 mass storage" trick to get the file to your device - just search here on xda-developers. After you've copied the file to your device it will be stored in "\My Documents\Zune\Content\0400\...". Now you need a file explorer for HD7. I'm not sure if you're already using a tool but TouchXplorer should do the job. Open your tool on the phone and navigate to the folder above. There should be several folders.. just browse through them and look for a file which has got a short name and another file ending as our file (CustClear.provxml). Check the file size - it has to be the same on PC and your phone. If it's the same file rename it to "CustClear.provxml" again. Then move the file to the "Windows" folder on your HD7. The file has got the right name and is on the right place.. let's go on:
Now don't start the HTC connection setup!
Be sure to update to the highest build available at the moment. It's Mango v7720. There are tutorials here on xda-developers.com on how to update to v7720 Run HTC connection setup only if you can see that your phone is running v7720. You can see this under settings > about > more information.
Then you should be developer unlocked and sideloading apps should work again.
If anyone finds a mistake in those instructions please tell me! Thanks
And please tell me if it worked
Click to expand...
Click to collapse
Is it possible to enable a custom notification sound via a reg edit in the omnia 7 running 7720 chevron unlocked? Maybe someone can make a prov file and instructions...
Well, maybe it's possible but I'm not really sure what you mean But I'm aware of provxml's capabilities, how to build them and how to set up the phone, so maybe I can help you
Thanks... I read somewhere that with a registry key we can change the path of the notification sound... This way we dont need to overwrite the original .wav... I believe this might be the only way to do it in mango since homebrew is blocked...
Need to check the registry key thread for this one, since i dont really know much about this...
Dehydration Hack
I have used this method to unlock and remove the side load limit on my HD7 and it works great. I am unsure how to create a file to turn the dehydration hack on and then off again after I have updated all the way to 7720. I used the HTC Connection setup once I fully updated, I have touch explorer I just have no clue what to do for the dehydration can anybody help me?
On HTC devices you can't create a simple switch to enable / disable the dehydration hack because once you've ran the HTC connection setup the provxml files will be deleted. But if you don't want to switch that often between on / off you can use this tool:
http://forum.xda-developers.com/showthread.php?t=907971
You'll have to create two .rgu files:
First one contains this:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\TaskHost]
"DehydrateOnPause"=dword:0
Second one contains this:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\TaskHost]
"DehydrateOnPause"=dword:3
Then you have to convert them to .provxml files. Put the first one in a folder called "Enable dehydration hack" and the second one into a folder called "Disable dehydration hack". This way you can't mess it up
Then use the tool mentioned above to deploy the .provxml which contains the setting you want to have on your phone - then finally run the HTC connection setup
For example you've enabled the dehydration: To disable it again you have to put the CustClear.provxml from "Disable dehydration hack" into the XAP file from xboxmod and deploy this XAP to your device. Then run HTC connection setup again and the changes will be applied - Dehydration hack will be turned off
Please tell me if it worked for you / helped you,
experience7
experience7 said:
On HTC devices you can't create a simple switch to enable / disable the dehydration hack because once you've ran the HTC connection setup the provxml files will be deleted. But if you don't want to switch that often between on / off you can use this tool:
http://forum.xda-developers.com/showthread.php?t=907971
You'll have to create two .rgu files:
First one contains this:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\TaskHost]
"DehydrateOnPause"=dword:0
Second one contains this:
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\TaskHost]
"DehydrateOnPause"=dword:3
Then you have to convert them to .provxml files. Put the first one in a folder called "Enable dehydration hack" and the second one into a folder called "Disable dehydration hack". This way you can't mess it up
Then use the tool mentioned above to deploy the .provxml which contains the setting you want to have on your phone - then finally run the HTC connection setup
For example you've enabled the dehydration: To disable it again you have to put the CustClear.provxml from "Disable dehydration hack" into the XAP file from xboxmod and deploy this XAP to your device. Then run HTC connection setup again and the changes will be applied - Dehydration hack will be turned off
Please tell me if it worked for you / helped you,
experience7
Click to expand...
Click to collapse
Should be
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\TaskHost]
"DehydrateOnPause"=dword:0
I've edited my imageres.dll file and have it all nice nice, but when I try to paste it into system 32 (tried safe mode) It will not let me overwrite that file.
I've tried Safe mode, Taking Control, Granting full control permissions of file, system32 folder, windows folder, and C folder (both taking control, and granting full permissions to: User (me) and Administrator (also me) Yes, i'm on windows 7 64bit but there is no Win 7 Forum here, however the imageres.dll is mentioned here, and I'm assuming the file is more-or-less the same. Besides taking ownership in C for Win 8 being bad? I did this to both System32 file and Syswow64 file- its now apparent to me that both are in USE and thats why I can't overwrite/modify them =/ So how do I use my modded one? (startup sound etc.)
Following this:
Code:
How to Take Ownership in Windows 7
1. Locate the file or folder on which you want to take ownership in windows explorer
2. Right click on file or folder and select “Properties” from Context Menu
3. Click on Security tab
4. Click on “Advance”
5. Now click on Owner tab in Advance Security Settings for User windows
6. Click on Edit Button and select user from given Change Owner to list if user or group is not in given list then click on other users or groups. Enter name of user/group and click ok.
7. Now select User/group and click apply and ok. (Check “Replace owner on sub containers and objects” if you have files and folder within selected folder)
8. Click ok when Windows Security Prompt is displayed
9. Now Owner name must have changed.
10. Now click Ok to exist from Properties windows
Once you have taken the ownership of file or folder next part comes is Granting Permissions to that file/folder or object.
How to Grant Permissions in Windows 7
1. Locate the file or folder on which you want to take ownership in windows explorer
2. Right click on file or folder and select “Properties” from Context Menu
3. Click on Edit button in Properties windows Click ok to confirm UAC elevation request.
4. Select user/group from permission windows or click add to add other user or group.
5. Now under Permission section check the rights which you want to grant i.e check “Full Control” under the “Allow” column to assign full access rights control permissions to Administrators group.
6. Click Ok for changes to take effect and click ok final ok to exit from Properties window.
Now you can access files of folder in windows 7 with full permissions and take full control.
also tried cmd prompt
Code:
takeown /F "C:\Windows\System32\imageres.dll"
with Sucess message (probably the same as my right click takeown reg file context thing)
I'm the only person/login/user on my PC. Ugh this is a pain in the butt. No matter what I've googled/tried hasn't worked. I don't have a linux CD/USB boot *(dunno if I do? but don't think I do) to repair/replace file, I may have Win 7 repair on my CD, maybe not.
EDIT: replacing the startup sound in imageres.dll in System32 and SysWOW64 folders still leaves me with default windows startup sound =( Only other file was imageres.dll in winsxs folder- copied, edited the copy, deleted the original with Fileassassin (it was locked, wouldn't edit, blah blah) STILL uses old windows start up sound, WHyyyyyy? theres MUI files with info for imageres.dll but IDK what's left where this sound exists =/ or where its coming from.
there used to be this program made for replacing system files
i don't remember its name, though
http://www.askvg.com/right-click-re...utility-to-replace-system-files-in-windows-7/
No manual methods worked for me, but just came across this and it worked, WOOT!
http://winaero.com/download.php?view.10
Starting with Windows 8, the administrator is no longer the same as root. Microsoft has very, VERY severely limited the administrator's abilities with many aspects of the system. This was done in an ill-conceived notion that they could curb piracy of Windows Store apps (like there's anything worth stealing in there, including games). People have already found a way to pirate Windows Store apps, so it was all just a way to irritate admins and hobbyists in the end.
@dragon_76: Care to explain what you mean by that? For one thing, Administrator on NT has never been "the same" as root (on POSIX); there's always been the local SYSTEM SID (which does some of the things which root would handle, such as being the process that drivers and initial user-space processes run as) and while I'm not entirely sure when the TrustedInstaller SID was added (may have been there since NT3.1 for all I know), it's been a part of Windows since well before Win8. For another thing, unlike root on a POSIX system, Administrator does not (and never has) automatically have access to everything; it's a SID like any other, and ACLs can be put in place to control its access.
Now, two powers that Administrator (and members of the Administrators group) do have are as follows:
1) Take ownership of any securable object (this allows completely overwriting the ACLs).
2) Impersonate any other SID (although some, like TrustedInstaller, are possibly trickier to impersonate in Win8 than they used to be; I need to investigate that).
If what you're complaining about is the fact that \Program Files\WindowsApps\ is now owned by TrustedInstaller and harder to mess with than you'd like, um... sorry? It's not *that* hard to take ownership (or set it back) from TrustedInstaller; you can do it as Admin, in fact.
*Ahem*
Back to *actually* being on-topic, older versions of Windows* had a background service that would undo any modifications to system files by replacing them with un-tampered copies from a backup location. Starting with Vista, such a service supposedly no longer exists, but it would be easy to implement something like it using VSS. So, you should verify that the file isn't being reverted. The simplest check is the modify timestamp and (if it's different on your file than on the stock one) the size. Somewhat more advanced is to use a hash function, such as MD5 or something from the SHA family, on the on-disc file and see whether it matches the version you put there.
Beyond that, you can easily replace system files if you do it while the OS isn't booted. Linux can do it, although that has risks. Better is to use WinPE (the Pre-installation Environment that bootable Windows disks and recovery tools load) and replace it from there.
Incidentally, you can use the command line tool icacls (which may even be present in WinPE by default) to both change ownership and set permissions on files and folders.
* Pre-Vista, which was the first version to switch to using TrustedInstaller to protect system files rather than letting Admin write to them by default. That's the last major change I'm aware of in the powers of the Administrator account on Windows, incidentally...
Not sure if I have anything worth while, but ASUS left a "Tools" folder on my desktop...attached a screenshot of what it included.
phxtravis said:
Not sure if I have anything worth while, but ASUS left a "Tools" folder on my desktop...attached a screenshot of what it included.
Click to expand...
Click to collapse
Can you please zip that and upload them?
Yeah please zip it up and upload them so we can see what it's doing.
Yes, ZIP them please - the auditmode files are for sysprep audit mode, securebootdebug - are probably from microsoft HCK and add debug key to key storage (so you can run testsigned apps), FWVar - probably allows editing UEFI firmware variables (I've already made the same tool myself), everything is interesting of cause.
Here you go
Thank you for the tools.
SetAuditMode/ClearAuditMode - clears the sysprep audit mode (useless)
setup.cmd, SecureBootDebug* - installs "secure boot debug" policy. I.e. allows running of testsigned (or unsigned) apps. More info: http://msdn.microsoft.com/en-us/library/windows/hardware/hh998740.aspx
Securebootdebug needs the signed policy file. It is probably left on your device too, as "tools" directory is not erased. To obtain it - run CMD or powershell as administrator, then type there: "mountvol S: /s" without quotes. This would assign S: to your BCD partition. There should be SecureBootDebugPolicy.p7b file. Please share it too
To dismount disk S: after copying that file - type "mountvol s: /d"
reset.cmd - this file would delete the tools directory and all other files reverting things back.
hsc.vbs, pdq.vbs - tiny support scripts for reset.cmd
FWVar.exe - writes firmware variables. Not UEFI vars that are documented, but it plays with some other asus-specific vars like sensors calibration and platform IDs. Would be interesting to decompile it
mamaich said:
Thank you for the tools.
SetAuditMode/ClearAuditMode - clears the sysprep audit mode (useless)
setup.cmd, SecureBootDebug* - installs "secure boot debug" policy. I.e. allows running of testsigned (or unsigned) apps. More info: http://msdn.microsoft.com/en-us/library/windows/hardware/hh998740.aspx
Securebootdebug needs the signed policy file. It is probably left on your device too, as "tools" directory is not erased. To obtain it - run CMD or powershell as administrator, then type there: "mountvol S: /s" without quotes. This would assign S: to your BCD partition. There should be SecureBootDebugPolicy.p7b file. Please share it too
To dismount disk S: after copying that file - type "mountvol s: /d"
reset.cmd - this file would delete the tools directory and all other files reverting things back.
hsc.vbs, pdq.vbs - tiny support scripts for reset.cmd
FWVar.exe - writes firmware variables. Not UEFI vars that are documented, but it plays with some other asus-specific vars like sensors calibration and platform IDs. Would be interesting to decompile it
Click to expand...
Click to collapse
I was unsuccessful at finding the file, I wiped the tablet yesterday as it was running like crap(freezing, and wouldn't download updates), not sure if that wiped what you are looking for.
OK, I see what that setup.cmd file is doing. It generates an unsigned SecureBootDebug.p7b file authorizing full debug unlocking for the particular serial number of your device - the -u switch to createsecurebootpolicy.exe locks it to your device. It then sends that file to a server aptly named "\\secureboot" on ASUS's internal network and waits for a reply. Sometime later, a signed version of that file appears on that server's share, and the Vivo RT copies it to the EFI system partition to use with SecureBootDebug.efi.
After the service center does what it needs to do, they run reset.cmd, which deletes the Secure Boot policy from EFI NVRAM at next reboot and deletes SecureBootDebugPolicy.p7b from the EFI system partition.
phxtravis said:
I was unsuccessful at finding the file, I wiped the tablet yesterday as it was running like crap(freezing, and wouldn't download updates), not sure if that wiped what you are looking for.
Click to expand...
Click to collapse
If you had not done that, we could have made an image of your EFI system partition and recovered the deleted SecureBootDebugPolicy.p7b file, which would have permanently jailbroken your Vivo RT forever. Sadly, it was locked to your device. What method did you use to wipe it? Did you ask it to repartition your system?
Myriachan said:
OK, I see what that setup.cmd file is doing. It generates an unsigned SecureBootDebug.p7b file authorizing full debug unlocking for the particular serial number of your device - the -u switch to createsecurebootpolicy.exe locks it to your device. It then sends that file to a server aptly named "\\secureboot" on ASUS's internal network and waits for a reply. Sometime later, a signed version of that file appears on that server's share, and the Vivo RT copies it to the EFI system partition to use with SecureBootDebug.efi.
After the service center does what it needs to do, they run reset.cmd, which deletes the Secure Boot policy from EFI NVRAM at next reboot and deletes SecureBootDebugPolicy.p7b from the EFI system partition.
If you had not done that, we could have made an image of your EFI system partition and recovered the deleted SecureBootDebugPolicy.p7b file, which would have permanently jailbroken your Vivo RT forever. Sadly, it was locked to your device. What method did you use to wipe it? Did you ask it to repartition your system?
Click to expand...
Click to collapse
I did the "remove everything and reinstall windows" option in settings.
phxtravis said:
I did the "remove everything and reinstall windows" option in settings.
Click to expand...
Click to collapse
It *might* still be there then if we take an image of your EFI System Partition and search it manually with a hex editor. There are definitely no guarantees, though. Also, this would likely reveal your device's serial number to whoever you give the image to. It probably would *not* have any other information, though, like personal documents or your Windows RT CD key--those're on the main partition.
If this file were found, I think it would permanently jailbreak your device - Windows RT would let you run whatever unsigned code.
The SecureBootDebug.efi tool needed to use this .p7b file is also part of the publicly-available final 8.1 Windows Driver Kit. The one in your .zip file looks like the 8.0 version.
Myriachan said:
It *might* still be there then if we take an image of your EFI System Partition and search it manually with a hex editor. There are definitely no guarantees, though. Also, this would likely reveal your device's serial number to whoever you give the image to. It probably would *not* have any other information, though, like personal documents or your Windows RT CD key--those're on the main partition.
If this file were found, I think it would permanently jailbreak your device - Windows RT would let you run whatever unsigned code.
The SecureBootDebug.efi tool needed to use this .p7b file is also part of the publicly-available final 8.1 Windows Driver Kit. The one in your .zip file looks like the 8.0 version.
Click to expand...
Click to collapse
Not sure if I am sold on jailbreaking, what's the advantages other than being able to run "hacked" exe's? Aslo, what would you need me to do?
The EXEs are not "hacked" in any proper sense of the word, just recompiled. Sometimes some changes are needed, but they're usually basic. It lets you run (normal) Windows programs. .NET programs run as-is, native ones need to be ported (usually a pretty simple recompile, if they built under Visual Studio in the first place, but we need the source code), and it unlocks full Powershell scripting power. Programs written in other languages, like Python and Java, can be run using ported runtimes. In fact, it's even possible to run some x86 programs (unmodified Win32 native EXEs) via a dynamic recompilation layer written by @mamaich here on XDA; I can play some old games and run some nice old programs that I like that way.
phxtravis said:
Not sure if I am sold on jailbreaking, what's the advantages other than being able to run "hacked" exe's? Aslo, what would you need me to do?
Click to expand...
Click to collapse
Hacked EXEs?
No hacking. We legally take the source code for a program and compile it for win32 in THUMB_2 instead of win32 on x86. You can then run these desktop applications on your lovely ARM tablet as you could on a normal windows PC. That is an absolutely huge advantage which should have been a default option.
Quake alone makes it worth it.
I didn't mean to use "hacked" in a negative context, merely meant it as a general term of modifying original EXEs to run on ARM, I haven't been following the RT jailbreaking at all.
Can't modify an existing EXE. Totally incompatible (unless its a .NET application in which case no mods needed). Need to rebuild the EXE and any supporting libraries from source.
phxtravis said:
Here you go:
https://docs.google.com/file/d/0BzebTu1H3-aIbXlTV09BMjZsLVk/edit?usp=sharing
Click to expand...
Click to collapse
This requires approval. Does anyone still have a copy?
jordanmills said:
This requires approval. Does anyone still have a copy?
Click to expand...
Click to collapse
It doesn't require approval
Curiously, there is a Secure Boot debug policy creator ,signed by Microsoft for ARM but sadly not generating signed policies...
It may be used for jailbreak as the other tools are unsigned(most of them) if there is a bug allowing to load a unsigned policy somewhere(there should be one)
Will try downloading the HCK to see if there is something useful there
black_blob said:
It doesn't require approval
Click to expand...
Click to collapse
Hmm, it doesn't now. But there doesn't seem to be any way to download the whole thing. It only shows individual files.
jordanmills said:
Hmm, it doesn't now. But there doesn't seem to be any way to download the whole thing. It only shows individual files.
Click to expand...
Click to collapse
There is the download button at the top