[Q] Dump Memory from Mango Phone / Extract Data From Backup? - Windows Phone 7 Development and Hacking

I haven't found anything on the forums about this (I have searched) so forgive me if it's a basic question. Is it possible to either:
1) Dump all data on a mango phone (in my case, a Samsung Focus, no interop-unlock) to a file on my computer, or alternatively
2) Access the data stored in the umpteen files created during a WP7 backup.
If anyone knows how to do either of these things (without interop unlocking -- I have data I need to pull off, but my firmware is too old to get interop unlocked, and I get error messages when I try to manually update the firmware), it would be greatly appreciated.
Thanks,
Beakin
Note: edited to clarify

I doubt it's even possible *with* interop-unlock.
1) A native app could map a large region of memory, but the WinCE kernel uses process isolation (same as every other modern OS) so there's no way for one app to access the full physical memory.
2) They're encrypted with a key that appears to be stored in the device itself. Nobody has yet figured out how to reverse this encryption.

GoodDayToDie said:
I doubt it's even possible *with* interop-unlock.
1) A native app could map a large region of memory, but the WinCE kernel uses process isolation (same as every other modern OS) so there's no way for one app to access the full physical memory.
2) They're encrypted with a key that appears to be stored in the device itself. Nobody has yet figured out how to reverse this encryption.
Click to expand...
Click to collapse
On #1, I should have been more specific -- I meant dump the phone's storage; what's in non-volatile memory, not RAM.

Still no without interop-unlock, then - standard apps don't have the privileges to access the filesystem (aside from a few very specific locations, like their isolated storage folder). That probalby means no access to the storage device itself either, although I admit to not knowing how that works on CE (NT or Linux, but that's it). If the app was initially sideloaded you can use the Isolated Storage Explorer to pull files from that app specifically, but if it's a marketplace app or something built-in like the SMS store, no such luck.
Of course, you can get more permissions if you can call into a driver - which is what ID_CAP_INTEROPSERVICES allows you to do, and ID_CAP_INTEROPSERVICES is why you need interop-unlock. I'd suggest you focus on figuring out why you can't interop-unlock and fixing that. Unfortunately I can't really help you there; I don't have a Samsung phone and the steps to IU an HTC phone are very different.

GoodDayToDie said:
Still no without interop-unlock, then - standard apps don't have the privileges to access the filesystem (aside from a few very specific locations, like their isolated storage folder). That probalby means no access to the storage device itself either, although I admit to not knowing how that works on CE (NT or Linux, but that's it). If the app was initially sideloaded you can use the Isolated Storage Explorer to pull files from that app specifically, but if it's a marketplace app or something built-in like the SMS store, no such luck.
Of course, you can get more permissions if you can call into a driver - which is what ID_CAP_INTEROPSERVICES allows you to do, and ID_CAP_INTEROPSERVICES is why you need interop-unlock. I'd suggest you focus on figuring out why you can't interop-unlock and fixing that. Unfortunately I can't really help you there; I don't have a Samsung phone and the steps to IU an HTC phone are very different.
Click to expand...
Click to collapse
Thanks for the clarification. I've spent the last month trying to figure out how to get the interop unlock working on my phone to no avail, which is why I was changing tact by asking this. Oh well, back to the old drawing board.
BTW if you or anyone know how to take a windows phone firmware CAB file and alter it (removing items) I'd appreciate it. My problem with updating the firmware is that I get a "file name conflict" error pointing to specific items in the CAB. At the risk of bricking my phone, at this point I'd try removing those items and installing it anyway.

Editing a CAB is easy; Win7 Explorer can open them natively and many third-party tools also exist. Editing a CAB so that it can still be isntalled may take a little bit more effort, but the important point is that as soon as you edit it, you'll invalidate the signature on the CAB. That means it will no longer install through the default update-OS at all. On HTC phones, you can use RSPL (or HSPL) to install custom updates, but on a phone with a retail bootloader (such as a Samsung), you can only install official updates.

Related

How to manage RAM without a new ROM?

My Wallaby (with Windows PPC 2002) is too central to my life for me to risk losing it by daring to flash it with a new ROM. This means that new tools, ringtones and things have to go into its mere 32 MB of RAM. On the other hand, this RAM is also cluttered up with "skins", sounds and things (including a version of Windows Media Player that has always resolutely refused to work) that Microsoft, HTC et al. have decided I must have. Mostly if I try to delete them, either using its native File Explorer, or via the cradle with Explorer from my computer (Windows XP Pro SP2, local adminstrator account on the PC), I get an error message, "File in use or write protected", that sort of thing, i.e. I'm not allowed to delete them.
Can anyone help me with the following?
- An explorer tool which will let me see and change attributes and permissions where necessary, and delete unwanted files from RAM?
- Any information on possible Windows PPC 2002 equivalents of accounts, local, administrator, etc.? My unsuccesful attempts to delete files have a distinctly "not local administrator" feel.
Another thing that would be marvellous, would be the option to use the (currently 128 MB) SD card as a sort of hard drive, i.e. to put large executables on to that and start them with something like a shortcut, so that they only load into RAM when they're actually needed. Can anyone tell me any more about whether this is possible, and if so how?
Thanks to all in advance.
you cant delete files in rom of the device and even if you could it would not add more program memory or storage on wallay you can only access the rom at flashtime
and at all other times it's readonly and dont take up any of the ram of your device
Thanks for your reply, Rudegar, but I'm looking to delete things from RAM, for instance \\device\program files\windows media player\*.* Am I wrong to think all this stuff loaded from ROM into RAM after the last cold reset?
Oops, I just discovered I can delete the files mentioned above (and did), from the native File Explorer. However, when I tap and hold \\device\windows\player (the media player executable, presumably player.exe) the "delete" option is greyed out in the context menu.
total commander is way better then file explore
I installed Total Commander, with thanks to Rudegar, and to Lumpistefan for being able to use his site as a hop. It's certainly a better tool for file management, but I'm not yet able to delete files I want to.
Roaring guitar.wav is a sound I particularly hate, and a colleague at work is already using it as his ringtone. Therefore there is no way I want to keep that ringtone in RAM. Total Commander lets me see the attributes, which are Read only, System (and in ROM, grey of course). It seems as if I can "greytick" and untick Read only and System, but when I come back to the file these attributes are there again. If I try to delete Roaring guitar.wav using Total Commander I get the message "Warning! Could not delete 1 file(s)!".
As I said, all this has a very "not local administrator" feel to it.
I tried searching the registry for "roaring" but the string was not found. I also cautiously experimented with switching the values of the following keys between 0 and 1:
HKLM\ControlPanel\AdminPassword\Group
HKLM\ControlPanel\Password\Group
but neither had any discernible effect on the behaviour described. Of course Roaring guitar.wav is just an example (and no offence meant to my colleague), I would like to remove a number of sounds and wallpapers I'll never use, and free up some more of my poor Wallaby's hard-pressed 32 MB RAM for everyday use.
Does anyone know how I could do it?
Hate to tell you this, but if TC says the file is in ROM, its in ROM and you can not delete it.
I am not familiar with Wallaby in particular but I guess the file your are attacking is not copied in to RAM. No reason to do so.
Windows Mobile was never designed for multiple users so no 'local / remote' administrator and stuff. Just trust me when I say this, if you can't delete it - it is in ROM.
There are two programs I can recommend:
MemMaid - it will show you exactly what is clogging up your RAM and automatically clean out what it can.
CabInstl - this little free app will let you choose where to install programs so you can put most of your apps on the SD.
Also in ActiveSync, when asked if to install to default location select 'NO' and you will get an option to install to SD.
One more hint:
You can keep all your themes, including the one you are currently using on the SD. Once you selected and installed the theme the *.tsk file is no longer needed.
When my iPaq was my only and primary PPC I also struggled with 32MB RAM (total). I kept everything on my trusty 512MB SunDisk except what I needed on startup.

[Q] Updating persistent data before hardreset

I'm currently developing a program that basically receives updates and performs them on mobile devices. These are running Windows Mobile 2003.
The update simply consists in a number of files/directories deletes, creates, attributes changes and overwrites (when modified). It's not clever or optimised in any way. But there is a problem.
If the program finds some files need to be modified, the program performs the modification and then immediately makes a kernel call to hard reset the device, so as to reload the OS which is set to read the persistent directories for further booting instructions (which was just changed).
It appears a small number of devices went through such an update but the old data is still being loaded into the registry for instance. There is no trace of where this could come from and I can guarantee it is not burnt into the OS's ROM. I suspect FAT12 or FAT16 corruption of its tables or perhaps its "Root Level Directory" section... reason is probably that the program makes the hardreset too quickly for all buffers to flush in time. Being a hardreset and not a soft one, I assume the buffers are destroyed and never written on disk, thus some changes are lost and some may have been done partially. This problem leaves what I call ghost files around. These files cannot be found anywhere, but somehow are read by the program in OS ROM that is set to find them in the root level dirs of the persistent partitions.
I've been researching like crazy to find a way to make a good call to FlushFileBuffers() to flush everything (data and metadata) before doing the hardreset. But I haven't found any good documentation that works for win32 ce 3.0. I've had to implement all kinds of silly workaround that are making the whole process take much longer than needed...
I'd like your input on how I could make sure everything is flushed properly on these WM2003 devices before I issue the call to hard reset.
Thanks,
Simon

[Q] Desperate newbie with deleted files problem….help please!!

I have a real cry for help!
Somehow all my pictures disappeared from my Galaxy Nexus. My only possible explanation (since it could not have decided to delete them itself!) is that I must have been a complete idiot and last night when I thought I was deleting a video I had just taken I must deleted the camera directory itself. This is supported by the fact that there was no ‘camera’ directory when I looked this morning. I then took a new photo and the directory reappeared. I have plenty of experience with PC’s but I’m a newbie with smartphones. I figured if I don’t write any more files to the phone then most of the actual data should still be there so I hoped to do some kind of undelete.
I’ve done some research and it looks like the ‘feature’ of only connecting as an MTP device (rather than USB mass storage) is potentially a killer blow. Without an assigned drive letter it seems that none of the usual recovery programmes will recognise the phone.
In theory an alternative might be to take a complete image of the phone contents and somehow recover the data from here?
I am pretty desperate as I have five months of pictures/videos of my kids etc, and most of that data must still be on the phone – but how to get to it?
Finally – yes I am a complete plonker, I shouldn’t have made such a stupid mistake and I should have backed up the phone or the pictures. I have learned my lesson. But given that, is there anything I can do?
BTW - the phone came from 3 network (via a reseller) and I have not touched it with respect to unlocking/rooting etc. It is in the state I received it.
HELP please!
Thanks very much...........
I believe the MTP vs. USB Mass storage would be a driver thing. There are many different versions of drivers so its possible there are ones that will mount the phone with a drive letter. I can think of some other things to try (Boot into fastboot mode by turning phone off then powering on by holding power, volume up and volume down at the same time and holding till it vibrates). You could also try Disk Management under windows to see if you can assign a letter
In the future I highly recommend setting up a google account and using Google Photo/Instant Upload to keep a backup of your photos. You dont even have to sync anything else
Thanks for your suggestions, much appreciated.
I’ve now tried going into fastboot mode and connecting to PC but no joy – Windows recognises there is a device connected (usually ID’d as an OMAP4440) but can’t find a driver.
Disk Management also doesn’t show the Nexus as a drive and therefore won’t allow a Drive letter to be assigned.
Try these (obviously no guarantees and I havent used any personally)
https://play.google.com/store/apps/details?id=fahrbot.apps.undelete
http://android-photo-recovery.com/tutorials/deleted-file-recovery-for-google-nexus-phones.html
EDIT: Found another:
http://www.wondershare.com/disk-utility/recover-deleted-photos-from-nexus-s-and-galaxy-nexus.html
Thanks again, I appreciate all suggestions. Yes I have come across these and unfortunately they don’t solve my issue. The last two are amongst those I’d seen reported as not working as they need a drive letter. I had installed both anyway but found that to be true (
The first requires root access which I don’t have. If I understand correctly, to root I’ll need to unlock the bootloader first, and unlocking will erase all the data anyway??
Unfortunately, you are out of luck. You cannot mount the storage on a GNex in USB Mass Storage mode, and I am pretty sure that none of the "undelete" programs that run in Android support ext4 (which is what our GNex internal storage is formatted).
If you are running 4.0.1 or 4.0.2, you can still get root access without losing your data (but not on 4.0.4), but I can't see how it will help you given what I mentioned above.
I am on 4.04 so sounds like I can't get root access without overwriting, can I roll back to 4.01/2 without overwriting the data? (sounds unlikely but I have to ask - I upgraded from 4.02 without losing data....).
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Gavdroid said:
[snip]
can I roll back to 4.02/3 without overwriting the data?
Click to expand...
Click to collapse
Unfortunately no.
Gavdroid said:
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Click to expand...
Click to collapse
I believe there are utilities to "do an undelete" on ext4. The problem is how to get access to the data image. I don't really know of any way to pull off the data partition of a GNex to your computer, but it may be possible.
Have a look at this thread. I think shaaXo managed to find a way for your computer to see the memory on the GNex and likely dump it (although it is not very user-friendly).
That sucks. If it's deleted, it's gone for good. Sorry, buddy.
Sent from my Galaxy Nexus using XDA
Thanks very much I will go through that post and see where I get to!
Edit! - uh-oh, taking a quick look it seems you need to use CWM, which I take to be ClockworkMod, which I thought required the phone to be rooted to install it? And if I understand correctly, rooting requires an unlocked bootloader, which wipes your data??
I will take a deeper look in case I've misunderstood (very likely), but am I thinking clearly here?

Read/modify system files through USB?

Hi, I have a stupid question: Is there any way to read and modify system files on my HTC One M8 through USB to a computer that can access them and doesn't care about file permissions? I have an annoying WiFi notifications issue that I can't disable anywhere implemented by Verizon and they lock the bootloader on 5.0.1 and I've found no safe workaround. I just want to edit the file that has this setting.
Maybe I don't know enough about the technology, but is there no program I can use on Windows or Linux that can read the memory through USB and let me change the data without it caring about permissions? If the files are not encrypted but accessible, something should be able to read them and let me edit them, as I can get Linux to read and edit any information on a Windows drive that isn't encrypted even if the user has a lockscreen password as it bypasses boot-up.
(I realize I may be sounding like an idiot as someone might have already done this if possible but maybe I haven't searched hard enough)
This would never work, since the system partition is write protected. Even if you can somehow change the system files by USB (which I think is unlikely), the changes would just revert when you rebooted. You need a kernel mod to disable the system write protection; and for that you need root.

Deleting C:\Windows\SoftwareDistribution on Elite x3

I'm getting some Windows Update errors (0x80244019 and 0x8007139f) which I'm 99% certain are caused by an incomplete download of the update.
Updating from Creators Update (RS2) to Fall Creators Update (RS3). I need it for some UWP API features. Prefer not to reset the device if I don't have to.
I just need to be able to clear the C:\Windows\SoftwareDistribution folder where the new build is downloaded to (unless it's different on mobile?). Is there any way to get access to this folder and delete/rename it? As far as I can tell, this would allow the update to download for real and install.
IIRC there used to be a way to browse system files in the built-in file explorer, using a shortcut, but that doesn't seem to work.
Interop Tools from the store lets me browse system files on PC and Xbox, but not on the x3. I can only access registry.
I couldn't find any guide that both applied to the x3 (all seem to be for Lumia and sometimes Samsung), and that I understood to follow. I think I need to enable mass storage mode, or get a different file manager installed?
@Kyle_N
Try his guide for accessing the files/file system in question on the X3. Should still work fine.
You need to focus on the section labeled ENABLE SYSTEM REGISTRY ACCESS INSTRUCTIONS-->For all other OEM devices.
This gives you the ability to unlock capabilities and full file system access.

Categories

Resources