Develop Bugs

unlock CE 6.0 of Windows Phone 7? Is this will help?

Hi
I thought this may be useful to our gurus in development. I am sorry if it is wrong place to post.
Is this a way to unlock CE 6.0 of Windows Phone 7? This I have seen in endgadget. This brings the native CE explorer in Zune. can we use this to bring file explorer in WP7?
Links:
http://www.zuneboards.com/forums/download-openzdk-applications/54495-liberate-explorer-zune-hd.html
http://www.engadget.com/2010/11/01/liberate-for-the-zune-hd-unlocks-hidden-windows-ce-potential/
Thanks,
Ravi

I can't find the source for that exact project (if you have a link, please post it), but I've spent a lot of time looking at the OpenZDK exploit source code, trying to adapt it to WP7.
There are a couple problems. The first is that you need to be able to install an app on the phone in order to get the exploit to work. Zune already allows you to install third-party apps, so the only problem they had was how to break out of the XNA/managed/C# jail. Then they can distribute the breakout as an executable, and anyone can run it. That won't work on WP7 because the only way to install a third-party app is if you have a developer license and the sourcecode. Or you can download it from the app store, but obviously Microsoft isn't going to allow exploits onto the store (they even have automated checking for the kind of exploit they have over at Zuneboards).
The second problem is even if you were able to run random apps on WP7, the exploit still wouldn't work. Microsoft has gotten a lot more serious about security on WP7, and they've closed off all the easy hacks like that (as far as I can tell, of course I'll keep looking). They didn't take security so seriously on WP7, and accidentally gave developers access to an unsafe memcpy(). In WP7 they have a much more robust security model, and closed that off. Which is sad.
I haven't been able to get pInvoke to work on WP7, or even use pointers. You can get the compiler to generate unsafe code, but the runtime on the phone crashes when it comes to any pointer. pInvoke might theoretically work, it's possible I've just been using it wrong, but I've tried a lot of different things and haven't gotten it to work.

Oh yeah, I found the announcement here:
http://www.zuneboards.com/forums/zu...-your-zune-new-version-includes-keyboard.html
Says it's built on openZDK, which means it is using the memcpy() exploit, and my last post wasn't completely off

athompson said:
Oh yeah, I found the announcement here:
http://www.zuneboards.com/forums/zu...-your-zune-new-version-includes-keyboard.html
Says it's built on openZDK, which means it is using the memcpy() exploit, and my last post wasn't completely off
Click to expand...
Click to collapse
I am really sorry, because most of the things you said, i'm not understanding, because I am not a professional developer or for that not even near to that area of coding (am a Pharmacist... my highest knoweldge is little HTML coding).
I am wondering is this will help in any way to access file system in WP7 and build an file explorer kind of app or can we install Totalchrom or resco file explorer kind of app??? using this can we enable bluetooth ftp or internet file download kind of options?
Thanks

lol ya, I guess I should have started with the executive summary. In short, my assessment is no, it doesn't help, because Windows Phone 7 is too different. I really wish it did help.

athompson said:
lol ya, I guess I should have started with the executive summary. In short, my assessment is no, it doesn't help, because Windows Phone 7 is too different. I really wish it did help.
Click to expand...
Click to collapse
+1, unfortunately this won't help us at all.

What we need to do...

Hello,
I just got my kin two the other day but have been doing research on hacking it for a couple of weeks now. I am no hacker or programmer but do have some knowledge. I think we need to look at things in a couple of ways based on what I have been seeing in regards to what is working and what isn't.
The most promising thing I have seen so far is a zune hack. This phone is basically a zune with a phone. Windows CE and Tegra APX 2600. I was also successful in viewing the files on my kin two in windows explorer as a flash drive using the same hack that was available for the Zune. The Zune has been jailbroke. We should be able to do the same on this phone. One thing I was looking at is the XNA development kit from Microsoft that is used to program for Zune. There is a glitch in it that allows free access to Windows CE on the Zune. If we could get this program to recognize the Kin Two as a Zune, I believe we could get in!
Another option is finding an exploit (possibly in the browser). Run some javascript which executes some shell code allowing us access to the phone. This is basically a "drive-by-download" which has been done many times on pc's.
I am more interested in looking into the similarities with the zune at the moment but one thing is for sure, we do need more interest in this phone. I recommend asking experienced programmers on hacking forums or anywhere. Also... college computer science and software engineers are always in need of projects. Many times you can talk to the department head and a student could work on it for a project. So, if you have a college in your area, go talk to them. We need to spread the word and get people interested in the possibilities of this phone!!!
Lets hack this thing!!!!!

Have you guys tried asking help from Olipro or Cmonex? These guys are masters at creating HardSPL on Windows Mobile, maybe they can help out with this? It might even be a challenge for them.

NeoS2007 said:
Have you guys tried asking help from Olipro or Cmonex? These guys are masters at creating HardSPL on Windows Mobile, maybe they can help out with this? It might even be a challenge for them.
Click to expand...
Click to collapse
Counting that the above it's true, the problem is that we still have no drivers nor known way to "flash"/write the "created" HardSPL or a ROM on the device.
At least not that i know (no experience on the topic).
If they also find a way to do so, i could do nothing less than bow em.

We shoudl try and find some of the actual M$ devs that worked on this project. Surely they are angry about how things turned out and would be willing to dish Anyone seen any docs listing developers?

One word: NDA
Anyway, you dont need any docs, you could find most of them just doing google searchs.
"site:linkedin.com kin phone"
Meh.

KIN Software Wishes.

hey guys, i don't know a thing about programming, but i have a question. instead of trying to put android on the device and going through all that trouble, is it at all possible to integrate an on screen keyboard onto the device ?

Thats what I need. Im getting sick of sliding my phone open. I want a landscape qwerty keyboard (android style) and same as for portrait mode. thats the only downfall this phone needs!

no, it's not possible as we A) cannot access the kinOS code, and B) know virtually nothing about how the kinOS works. android is several times more feasible.

so then is it probable that there could be an onscreen android keyboard integrated with the android os ?

wasserman11 said:
hey guys, i don't know a thing about programming, but i have a question. instead of trying to put android on the device and going through all that trouble, is it at all possible to integrate an on screen keyboard onto the device ?
Click to expand...
Click to collapse
your acting as if putting a keyboard on this device will let it do everything everybody wants...and anyways, if we cant even take of a file from the device, how will be even begin to integrate a keyboard that will work with this odd OS? Please read forums to figure out what is possible

soninja8 said:
...if we cant even take of a file from the device, how will be even begin to integrate a keyboard that will work with this odd OS?...
Click to expand...
Click to collapse
This.
Till now we are not able to fetch a file from the device without using Zune (which is cool looking software to me, but tooooooooooooooooooooo complex for the task) in windows or the macspace app on Macs.
Furthermore, if you try to make a lame hijacking test, renaming a mp3 to image or the opposite (like "image.mp3"), the Zune software detects it, before you sync, so outta luck.

Kin & Xna Framework 3.1 (prev. Random Madness)

Hey, i was playing a bit with some files here and there, so i faked Xna to believe that kin was a zune (i'm a ninja) and then becoming asleep when suddenly i launched the first non-official app on the kin.. although it didn't work.
It's the result of a bad deployment of a XNA game template, which runs till the loading part, where it's broken and does nothing.
On the other hand, it's listed on the recent apps tab, and i was able to re-do the deployment. I wasnt able to redo after some time, even rebooting the Kin.
Yup, i know it does nothing but... makes you wonder if working apps can be made and yak yak yak.
Fyi, i was able to reboot succesfully but the app must be in a temp space, cause it didnt showed anymore nor in recent apps, nor in the menu. Kino showed me that there were no further files, other than mines.
i thought that a video would show things that are real and ... well.. all. So it's attached.
I wont tell how it goes in the very end till i'm able to reproduce it, and also, cause i *cough* modified *cough* some file in my windows to do so (not distributing them, for legal reasons and so). In any case, i would just tell how to get the same file, through a process.
I h4ck3d this thing, now, where are my cookies? (just kidding)
Edit:
Disclaimer
Ha! Before doing anything, this is going to scr*w your XnaFramework 3.1 Zune capabilities, so.... backup first, backup first... did you backup?
Ha 2.0. This is you, doing it personally. If it's not legal there (?) i take no responsabilities from what you do. If you crash your windows/zune/kin... i won't pay it.
Procedure
- Install Visual studio 2008 c# express (or 2008 if you have it... legally and so on) for free from microsoft.
- Install the Xna framework 3.1 (I also installed 4.0 but... it's not going to work for other tests i wanna make... so.... i wouldnt do it)
- Install the Xna framework 3.1 zune extensions
- Install a hex editor ... my favourite is HxD but others, like ultraedit32 or... [insert other here] will work. Notepad is not a hex editor.
- Look for "XnatransZ.dll" under "c:\program files\common files\microsoft shared\xna" (or just common files will only have one or two inside). There are Am64 folders with it (64 bits) and X86 (32 bits), of course, you are going to edit the one you use and so....
- Backup... remember to backup... backup... man, do a backup. Then open the file
- Search for the following HEX pattern: 5a 00 75 00 6e 00 65 00 00 00
(which is "Z.u.n.e..."). Make sure that on the right side on HxD shows Zune alone and not "Z.u.n.e.D.e.v.i.c.e.", or so. Replace it (overwriting left side on Hxd) with: 4b 00 49 00 4e 00 00 00 00 00 (which is "K.I.N....")
- Save the file.
- Now use the xna device center to add a new device, and pick a Zune (yup, a zune). Kin will appear there if done correctly.
Explanation
Why this change? Well, seems like it's pretty much stupid things around.
First i thought that as there were only a few models of zune, the xna would have the PID and VID values for their devices.
Then through *magic process* i saw that it just looked at the "Zune" text and compared it with the devices on the system. So i changed the zune driver info to name the Kin as "Zune" (haha smart approach huh!) but the Zune software is sooo smart, that it changed the device name under device manager... Wow!
So... i checked that file and ... through *magic process* i found out that it checked the devices statically (using "Zune"), so as i couldn change my device name, i turned that string into ours: "KIN" and.. magic worked...
Surely, not going to help us... but it's kind of a weird thing that it worked "as is" (Xna detects the phone as compatible) even if later it says that the needed runtimes werent present at the phone (it's ok, the files for gaming aren't probably on the kin).
That means that microsoft could modify the Xna to let development on the kin, but was out of it, not the kin market i guess.

hmm.. if this XNA application doesn't appear on first page... then how did you launch it in the first place?
Any way of receiving already made apps?
You wrote to phone's unreachable memory?
Tutorial?
Too many question? umad?

Try to get one of the phones apps and see how they are coded so you can get one to launch

Antonpup said:
hmm.. if this XNA application doesn't appear on first page... then how did you launch it in the first place?
Click to expand...
Click to collapse
Deployment launched it if i had the device connected, in a non error state, and with the screen showing the home (apps) window. IF it was with the screen turned of, it didnt showed anything (quite meh). Then i realizzed that it was on the recent
Antonpup said:
Any way of receiving already made apps?
Click to expand...
Click to collapse
Who knows yet?
Antonpup said:
You wrote to phone's unreachable memory?
Click to expand...
Click to collapse
Not sure of where this app went, must recheck at night
Antonpup said:
Tutorial?
Click to expand...
Click to collapse
When is repeatable or a working thing. I said, i modified files which is not the same as redevelop things. this is clearly a hack (of the files,not the device itself).

Great to hear of more potential progress here.
I'm curious, JohnKussack... was it my comment about XNA a while back that led you in this direction?
Marcellus1 said:
Would Zune apps loaded through KinO run? What about XNA apps?
Click to expand...
Click to collapse

Marcellus1 said:
Great to hear of more potential progress here.
I'm curious, JohnKussack... was it my comment about XNA a while back that led you in this direction?
Click to expand...
Click to collapse
Unfortunately, not. I was inspecting the Xna software for about 1 day or more before posting this. A few days before your post, i was able to upload anything with KinO and tried it without success.
This comes from *other* ways, which we have no idea about how they work. I will skip the part where i found how it all works when looking for a "Zune".
I've been experimenting with all the kin related test for a year (not continuosly) and went curious about "why Xna device center doesnt recognize the kin?". The answer is pretty much stupid: because it looks for the Zune.
I updated the first post about how to operate with the Xna framework, although it doesnt let you do anything, it's a lame thing.

Pretty cool findings, man. So are you able to duplicate this on both the TWO and TWOm versions of the OS? Are the results the same?
(actually, I don't even know if your current working device can be switched between the original and M versions of the OS)

klamation said:
So are you able to duplicate this on both the TWO and TWOm versions of the OS? Are the results the same?
(actually, I don't even know if your current working device can be switched between the original and M versions of the OS)
Click to expand...
Click to collapse
I prefer not to play Russian Roulette with RB+power option, and getting a kintwo or a brick atm. If i was on verizon coverage area... mmmm might be. I'm getting this on my new phone, which is a Kin Two M (2 yellow dots model to be exact)
I will try to send programs till i figure out what could work or i get bored. In the end... microsoft abandoned the kin, so unless we test things... we'r stuck with the phone.
maybe one of this lame programs lets us read(even only reading) the normal filesystem.
In any case... i will try some helloworld!

I could kiss you right now

johnkussack, I've been reading all of your posts on here and... wow. I'm amazed at your knowledge and how much you have been able to figure out. You are so close to getting apps on this phone!
I know nothing about Windows hacking/development, but I have had experience with Android development on old WM6 devices. The hardware on this phone is capable of running android, the only thing stopping it is not being able to test the builds. If you figure out how to get apps to launch, one of the ones I suggest you put on your list is Haret.exe, then maybe we can send the android files to the phones storage and... well, I'm rambling on and on right now. Anyways, here's what I am thinking after reading all that you have done:
On my old Env2, the device was locked to only run BREW games, which was a pain because you can't torrent them Flash games couldn't be launched from the SD card or the internal memory, but some genius figured out that the calculator and the world clock were flash apps. So by connecting your phone to your PC and using bitpim (at least I think it was bitpim) you could replace the world clock or calculator with 2 flash games, like pac man.
So, I'm assuming that the apps already on the Kin are .exe or something, couldn't you just replace the calculator on the kin with a file system explorer?
You probably know all of this, I hope this post helped in some way and didn't just waste your time...
Good Luck! - Jeff

Jemilio3 said:
...So, I'm assuming that the apps already on the Kin are .exe or something, couldn't you just replace the calculator on the kin with a file system explorer?
You probably know all of this, I hope this post helped in some way and didn't just waste your time...
Good Luck! - Jeff
Click to expand...
Click to collapse
The main complication with this is, we haven't found any way to get access to the main file system of the phone (the one containing the Windows Mobile OS files). BitPim gives access to one small area, and MTP (using John's KinO software) gives access to another area.
If we could find a way to gain access to the main operating system of the phone, then we're almost assured victory.

@Jemilio3 Thanks for the compliments hehehe.
As was very well explained by Klamation, we do not have access to the filesystem where the OS is (at least for now), we are kind of stuck with what we have.
From my past experiences with a win mobile 2003 pda, the system will be a fixed rom memory, user available space (configuration & temp values) and a storage card (our storage now).
So when we CB reboot the kin, just configuration & storage are cleaned.
I'm still operating on what to do with my pc, the disk is half dead, but isnt sata, so no replacement easily... reinstalling on another external disk to test things....tomorrow
There are several things to test by now:
-test for deployment tools on the xna3.1
-deployment of apps using xna 3.1 and openzdk deploy tools
-xna 3.1 deployment with visual studio (for ages testing)
.... a lot hahaha

It's very strange that the device is so locked down. Music and videos sync to the main memory, right? Maybe the solution isn't to hack the device, but to hack the program that syncs the music.
I wish I could help with the testing, but the only Kin I have access to is my dads, so I can't mess with it. Maybe I will call the people who made the Kin and see if they will help us.

Jemilio3 said:
Maybe I will call the people who made the Kin and see if they will help us.
Click to expand...
Click to collapse
We already tried this. Microsoft, Sharp, and Verizon didn't help much. They mostly dropped support for the phone.

Jemilio3 said:
Maybe I will call the people who made the Kin and see if they will help us.
Click to expand...
Click to collapse
Antonpup said:
We already tried this. Microsoft, Sharp, and Verizon didn't help much. They mostly dropped support for the phone.
Click to expand...
Click to collapse
You are more than welcome to call. Past experience is you'll get a run-around of people telling you to call the other company, if you're lucky.
I've tried calling a few people (within Verizon) and basically reached dumb tech support people. (minor rant, how can you work in tech support when you are a self-proclaimed "non technical person"??)
If you do contact anyone more than the customer service and tech support staff with no information, like somebody who advises you to contact somebody else, please take note of whom they say to contact, and their own name/contact information. If we can actually get the right people, or at least get a lead on the right people to contact, maybe we can make progress within the companies.

@John
If you ever need parts or anything im sure all of us on here are willing to help, including me.

Jemilio3 said:
Maybe the solution isn't to hack the device, but to hack the program that syncs the music.
Click to expand...
Click to collapse
That's what KinO is for .
The OS memory and the music/pictures/etc storage is different, so only apps should be able to use it.
@soninja Thanks . I guess that i will use one my several external disks instead the zombie one, but yesterday i had to classify ~200gb of info & videos into others before formatting it and reinstalling linux. My data inside was a mess rofl so it took about 4 hours.
In any case, thanks to awesome71717 & some random analysis i did on the kin mtp, i saw that most of the MTP commands used on the Zune HD app deployment are present on the kin MTP commands list, so at least deploy is available, even if it's not using XNA code, but c# code or so.

I know this might be a stupid question (this is really my 1st phone I've ever worked with)
but is there a way to push an XNA framework to the kin or something along those lines or would that just be pointless work?

jthree2001 said:
I know this might be a stupid question (this is really my 1st phone I've ever worked with)
but is there a way to push an XNA framework to the kin or something along those lines or would that just be pointless work?
Click to expand...
Click to collapse
Probably easier to just test what works from the xna or c# examples. I dont want to deal with microsoft things more than needed. Legal issues and that things. I try to draw a line there.

I'm not 100% sure I understand how this all works but have we figured out how the browser adds links to the main menu? Or possibly where this is located?
What are we able to access at this time?
Heratiki

kin ui in silverlight

according to certain websites, the kin ui was made in silverlight. whether this is true or not i dont know. however i just wanted to say that i will be working on a new kin design interface and will be possibly making a website for it if it works okay. all support is appreciated.

Yes, everything points to the Kin menu being Silverlight-based, however, the IEmobile 6 browser on the Kin does not support Silverlight.

possible solution
hmm... maybe i could make the ui in silverlight, save it as a file, and redo the programming in some like visual c++ or visual c#. we need to find out how microsoft did it and retrace their steps our way.

The biggest complication is just that we don't have access to the Kin OS files. If we did, then it would be almost easy to modify what's already there.

I'll try anyway
im gonna see if i can break in...im good at that so this may not be that difficult.

Good luck with that. Seriously, lol.

........... Guys, guys. This stuff is a lot harder than it looks, take it from someone whos worked on this for a long time. ITS TOUGH! We have none of the neccesary codes and system access for a clean succesful break in. Just slow down a little ok.

Good luck to anybody who tries to crack this phone but I would like to mention the fact that if you can jailbreak a itouch does not mean that you can hack into this phone.

BitPim alternatives
Anybody know any good alternatives to BitPim? I need something like it that is centered around the file system. I may have just figured out how to hack this phone, but I need something better than BitPim for it to work.

X-15D9W8491 said:
Anybody know any good alternatives to BitPim? I need something like it that is centered around the file system. I may have just figured out how to hack this phone, but I need something better than BitPim for it to work.
Click to expand...
Click to collapse
I would suggest that you make a thread about your question so people can see your question
Sent from my ADR6300 using XDA Premium App

The Issue
X-15D9W8491 said:
Anybody know any good alternatives to BitPim? I need something like it that is centered around the file system. I may have just figured out how to hack this phone, but I need something better than BitPim for it to work.
Click to expand...
Click to collapse
I believe this is at the core of the issue. There is nothing that can access the "file system" other than what media we store. If there was anything better it would already be hacked. I believe we are going in circles here. If we can get into the "file system" it's hacked.
This is what I know accesses the phone so far(none are hacks):
* Zune software
* Qualcomms QPST(scary)
* KinO(johnkussack's closest to a hack)
* BitPim
Are there anymore to add to the list?

gerrypw said:
I believe this is at the core of the issue. There is nothing that can access the "file system" other than what media we store. If there was anything better it would already be hacked. I believe we are going in circles here. If we can get into the "file system" it's hacked.
This is what I know accesses the phone so far(none are hacks):
* Zune software
* Qualcomms QPST(scary)
* KinO(johnkussack's closest to a hack)
* BitPim
Are there anymore to add to the list?
Click to expand...
Click to collapse
If you're on a Mac, MarkSpace has a Kin sync program. It's basically like Zune software excluding DRM content, but also has a pretty simple browser program to access the folders (not the root folder, where the contact XML file would be found).
There are other MTP explorers out there, that will actually show you the content of the phone. However, in my testing, none of them will allow you to read or write content.
Basically, if the phone is in MTP (default) mode, you only have access to the media, and not to the OS space on it. We'd need a driver to use one of the other USB modes.

ok
ill make a new thread...