I happened to look into the WinPho7 Unlocking and found some important items. Chevron team also thinks the same way If I'm right.
1. When We connect our WinPho7 to PC, Zune software creates a proxy server at port 27071 (or something like that) and redirects all calls to localhost([email protected]) to TCP2UDP port for Mobile Device.
2. All Mobile Related Activities are handled by the dll files ZuneDriver.dll,ZuneTcp2Udp.dll,ZuneIpTransport.dll,ZuneRegUtil.dll and ZuneTcp2Udp.dll).
3. All Communication from PC/Zune software to Device always happens over TCP2UDP, and thats the reason connection issues occur.So never ever close Zune once u connect Device, If u close ZUne, then disconnect device and reconnect.
Coming to Device Unlocking
Well In SDK We can find 2 dll files PhoneRegDll.dll and msidcrl40.dll, which are the main items that handle all unlocking of the device.
Actually when u try to unlock the device, using LiveId and password, a HashToken is generated and returned by liveId authentication along with some secretKey and CryptKey, which is again authenticated with passportservices to get a 300-500 character length encrypted token which is actually a CertificateStoreItem generated by the microsoft passport service. (sorry for this lengthy sentence)
These dll's and transport methods in the dll's convert this into a certificate and install
###REF msidcrl40.dll PE signatures (few of them only)
// [email protected]@[email protected][email protected]_WV?
// BuildAuthTokenRequest; Index 26; Information not available
// BuildServiceTokenRequest; Index 27; Information not available
// PutTokenResponse; Index 28; Information not available
// InitializeEx; Index 29; Information not available
// GetWebAuthUrl; Index 30; Information not available
// LogonIdentityEx; Index 31; Information not available
// AuthIdentityToServiceEx; Index 33; Information not available
// GetAuthStateEx; Index 34; Information not available
// GetCertificate; Index 35; Information not available
// BuildServiceTokenRequestEx; Index 36; Information not available
// BuildAuthTokenRequestEx; Index 37; Information not available
// CancelPendingRequest; Index 38; Information not available
// PutTokenResponseEx; Index 39; Information not available
// VerifyCertificate; Index 40; Information not available
// GetIdentityPropertyByName; Index 41; Information not available
// CreateIdentityHandleFromAuthState; Index 42; Information not available
// ExportAuthState; Index 43; Information not available
// CacheAuthState; Index 44; Information not available
// RemoveAuthStateFromCache; Index 45; Information not available
To find the reference method calls and dll export functions I Used PE Explorer and DllExportViewer along with DependencyWalker, and anybody can check it for verification. I'm attaching the typelib reference from ZuneDriver
ZuneDriver.dll TypeLib exports
//Zune Driver for WUDF 1.0 Type Library
//Version: 1.0
ZuneDriverLib;
GUID = {BC86C3E6-D4A6-41DF-B272-DB2117D095EE};
//ZuneDriver Class
CoClass ZuneDriver;
GUID = {2E2C3051-B7B7-4D51-8C57-784BA5AC0FF0};
//IDriverEntry Interface
Interface IDriverEntry;
GUID = {1BEC7499-8881-4F2B-B01C-A1A907304AFC};
function OnInitialize(pWdfDriver: ^IWDFDriver): HResult; stdcall;
function OnDeviceAdd(pWdfDriver: ^IWDFDriver; pWdfDeviceInit: ^IWDFDeviceInitialize): HResult; stdcall;
function OnDeinitialize(pWdfDriver: ^IWDFDriver); stdcall;
//IWDFDriver Interface
Interface IWDFDriver;
GUID = {AD368EBE-4139-43E3-A875-69B266A9139C};
function CreateDevice(pDeviceInit: ^IWDFDeviceInitialize; pCallbackInterface: IUnknown; out ppDevice: ^^IWDFDevice): HResult; stdcall;
function CreateWdfObject(pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfObject: ^^IWDFObject): HResult; stdcall;
function CreatePreallocatedWdfMemory(pBuff: ^UI1; BufferSize: ULONG_PTR; pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfMemory: ^^IWDFMemory): HResult; stdcall;
function CreateWdfMemory(BufferSize: ULONG_PTR; pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppWdfMemory: ^^IWDFMemory): HResult; stdcall;
function IsVersionAvailable(pMinimumVersion: ^UMDF_VERSION_DATA): I4; stdcall;
function RetrieveVersionString(out pVersion: LPWSTR; out pdwVersionLength: ^UI4): HResult; stdcall;
//IWDFObject Interface
Interface IWDFObject;
GUID = {64275C66-2E71-4060-B5F4-3A76DF96ED3C};
function DeleteWdfObject: HResult; stdcall;
function AssignContext(pCleanupCallback: ^IObjectCleanup; pContext: ^VOID): HResult; stdcall;
function RetrieveContext(out ppvContext: ^^VOID): HResult; stdcall;
function AcquireLock; stdcall;
function ReleaseLock; stdcall;
//IObjectCleanup Interface
Interface IObjectCleanup;
GUID = {244ABE3A-ABBC-43B1-A877-F00077550E6A};
function OnCleanup(pWdfObject: ^IWDFObject); stdcall;
//IWDDeviceInitialize Interface
Interface IWDFDeviceInitialize;
GUID = {74CC381C-0871-43C1-878B-3F7C9D16933D};
function SetFilter; stdcall;
function SetLockingConstraint(LockType: _WDF_CALLBACK_CONSTRAINT); stdcall;
function RetrieveDevicePropertyStore(pcwszServiceName: ^UI2; Flags: _WDF_PROPERTY_STORE_RETRIEVE_FLAGS; out ppPropStore: ^^IWDFNamedPropertyStore; out pDisposition: ^_WDF_PROPERTY_STORE_DISPOSITION): HResult; stdcall;
function SetPowerPolicyOwnership(fTrue: I4); stdcall;
function AutoForwardCreateCleanupClose(State: _WDF_TRI_STATE); stdcall;
function RetrieveDeviceInstanceId(out Buffer: LPWSTR; out pdwSizeInChars: ^UI4): HResult; stdcall;
function SetPnpCapability(Capability: _WDF_PNP_CAPABILITY; Value: _WDF_TRI_STATE); stdcall;
function GetPnpCapability(Capability: _WDF_PNP_CAPABILITY): _WDF_TRI_STATE; stdcall;
Enum _WDF_CALLBACK_CONSTRAINT;
None = 0;
WdfDeviceLevel = 1;
WdfLevelReserved = 2;
WdfLevelMaximum = 3;
Enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS;
WdfPropertyStoreNormal = 0;
WdfPropertyStoreCreateIfMissing = 1;
Interface IWDFNamedPropertyStore;
GUID = {394B48C9-BCA0-498F-8E2C-01225464A932};
function GetNamedValue(pszName: LPWSTR; out pv: ^^VOID): HResult; stdcall;
function SetNamedValue(pszName: LPWSTR; pv: ^^VOID): HResult; stdcall;
function GetNameCount(out pdwCount: ^UI4): HResult; stdcall;
function GetNameAt(iProp: UI4; out ppwszName: ^LPWSTR): HResult; stdcall;
Enum _WDF_PROPERTY_STORE_DISPOSITION;
CreatedNewStore = 1;
OpenedExistingStore = 2;
Enum _WDF_TRI_STATE;
WdfUseDefault = 0;
WdfFalse = 1;
WdfTrue = 2;
Enum _WDF_PNP_CAPABILITY;
WdfPnpCapInvalid = 0;
WdfPnpCapLockSupported = 1;
WdfPnpCapEjectSupported = 2;
WdfPnpCapRemovable = 3;
WdfPnpCapDockDevice = 4;
WdfPnpCapSurpriseRemovalOk = 5;
WdfPnpCapNoDisplayInUI = 6;
WdfPnpCapMaximum = 7;
//IWDFDevice Interface
Interface IWDFDevice;
GUID = {D657FE45-460A-49C3-8219-766AE8032A80};
function RetrieveDevicePropertyStore(pcwszServiceName: ^UI2; Flags: _WDF_PROPERTY_STORE_RETRIEVE_FLAGS; out ppPropStore: ^^IWDFNamedPropertyStore; out pDisposition: ^_WDF_PROPERTY_STORE_DISPOSITION): HResult; stdcall;
function GetDriver(out ppWdfDriver: ^^IWDFDriver); stdcall;
function RetrieveDeviceInstanceId(out Buffer: LPWSTR; out pdwSizeInChars: ^UI4): HResult; stdcall;
function GetDefaultIoTarget(out ppWdfIoTarget: ^^IWDFIoTarget); stdcall;
function CreateWdfFile(pcwszFileName: LPWSTR; out ppFile: ^^IWDFDriverCreatedFile): HResult; stdcall;
function GetDefaultIoQueue(out ppWdfIoQueue: ^^IWDFIoQueue); stdcall;
function CreateIoQueue(pCallbackInterface: IUnknown; bDefaultQueue: I4; DispatchType: _WDF_IO_QUEUE_DISPATCH_TYPE; bPowerManaged: I4; bAllowZeroLengthRequests: I4; out ppIoQueue: ^^IWDFIoQueue): HResult; stdcall;
function CreateDeviceInterface(pDeviceInterfaceGuid: ^GUID; pReferenceString: LPWSTR): HResult; stdcall;
function AssignDeviceInterfaceState(pDeviceInterfaceGuid: ^GUID; pReferenceString: LPWSTR; Enable: I4): HResult; stdcall;
function RetrieveDeviceName(out pDeviceName: LPWSTR; out pdwDeviceNameLength: ^UI4): HResult; stdcall;
function PostEvent(EventGuid: ^GUID; EventType: _WDF_EVENT_TYPE; pbData: ^UI1; cbDataSize: UI4): HResult; stdcall;
function ConfigureRequestDispatching(pQueue: ^IWDFIoQueue; RequestType: _WDF_REQUEST_TYPE; Forward: I4): HResult; stdcall;
function SetPnpState(State: _WDF_PNP_STATE; Value: _WDF_TRI_STATE); stdcall;
function GetPnpState(State: _WDF_PNP_STATE): _WDF_TRI_STATE; stdcall;
function CommitPnpState; stdcall;
function CreateRequest(pCallbackInterface: IUnknown; pParentObject: ^IWDFObject; out ppRequest: ^^IWDFIoRequest): HResult; stdcall;
function CreateSymbolicLink(pSymbolicLink: LPWSTR): HResult; stdcall;
//IWDFIoTarget Interface
Interface IWDFIoTarget;
GUID = {CC060D79-C0C2-407F-8B10-A5E900FC3474};
function GetTargetFile(out ppWdfFile: ^^IWDFFile); stdcall;
function CancelSentRequestsForFile(pFile: ^IWDFFile); stdcall;
function FormatRequestForRead(pRequest: ^IWDFIoRequest; pFile: ^IWDFFile; pOutputMemory: ^IWDFMemory; pOutputMemoryOffset: ^_WDFMEMORY_OFFSET; DeviceOffset: ^I8): HResult; stdcall;
function FormatRequestForWrite(pRequest: ^IWDFIoRequest; pFile: ^IWDFFile; pInputMemory: ^IWDFMemory; pInputMemoryOffset: ^_WDFMEMORY_OFFSET; DeviceOffset: ^I8): HResult; stdcall;
function FormatRequestForIoctl(pRequest: ^IWDFIoRequest; IoctlCode: UI4; pFile: ^IWDFFile; pInputMemory: ^IWDFMemory; pInputMemoryOffset: ^_WDFMEMORY_OFFSET; pOutputMemory: ^IWDFMemory; pOutputMemoryOffset: ^_WDFMEMORY_OFFSET): HResult; stdcall;
//IWDFFile Interface
Interface IWDFFile;
GUID = {CC8FE04B-FE8B-4245-AFD6-C31BC830C791};
function RetrieveFileName(out pFileName: LPWSTR; out pdwFileNameLengthInChars: ^UI4): HResult; stdcall;
function GetDevice(out ppWdfDevice: ^^IWDFDevice); stdcall;
//IWDFIoRequest Interface
Interface IWDFIoRequest;
GUID = {896DF312-22B4-4A9D-95DD-A364AAF59769};
function CompleteWithInformation(CompletionStatus: HResult; Information: ULONG_PTR); stdcall;
function SetInformation(Information: ULONG_PTR); stdcall;
function Complete(CompletionStatus: HResult); stdcall;
function SetCompletionCallback(pCompletionCallback: ^IRequestCallbackRequestCompletion; pContext: ^VOID); stdcall;
function GetType: _WDF_REQUEST_TYPE; stdcall;
function GetCreateParameters(out pOptions: ^UI4; out pFileAttributes: ^UI2; out pShareAccess: ^UI2); stdcall;
function GetReadParameters(out pSizeInBytes: ^ULONG_PTR; out pullOffset: ^I8; out pulKey: ^UI4); stdcall;
function GetWriteParameters(out pSizeInBytes: ^ULONG_PTR; out pullOffset: ^I8; out pulKey: ^UI4); stdcall;
function GetDeviceIoControlParameters(out pControlCode: ^UI4; out pInBufferSize: ^ULONG_PTR; out pOutBufferSize: ^ULONG_PTR); stdcall;
function GetOutputMemory(out ppWdfMemory: ^^IWDFMemory); stdcall;
function GetInputMemory(out ppWdfMemory: ^^IWDFMemory); stdcall;
function MarkCancelable(pCancelCallback: ^IRequestCallbackCancel); stdcall;
function UnmarkCancelable: HResult; stdcall;
function CancelSentRequest: I4; stdcall;
function ForwardToIoQueue(pDestination: ^IWDFIoQueue): HResult; stdcall;
function Send(pIoTarget: ^IWDFIoTarget; Flags: UI4; Timeout: I8): HResult; stdcall;
function GetFileObject(out ppFileObject: ^^IWDFFile); stdcall;
function FormatUsingCurrentType; stdcall;
function GetRequestorProcessId: UI4; stdcall;
function GetIoQueue(out ppWdfIoQueue: ^^IWDFIoQueue); stdcall;
function Impersonate(ImpersonationLevel: _SECURITY_IMPERSONATION_LEVEL; pCallback: ^IImpersonateCallback; pvCallbackContext: ^VOID): HResult; stdcall;
function IsFrom32BitProcess: I4; stdcall;
function GetCompletionParams(out ppCompletionParams: ^^IWDFRequestCompletionParams); stdcall;
Alias ULONG_PTR;
UI4
//IRequestCallbackRequestCompletion Interface
Interface IRequestCallbackRequestCompletion;
GUID = {8A7CC8CB-CEB2-46F6-9851-77BD347A15C2};
function OnCompletion(pWdfRequest: ^IWDFIoRequest; pIoTarget: ^IWDFIoTarget; pParams: ^IWDFRequestCompletionParams; pContext: ^VOID); stdcall;
//IWDFRequestCompletionParams Interface
Interface IWDFRequestCompletionParams;
GUID = {707A2B42-69B8-4971-A49C-4031861E7AFF};
function GetCompletionStatus: HResult; stdcall;
function GetInformation: ULONG_PTR; stdcall;
function GetCompletedRequestType: _WDF_REQUEST_TYPE; stdcall;
Enum _WDF_REQUEST_TYPE;
WdfRequestUndefined = 0;
WdfRequestCreate = 1;
WdfRequestCleanup = 2;
WdfRequestRead = 3;
WdfRequestWrite = 4;
WdfRequestDeviceIoControl = 5;
WdfRequestClose = 6;
WdfRequestUsb = 7;
WdfRequestOther = 8;
WdfRequestInternalIoctl = 9;
WdfRequestTypeNoFormat = 10;
WdfRequestMaximum = 11;
//IWDFMemory Interface
Interface IWDFMemory;
GUID = {AB098F88-8F16-472A-B0BC-ECA46486C102};
function CopyFromMemory(Source: ^IWDFMemory; SourceOffset: ^_WDFMEMORY_OFFSET): HResult; stdcall;
function CopyToBuffer(SourceOffset: ULONG_PTR; TargetBuffer: ^VOID; NumOfBytesToCopyTo: ULONG_PTR): HResult; stdcall;
function CopyFromBuffer(DestOffset: ULONG_PTR; SourceBuffer: ^VOID; NumOfBytesToCopyFrom: ULONG_PTR): HResult; stdcall;
function GetSize: ULONG_PTR; stdcall;
function GetDataBuffer(out BufferSize: ^ULONG_PTR): ^VOID; stdcall;
function SetBuffer(Buffer: ^VOID; BufferSize: ULONG_PTR); stdcall;
Record _WDFMEMORY_OFFSET;
BufferOffset: ULONG_PTR;
BufferLength: ULONG_PTR;
//IRequestCallbackCancel Interface
Interface IRequestCallbackCancel;
GUID = {4E9F1A77-4587-4235-81C4-E6D24545A656};
function OnCancel(pWdfRequest: ^IWDFIoRequest); stdcall;
//IWDFIoQueue Interface
Interface IWDFIoQueue;
GUID = {AE1162B9-8B11-4714-993D-93DC48CC9E8A};
function GetDevice(out ppWdfDevice: ^^IWDFDevice); stdcall;
function ConfigureRequestDispatching(RequestType: _WDF_REQUEST_TYPE; Forward: I4): HResult; stdcall;
function GetState(out pulNumOfRequestsInQueue: ^UI4; out pulNumOfRequestsInDriver: ^UI4): _WDF_IO_QUEUE_STATE; stdcall;
function RetrieveNextRequest(out ppRequest: ^^IWDFIoRequest): HResult; stdcall;
function RetrieveNextRequestByFileObject(pFile: ^IWDFFile; out ppRequest: ^^IWDFIoRequest): HResult; stdcall;
function Start; stdcall;
function Stop(pStopComplete: ^IQueueCallbackStateChange); stdcall;
function StopSynchronously; stdcall;
function Drain(pDrainComplete: ^IQueueCallbackStateChange); stdcall;
function DrainSynchronously; stdcall;
function Purge(pPurgeComplete: ^IQueueCallbackStateChange); stdcall;
function PurgeSynchronously; stdcall;
Enum _WDF_IO_QUEUE_STATE;
WdfIoQueueAcceptRequests = 1;
WdfIoQueueDispatchRequests = 2;
WdfIoQueueNoRequests = 4;
WdfIoQueueDriverNoRequests = 8;
WdfIoQueuePnpHeld = 16;
//IQueueCallbackStateChange Interface
Interface IQueueCallbackStateChange;
GUID = {E7ECE381-7CB1-468A-BC43-ABD5948FFC75};
function OnStateChange(pWdfQueue: ^IWDFIoQueue; QueueState: _WDF_IO_QUEUE_STATE); stdcall;
Enum _SECURITY_IMPERSONATION_LEVEL;
SecurityAnonymous = 0;
SecurityIdentification = 1;
SecurityImpersonation = 2;
SecurityDelegation = 3;
//IImpersonateCallback Interface
Interface IImpersonateCallback;
GUID = {99B01D17-9FBD-4AA6-B16D-82DAB6A4107F};
function OnImpersonate(Context: ^VOID); stdcall;
//IWDFDriverCreatedFile Interface
Interface IWDFDriverCreatedFile;
GUID = {B7615D26-494B-47A6-B4CF-0271BCC3DA4B};
function Close; stdcall;
Enum _WDF_IO_QUEUE_DISPATCH_TYPE;
WdfIoQueueDispatchSequential = 1;
WdfIoQueueDispatchParallel = 2;
WdfIoQueueDispatchManual = 3;
WdfIoQueueDispatchMaximum = 4;
Enum _WDF_EVENT_TYPE;
WdfEventReserved = 0;
WdfEventBroadcast = 1;
WdfEventMaximum = 2;
Enum _WDF_PNP_STATE;
WdfPnpStateInvalid = 0;
WdfPnpStateDisabled = 1;
WdfPnpStateFailed = 2;
WdfPnpStateRemoved = 3;
WdfPnpStateResourcesChanged = 4;
WdfPnpStateDontDisplayInUI = 5;
WdfPnpStateNotDisableable = 6;
WdfPnpStateMaximum = 7;
Record UMDF_VERSION_DATA;
MajorNumber: UI4;
MinorNumber: UI4;
ServiceNumber: UI4;
Note: I'm not a Microsoft developer or a hacker or a cracker.I just do some research by peeping into dll's and exe's for fun.
So in short, if we could generate a valid certificate we could use PhoneRegDll.dll and msidcrl40.dll to deploy it to the device and unlock it ?
I'd guess generating the cert is then the difficult part, at a guess I'd presume it's signed with an MS private key and then validated on the device by a public key.
No, in short he dumped some exported functions and interfaces.
msidcrl handles the authentication with Live. The PhoneReg tool simply logs into Live (Passport), grabs your cookie, shoves it into a string, and sends it to the phone via the socket-based interface created by Zune. The rest is handled by the phone.
No secrets here.
Related
Does anybody know the interpretation of KernelIoControl with dwIoControlCode = 0x010125E0? The breakdown of the Control Code is:
DeviceType = 0x0101 = FILE_DEVICE_HAL
Access = 0 = ANY_ACCESS
Function = 0x978 = 2424 dec = ?
Method = 0 = BUFFERED
So what is function 0x978 (2424)?
I searched through the WinCE Platform Builder 5.00 files and did not see any definition of 0x978 nor 2424.
thx,
((&->
how do i replicate this under windows mobile. The first function works flawlessly however the second version (Which is required to run on windows mobile 6.1-6.5) doesn't.. If anyone has any idea how to fix it i'm willing to try it out.
Thanks
Code:
private static byte[] WebPost(string url, byte[] data)
{
var webClient = new WebClient();
return webClient.UploadData(url, data);
}
This dont.
Code:
private static byte[] WebPost(string url, byte[] data)
{
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
request.Credentials = System.Net.CredentialCache.DefaultCredentials;
request.Timeout = 10000; // 10 secs
request.Method = "POST";
byte[] requestPostBuffer = System.Text.Encoding.GetEncoding(1252).GetBytes(ByteArrayToStr(data));
request.ContentLength = requestPostBuffer.Length;
Stream requestPostData = request.GetRequestStream();
requestPostData.Write(requestPostBuffer, 0, requestPostBuffer.Length);
requestPostData.Close();
// initialize the httpweresponse object
HttpWebResponse webResponse = (HttpWebResponse)request.GetResponse();
// set our encoding
Encoding enc = System.Text.Encoding.GetEncoding(1252);
//initialis the webresponse stream with our encoding
StreamReader webResponseStream = new StreamReader(webResponse.GetResponseStream(),enc);
// create a string to copy it all into.
string streamedData = webResponseStream.ReadToEnd();
webResponse.Close();
webResponseStream.Close();
byte[] convertedResponse = StrToByteArray(streamedData);
convertedResponse = Encoding.Convert(System.Text.Encoding.Default, Encoding.GetEncoding(1252),convertedResponse);
return convertedResponse;
}
i know this might be in the wrong section but can this be ported to our device
http://forum.xda-developers.com/showthread.php?t=1140967
here is the build.prop
PHP:
modules
#
#device supports LTE
ro.config.lte=true
#device supports EHRPD
ro.config.ehrpd=true
#device supports simultaneous 1x voice + LTE
ro.config.svlte1x=true
#-from QCT Fusion
# Default network type.
# 8 => CDMA/EVDO/LTE auto mode preferred.
ro.telephony.default_network=8
wifi.interface=eth0
wifi.supplicant_scan_interval=120
# The OpenGL ES API level that is natively supported by this device.
# This is a 16.16 fixed point number
ro.opengles.version = 131072
# This is a high density device with more memory, so larger vm heaps for it.
# Change to 64m for Sense 3.0 elements
dalvik.vm.heapsize=64m
# For the default value of agps
ro.ril.def.agps.mode = 2
# For emmc phone storage
ro.phone_storage = 0
#
# This file describes the media capabilities and profiles
# using system properties.
#
# Note: The property key and value has some length
# limit as defined by PROPERTY_KEY_MAX and
# PROPERTY_VALUE_MAX, respectively
#
# WARNING: We may not use system properties for specifying
# media capabilities and profiles in the future
#
ro.media.enc.file.format = 3gp,mp4
ro.media.enc.vid.codec = m4v,h263,h264
ro.media.enc.vid.h263.width = 176,1280
ro.media.enc.vid.h263.height = 144,720
ro.media.enc.vid.h263.bps = 64000,6000000
ro.media.enc.vid.h263.fps = 1,30
ro.media.enc.vid.m4v.width = 176,1280
ro.media.enc.vid.m4v.height = 144,720
ro.media.enc.vid.m4v.bps = 64000,6000000
ro.media.enc.vid.m4v.fps = 1,30
ro.media.enc.vid.h264.width = 176,1280
ro.media.enc.vid.h264.height = 144,720
ro.media.enc.vid.h264.bps = 64000,6000000
ro.media.enc.vid.h264.fps = 1,30
# For FOTA setting (leave empty value to use default)
ro.config.htc.nocheckin = 1
# Release Bluetooth HW/SW information
ro.bt.chipset = Broadcom BCM4329-B1
ro.bt.stack = Broadcom BTL-A
ro.bt.stack.version = 2.0.50.032
#0x10000010010100101000011 represent bt profile list
ro.bt.profiles = 4270403
# Properties of BTLA stack
service.brcm.bt.activation = 0
service.brcm.bt.srv_active = 0
service.brcm.bt.hcid_active = 0
service.brcm.bt.btld = 0
service.brcm.bt.btld_pid = 0
service.brcm.bt.avrcp_pass_thru = 0
service.brcm.bt.avrcp_toggle = 1
service.brcm.bt.btport_redir_on = 1
#Welly_Fang
ro.cdma.home.operator.numeric = 310012
ro.cdma.home.operator.alpha = Verizon
ro.htc.device.slot1 = RUIM
# jerry.pj_chen [Start]20100730 For Verizon data retry
ro.cdma.data_retry_config = max_retries=infinite,0,0,60000,120000,480000,900000
ro.com.android.dataroaming = true
# jerry.pj_chen [end]20100730 For Verizon data retry
# For opensense sdk
ro.htc.common.version = 2.0.0.0
# Set Horizontal VVM = true and HorizontalBUA = true for Incredible#C/Lexikon/Mecha Verizon build
# Then Verizon VVM/BuA program can check this property to known if there is a Native VVM/BuA in ROM
ro.HorizontalVVM = false
ro.HorizontalBUA = false
# Properties of Scalado Denoise param.
postprocess.iso_midband = 400
postprocess.denoise_level = 5
# Following property will be reference by Settings.
ro.product.processor = 1GHz
ro.product.ram = 768MB
ro.product.display_resolution = 4.3 inch WVGA resolution
ro.product.main_camera = 8M
ro.product.front_camera = 1.3M
ro.product.bluetooth = 2.1 + EDR
ro.product.wifi = 802.11 b/g/n
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.com.google.networklocation=1
ro.setupwizard.mode=DISABLED
ro.config.ringtone=QuietlyBrilliant.mp3
ro.config.notification_sound=Zeta.mp3
ro.config.alarm_alert=NewDay.mp3
ro.config.cal_notification=Epsilon.mp3
ro.config.msg_notification=Gamma.mp3
ro.com.google.gmsversion=2.3_r3
media.a1026.nsForVoiceRec=0
htc.audio.alt.enable=1
htc.audio.hac.enable=1
net.ppp0.dns1=8.8.8.8
net.ppp0.dns2=8.8.4.4
ro.media.codec_priority_thumb=so
dalvik.vm.lockprof.threshold=500
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.toolkit.romversion=Das BAMF Sense 3.0 RC
ro.toolkit.romedition=BAMF Sense 3.0 RC
ro.toolkit.romtype=gingerbread
ro.stats.devname=TeamBAMF
ro.stats.romname=DasBAMF
ro.stats.romversion=2.1
I think this is 2.3.4 when you look at build.prop with a text editor and search for 2.3.4 it comes up twice.
kyleastley said:
i know this might be in the wrong section but can this be ported to our device
http://forum.xda-developers.com/showthread.php?t=1140967
I think this is 2.3.4 when you look at build.prop with a text editor and search for 2.3.4 it comes up twice.
Click to expand...
Click to collapse
But i'm already running 2.3.4
Uploaded with ImageShack.us
Hello!
I have file store.vol copy from Windows phone device(HTC HD7). I use EDB API to read it.
My problem: I could not open store.vol file. ERROR_BAD_FORMAT.
How can I open this file.
Thanks!!!
My code:
Code:
#include "stdafx.h"
#include "Winphone7_Lib.h"
#include "clsReadEDB.h"
#include <iosfwd>
#define EDB
extern "C"
{
#include <windbase_edb.h>
}
// clsReadEDB
IMPLEMENT_DYNAMIC(clsReadEDB, CWnd)
clsReadEDB::clsReadEDB()
{
}
void clsReadEDB::readFile(char* path)
{
CEGUID guid;
CEVOLUMEOPTIONS cevo = {0};
cevo.wVersion = 1;
CEOIDINFOEX oidInfo = {0};
wchar_t buff[250];
HANDLE hSes, hBD, hBDS;
BOOL rez;
rez = CeMountDBVolEx(&guid, L"store.vol", &cevo,OPEN_EXISTING);
if (rez == FALSE) {
}
DWORD dw = GetLastError();
hBD = CeFindFirstDatabaseEx(&guid, 0);
if (hBD != INVALID_HANDLE_VALUE)
{
oidInfo.wVersion = CEOIDINFOEX_VERSION;
oidInfo.wObjType = OBJTYPE_DATABASE;
//creare sesiune
hSes = CeCreateSession(&guid);
if (hSes == INVALID_HANDLE_VALUE) {/* error */}
CEOID oidBD = CeFindNextDatabaseEx(hBD, &guid);
while (oidBD != 0)
{
//obtain database information
rez = CeOidGetInfoEx2(&guid, oidBD, &oidInfo);
if (rez != TRUE) {/* error */}
//open database
hBDS = CeOpenDatabaseInSession(hSes, &guid, &oidBD,
oidInfo.infDatabase.szDbaseName, NULL, CEDB_AUTOINCREMENT, NULL);
if (hBDS == INVALID_HANDLE_VALUE) {/* error */}
PCEPROPVAL pInreg = NULL;
PBYTE pBuffInreg = NULL;//memory is allocated by function
WORD wProp;//number of properties
DWORD dwLgInreg;// record lengths
//memory is allocatd by function
CEOID ceoid = CeReadRecordPropsEx(hBDS, CEDB_ALLOWREALLOC, &wProp, NULL,
&(LPBYTE)pBuffInreg, &dwLgInreg, NULL);
int k = 0;
while(ceoid != 0)
{
pInreg = (PCEPROPVAL)pBuffInreg;
//for each field
for (int i = 0; i < wProp; i++)
{
switch(LOWORD(pInreg->propid))
{
case CEVT_LPWSTR:
//process string values
break;
//integers
case CEVT_I2:
case CEVT_I4:
case CEVT_UI2:
case CEVT_UI4:
case CEVT_BLOB:
case CEVT_BOOL:
//process integer values
break;
case CEVT_R8:
//process floating point values
break;
default:
//other types
break;
}
OutputDebugString(buff);
//next field
pInreg++;
}
LocalFree(pBuffInreg);
//next record
ceoid = CeReadRecordPropsEx(hBDS, CEDB_ALLOWREALLOC, &wProp, NULL,
&(LPBYTE)pBuffInreg, &dwLgInreg, NULL);
k++;
}
CloseHandle(hBDS);
//next database
oidBD = CeFindNextDatabaseEx(hBD, &guid);
}
CloseHandle(hBD);
CloseHandle(hSes);
}
CeUnmountDBVol(&guid);
}
clsReadEDB::~clsReadEDB()
{
}
Just wrote this up and it works on a Nook Simple Touch Glow. It would be interesting, for completeness, to know what similar code returned on first gen nooks, and the HD nooks.
Code:
public static boolean isNook()
{
String thisManufacturer=android.os.Build.MANUFACTURER;
Log.d(TAG, "UTIL: Manu: "+thisManufacturer);
// 'BarnesAndNoble' on Nook Simple Touch with GlowLite
String thisProduct=android.os.Build.PRODUCT;
Log.d(TAG, "UTIL: PRODUCT "+thisProduct);
// 'NOOK' on Nook Simple Touch with GlowLite
//String thisBrand=android.os.Build.BRAND;
//Log.d(TAG, "UTIL: Brand "+thisBrand);
// 'nook' on Nook Simple Touch with GlowLite
//String thisModel=android.os.Build.MODEL;
//Log.d(TAG, "UTIL: Model "+thisModel);
// 'unknown' on Nook Simple Touch with GlowLite
if( thisManufacturer.equals("BarnesAndNoble") &&
thisProduct.equals("NOOK"))
return(true);
else
return(false);
}
I believe I've seen some similar code posted somewhere, but since a variety of searches didn't bring it up, perhaps this more SEO title will help.
Anders
From my old Nook Simple Touch:
Code:
android.os.Build
ALLOW_INSTORE = false
BOARD = zoom2
BRAND = nook
CPU_ABI = armeabi
DEVICE = zoom2
DISPLAY = ERD79
FINGERPRINT = generic/zoom2/zoom2/zoom2:2.1/ERD79/1.2.1:user/test-keys
HOST = dhabuildimage04
ID = ERD79
MANUFACTURER = BarnesAndNoble
MODEL = unknown
NOOK_CARRIER = unknown
NOOK_CODE = unknown
NOOK_DISTRIBUTOR = unknown
NOOK_LOCALE_LANGUAGE = unknown
NOOK_LOCALE_REGION = US
NOOK_VENDOR = unknown
NOOK_VERSION = unknown
PRODUCT = NOOK
SERIAL = unknown
TAGS = test-keys
TIME = 1354919736000
TYPE = user
UNKNOWN = unknown
USER = build
android.os.Build$VERSION
CODENAME = REL
INCREMENTAL = 1.2.1
RELEASE = 2.1
SDK = 7
SDK_INT = 7
For newer stuff, the Glowlight plus will reply with product: "ntx_6sl". Manufacturer still the same.