Develop Bugs

[UPDATE 18.12.10] Shared Homebrew projects

let me start a thread where you all can drop your shared homebrew app's.
For homebrew app's we first need to unlock:
iridium21 said:
As people may know, Chevron have removed their unlocker download for WP7 so I thought I'd archive it and make it available for everyone here still:
http://www.megaupload.com/?d=Q1T7WQMK
EDIT: Thanks to Cendaryn we also have the required security certificate - the easiest way (thanks to Talys) to install the cert and unlock your WP7 is to do as follows:
1. Unzip file, and attach chevronwp7.cer (see below for file) to an e-mail to yourself
2. Open email in WP7
3. Tap attachment once, turns it into a shield, tap it again, goes to install certificate screen with white letters on black screen
4. Click install at the bottom
5. Make sure registry is modified:
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsPhone\ProxyPorts]“DeviceReg”=dword:000069C5
I think the WP7 developer tools from MS does this, but you can add it in manually (it's a 32bit DWORD)
6. Plug in phone and leave Zune running
7. Run chevronwp7.exe, click both checkboxes
8. Click unlock
Excellent video tutorial here thanks to Jaxbot
[Edit 8th Dec 2010]
Worried that Microsoft has relocked your phone? They haven't, look here
Hope this helps someone.
Click to expand...
Click to collapse
Or unlock using a modded version by hounsell .
hounsell said:
Been able to remove the sideload limit, I was able to install 11 apps by my count, though I'd appreciate a third-party confirmation to be honest.
http://thounsell.co.uk/2010/12/chevronwp7-now-without-the-sideload-limit/
Click to expand...
Click to collapse
After unlocking we want some custom ringtones ofcourse:
ShadowLegion said:
I didnt see a thread so i just thought i would let people who did already know that ChevronWP7 released their Custom Ringtone Manager Today
you can Find It Here http://www.chevronwp7.com/
download: http://walshie.me/ChevronWP7.RingtoneInstaller.zip
Source code:http://blog.walshie.me/2010/12/source-code-to-the-chevronwp7-ringtone-editor/
Click to expand...
Click to collapse
Lets look at the file system:
hounsell said:
FileBrowser
Source
Still very basic, not the most stable either, but at least you can browse the Windows folder, and read text files.
I'll probably put more effort in once I've got further with my SevenIRC App.
Click to expand...
Click to collapse
We need a .reg viewer to:
(nico) said:
I've managed to create a basic Registry Viewer, readonly for the moment.
For now, I didn't manage to get access to root path, so the first 2 levels are hardcoded.
Download it here: (link removed, see below)
Edit:
Updated version here: http://bit.ly/ed1Sz1
and a direct link:http://www.xda-developers.ch/download/?a=d&i=4227279264
Click to expand...
Click to collapse
And to get this all on the phone a nice way:
tom_codon said:
Hi all !
For all devices unlocked with ChevronWP7 Unlocker , we're can easy install custom ringtones or applications .XAP format via Application Deployment , but everytimes need open start menu --> Application Deployment then browser .xap to tool for install take too much times and almost make some in us crazy
That why i decided to write Tom XAP installer , basicly Tom XAP installer and Application Deployment are the same ( Alow install custom .xap to device and emulator windows phone 7 ) But Tom XAP installer a lot convenience , it's alow you install .xap with double click to file or simple just right click --> install xap
How to :
Download exe and put it somewhere in PC, run it , it will automatic add registry path of application and add menu , icon to .XAP files
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Then just close it and now double click to custom ringtones , or any .xap format files , the Tom XAP installer will automatic open and give you some details ( App name , Version , Author , Size , Description of XAP ) then select where you will install xap ( device or emulator )
Press Install and wait it finish.
Notices :
1. Tom XAP installer Requires .NET 4.0 Framework and Windows Phone 7 SDK
2. If you install xap to device
- Please make sure your device was unlocked with ChevronWP7 Unlocker ( Here is guide how to unlock )
- Make sure your device was connected with PC and Zune lauched
- Make sure your device not in sleep mode
3. If you move Tom XAP installer.exe to other location in PC , you should run it again one time for registry again location of application
4. If you don't like this software , just run Tom XAP installer.exe and uncheck " Enable Tom XAP installer" it will uninstall all registry of Tom XAP installer in your PC
Download: http://forum.xda-developers.com/attachment.php?attachmentid=456249&d=1291493842
Cheers !
Tom
Click to expand...
Click to collapse
Man I need a webserver on my phone.
davux said:
I've extended jmorrill's code to include the Winsock functions to listen. The example proves that one may listen on port 80.
One problem with this library right now is that it is IPv4 only. I tried to make things generic but that was quite hard, I'm also really not very familiar with native Winsock anyway.
dl.dropbox.com/u/12359/PhoneNetworkingSample_with_listen.zip
[edit] and here's a really simple (and really hacked together - you've been warned) webserver!
dl.dropbox.com/u/12359/wp7_webserver.zip
The code is definitely *preview quality* - I pulled it together just now because I don't think I'll be able to work on this for a few days, so it'd be a starting point but I'm sure it's buggy.
Click to expand...
Click to collapse
davux said:
I've enhanced my Webserver sample to support reading from the device (where allowed), as well as reading/writing IsolatedStorage
//dl.dropbox.com/u/12359/WP7Homebrew_Webserver.zip
The XAP is located in the Webserver project.
I am not finished, there are several issues:
- I have not implemented support for getting the local endpoint, so you need to know your phones IP address
- There is a bug somewhere that causes a problem when uploading larger files.
- There is no UI
- No authentication!
To access the webserver, open the app on your phone (it will disable the idle timer and run behind the lock screen)
//phone_ip/IsolatedStorage
//phone_ip/Windows
IsolatedStorage is a special case (virtual directory that uses the SDK IsolatedStore APIs), the filesystem is mounted at the root of the webserver. Note that if you navigate to //phone_ip/, you will not see anything, as we are not able to list the contents of the root directory.
I am working to create a real socket library that mimics System.Net/.Sockets, and System.IO for file access. TcpClient and TcpListener are in a mostly functional state already.
I'll add in registry and other capabilities once those two components are stable.
Most of the code came from jmorrill.
Click to expand...
Click to collapse

I'm thinking we could do with somewhere to place an open-source collection of homebrew apps.
Also, with the Chevron WP7 unlocker, you might want to include the version with the sideload limit removed

hounsell said:
I'm thinking we could do with somewhere to place an open-source collection of homebrew apps.
Also, with the Chevron WP7 unlocker, you might want to include the version with the sideload limit removed
Click to expand...
Click to collapse
good idea do you have some ideas
can you gif me the link of the unlocker you modded ?

The regviewer zip file contained projects not possible to open in VS2008 or VS2010. Could you check this?

ajhvdb said:
The regviewer zip file contained projects not possible to open in VS2008 or VS2010. Could you check this?
Click to expand...
Click to collapse
I will ask the maker of the regviewer.

What to you mean by not possible ?
The source contains multiple project:
- COM: Visual Studio 2008 C++ project using Windows Mobile 6 SDK
- Native : Visual Studio 2010 Solution containing the .Net / COM interface
- Registry Viewer: Visual studio 2010 Project containing the registry viewer app and also referencing Native project.
Everything works on my machine. You may need to fixe path to make it works on yours.

(nico) said:
What to you mean by not possible ?
The source contains multiple project:
- COM: Visual Studio 2008 C++ project using Windows Mobile 6 SDK
- Native : Visual Studio 2010 Solution containing the .Net / COM interface
- Registry Viewer: Visual studio 2010 Project containing the registry viewer app and also referencing Native project.
Everything works on my machine. You may need to fixe path to make it works on yours.
Click to expand...
Click to collapse
Sorry, most of the time when i rebuild a project all files are relative to the project, the references are not of course and i need to set the correct path. Could you give me a hint?
I download the 002 file. In this there is a native.zip. I unzipped it and got 2 folders:
1. COM
Renamed it to COM2008 and opened this in VS2008, did a rebuild. below is the output.
1>Compiling resources...
1>Microsoft (R) Windows (R) Resource Compiler Version 6.1.6723.1
1>Copyright (C) Microsoft Corporation. All rights reserved.
1>Linking...
1> Creating library Windows Mobile 6 Professional SDK (ARMV4I)\Release/Native.lib and object Windows Mobile 6 Professional SDK (ARMV4I)\Release/Native.exp
1>Performing Post-Build Event...
1> 1 file(s) copied.
1>The system cannot find the path specified.
1> 0 file(s) copied.
1>The system cannot find the path specified.
1> 0 file(s) copied.
1>The system cannot find the path specified.
1> 0 file(s) copied.
1>Project : error PRJ0019: A tool returned an error code from "Performing Post-Build Event..."
1>Build log was saved at "file://e:\_PROJECT\WP7\_Source\_Homebrew\RegistryViewer002\Native\Native\COM2008\Native\Windows Mobile 6 Professional SDK (ARMV4I)\Release\BuildLog.htm"
1>Native - 1 error(s), 0 warning(s)
Im not sure where to find this "path".
2. Nativelibrary

In the post build event of the COM project, I copy the output file to several projects of mine. Just remove post build events and copy the file manually to your own project.

(nico) said:
In the post build event of the COM project, I copy the output file to several projects of mine. Just remove post build events and copy the file manually to your own project.
Click to expand...
Click to collapse
Yup, it's working now.
In the registry viewer I only needed to change the project folder to the nativelibrary.

ceesheim, thanks..excellent

Updated the first post with a newer/better webserver

Mango Internet Sharing/Tethering - Omnia 7/Focus Tutorial Added to OP

OndraSter said:
So, the full tuto goes something like this:
1. Remove (uninstall) Network Profile application and remove any APN you set up in settings -> cellular.
2. InterOP-unlock your device (Heathcliff)
3. Install DiagProvXML app
3. Using Isolated Storage Explorer deploy enclosed provxml files
4. Install the xml files in this order: hotspot, hotspot1, mxip_hotspotconfig_01, EnableAutoDataConfig
4b. Check in settings that you can now see Internet Sharing between Bluetooth and accounts!
5. Reboot
6. Deploy WP7 Root Tools (Heathcliff)
7. Now launch Root Tools and go to Local Machine -> Comm -> InternetSharing and manualy add:
Name => value (type)
EntitlementURI => ./Vendor/MSFT/Registry/HKLM/Comm/InternetSharing/Settings/OpenMarketEnabled (string)
OpenMarketEnabled => 1 (dword)
8. Clear "CellularConnectionName" (aka set to empty)
and you can go to settings -> Internet Sharing and start it up
// Oh and I had some problems with it when system was set to CZECH. When I HRed and did the same process in English, it worked fine ?!.
// You can also try my all-in-one provxml file on http://wp7.ondraster.cz/all.7z - deploy it via the Isolated Storage Explorer to the diagprovxml application and after running it, reboot the phone. I am not testing it, I already reset my phoe 5 times today. Sorry
See OndraSter's post for the file. Click the little arrow next to his name above in the quote.
Click to expand...
Click to collapse
boredtoday said:
a small step by step instructions i made for all of us newbies in this thread (all credits go to OndraSter):
FIRST THINGS FIRST
You need a developer unlocked Omnia 7 / Focus on Mango
WHAT YOU NEED
Isolated Storage Explorer
NOTE: unpack and install vm_web2.exe first (it will download a 500mb++ file during installation, so it's best to do this first). then unpack ISE_GUI_1.1.rar, inside is the isolated storage explorer)
needed xml's (hs.zip)
DiagProvXML v0.9
Interop Unlock by Heathcliff74 v2.xap
WP7 Root Tools
INSTRUCTIONS
1. Remove (uninstall) Network Profile application and remove any APN you set up in settings -> cellular
2. InterOP-unlock your device (Heathcliff)
3. Install DiagProvXML app on your phone
4. Using Isolated Storage Explorer deploy enclosed provxml files in hs.zip
4.a to do this: run Isolated storage explorer on your PC with your device plugged in and screen-unlocked. (DiagProvXML does not need to be running on your phone)
4.b paste this value on Product GUID text box: 566814df-f6b6-4154-8be5-9e65dce907c0
4.c click GET DATA button and save on your desktop.
4.d open the downloaded folder and paste there the 4 xml files from hs.zip
4.e click the Upload folder to Isolated Storage and select the same folder you just worked on, and upload!​
5. Run DiagProvXML on your phone, swipe to ISO Store and you should see the xml files, hold and click execute on each one following this order: hotspot, hotspot1, mxip_hotspotconfig_01, EnableAutoDataConfig.
6. Check in settings that you can now see Internet Sharing between Bluetooth and accounts!
7. Reboot
8. Deploy WP7 Root Tools (Heathcliff)
9. Now launch WP7 Root Tools and go to Local Machine -> Comm -> InternetSharing -> Settings and manualy add new value (+val button):
Value Name: Name, Value Type: String, Value Data: Value ... hit save
Value Name: EntitlementURI, Value Type: String, Value Data: ./Vendor/MSFT/Registry/HKLM/Comm/InternetSharing/Settings/OpenMarketEnabled ... hit save
Value Name: OpenMarketEnabled, Value Type: dword, Value Data: 1 ... hit save​
10. Clear "CellularConnectionName" (aka set Value Data to empty)
11. and you can go to settings -> Internet Sharing and start it up
--END--
Click to expand...
Click to collapse
Post edited to remove outdated info & keep it clean.

What a great news! Finally it's here!

Yeah, but I need it even through cable - because when internet craps out at home, I want to be able to connect even my PC .
(at worst case scenario, I could change router to client mode and connect to phone from there )

OndraSter said:
Yeah, but I need it even through cable - because when internet craps out at home, I want to be able to connect even my PC .
(at worst case scenario, I could change router to client mode and connect to phone from there )
Click to expand...
Click to collapse
Hello OndraSter, long time no see. Glad to see you are WP7 too.
Yeah, I agree about having wired tethering. Luckily my PC has a WiFi adapter, but a decent amount of Desktops don't. No need for WiFi on something that never moved especially when Gigibit LAN is way faster than the fastest WiFi.

If this will be blocked on unbranded/outside of US devices (like voicemail is), I will be really pissed off!

Snake. said:
If this will be blocked on unbranded/outside of US devices (like voicemail is), I will be really pissed off!
Click to expand...
Click to collapse
Visual Voicemail is dependent on your carrier, tethering isn't though they could very well hide the setting via registry. So, even if they do hide it, we'll be able to unhide it with a registry hack, same as how some devices have the "never" option for the lockscreen timeout & the accessibility options disabled.

Why are you so sure?

Snake. said:
Why are you so sure?
Click to expand...
Click to collapse
Update II: Rafael Rivera notes "Confirm ICS is baked into my Mango phone (e.g. Ics*.dll, HKLM\Comm\InternetSharing). My guess is requires carrier "update" to enable."
Click to expand...
Click to collapse
This quote has a registry directory that wasn't in the Beta 2 Emulator Dump. I have the full registry from a dumped emulator of 7692 compiled & this directory isn't in it. I'm trying to find a new 7720 dump to so I can compile it's registry.
EDIT: It appears this directory exists in NoDo 7392. I just opened my registry editor & manually added this key & it shows up as (unavailable info). I wonder if this means tethering was always there but hidden.

soooo.... anyone with an unlocked rtm mango willing to take a shot at enabling it?
Sent from my HD7 using Board Express

mike21pr said:
soooo.... anyone with an unlocked rtm mango willing to take a shot at enabling it?
Click to expand...
Click to collapse
I would try but my registry editor always crashes when I open it up.

mike21pr said:
soooo.... anyone with an unlocked rtm mango willing to take a shot at enabling it?
Sent from my HD7 using Board Express
Click to expand...
Click to collapse
We could try, but we need the entire regkey. Parameters and such.

kwill said:
We could try, but we need the entire regkey. Parameters and such.
Click to expand...
Click to collapse
Maybe this will help (found in netcore.7.10.7654.1-7.10.7720.68.cab's RGU);
Services\ICS _ IcsService ServiceContex (ICS Connection Sharing disable-value is DWord:4 (DEVFLAGS_NOLOAD); enable value is DWord:12 (DEVFLAGS_LOADLIBRARY|DEVFLAGS_LOAD_AS_USERPROC)
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
EDIT: From further examination of the RTM update packages. Internet Sharing seems to be in 7712 as well. The netcore.7.10.7712.60-7.10.7720.68.cab doesn't have an RGU & has a few updates to a couple DLL's (icscsp.dll/IcsService.dll/intshare.dll) & the netcore.7.10.7718.66-7.10.7720.68.cab has nothing new added to ICS aka Internet Connection Sharing.

Can someone running Mango RTM 7720 that has TouchXplorer Side Loaded & working as well as the PC USB Enable hack please copy out \Windows\E58CB45D-B3FE-405d-85CF-4D19C2AE80BE.rgu & upload it here? It should be around 15.5 KB in size as the NoDo RGU is 12.5 KB & the 7720 update RGU is 3 KB, which get's added to the existing RGU in \Windows\. You should be able to copy it out as I am running NoDo was able to pull it out with WPDM, but it doesn't work in Mango so you'll need to use TouchXplorer/USB Hack. I might be able to find the exact registry value with this file.

Well if thats true, then maybe we can get access to it via provxml... Just like chevron, dont we?

I posted this in a new thread at PPCG also. no longer is no tethering a deal breaker for those on the edge.

drkfngthdragnlrd said:
Can someone running Mango RTM 7720 that has TouchXplorer Side Loaded & working as well as the PC USB Enable hack please copy out \Windows\E58CB45D-B3FE-405d-85CF-4D19C2AE80BE.rgu & upload it here? It should be around 15.5 KB in size as the NoDo RGU is 12.5 KB & the 7720 update RGU is 3 KB, which get's added to the existing RGU in \Windows\. You should be able to copy it out as I am running NoDo was able to pull it out with WPDM, but it doesn't work in Mango so you'll need to use TouchXplorer/USB Hack. I might be able to find the exact registry value with this file.
Click to expand...
Click to collapse
Can you please explain or post a link on how to do the PC USB Enable hack? I have TouchXplorer running but if I can do the PC USB Enabled hack then I get my \Windows\E58CB45D-B3FE-405d-85CF-4D19C2AE80BE.rgu and upload it here.

JosepHenry said:
Can you please explain or post a link on how to do the PC USB Enable hack? I have TouchXplorer running but if I can do the PC USB Enabled hack then I get my \Windows\E58CB45D-B3FE-405d-85CF-4D19C2AE80BE.rgu and upload it here.
Click to expand...
Click to collapse
See this;
http://forum.xda-developers.com/showthread.php?t=1069568
This tool allows you to access your WP7 in Windows Explorer as a USB Storage device as long as Zune is closed. You need to copy that file to \My Documents\Zune\Content\ with TouchXplorer & than on you PC access the "USB Mode WP7" to copy it to your PC.

When I do this the only thing I am able to see is just four sub folders. Albums, Artists, Music, and Pictures. Am I doing something wrong?

JosepHenry said:
When I do this the only thing I am able to see is just four sub folders. Albums, Artists, Music, and Pictures. Am I doing something wrong?
Click to expand...
Click to collapse
Nope, those are the folder that are on your device under \My Documents\Zune\Content\(# Value)\.
You use TouchXplorer to copy from \Windows\ to \My Documents\Zune\Content\(# Value)\ & than on your PC you'll see it in one of the folders you mentioned.

So would it show up it copy the file into one of folders with a # value?

[HACK] Using complete Windows API in Windows Store app (c++)

As we know, MS prohibits using most of standard Win32 API in Windows Store applications. Obviously there are lots of ways to overcome this limit and to call any API you like, if you are not going to publish your app on Windows Store. And here is one of them.
Idea is really simple and rather old (lots of viruses use it): search for kernel32.dll base in memory, then parse its exports for LoadLibraryA and GetProcAddress, call them - and get profit.
Writing here so this post can be indexed by google.
Partial code:
Code:
void DoThings()
{
char *Tmp=(char*)GetTickCount64;
Tmp=(char*)((~0xFFF)&(DWORD_PTR)Tmp);
while(Tmp)
{
__try
{
if(Tmp[0]=='M' && Tmp[1]=='Z')
break;
} __except(EXCEPTION_EXECUTE_HANDLER)
{
}
Tmp-=0x1000;
}
if(Tmp==0)
return;
LoadLibraryA=(t_LLA*)PeGetProcAddressA(Tmp,"LoadLibraryA");
GetProcAddressA=(t_GPA*)PeGetProcAddressA(Tmp,"GetProcAddress");
CreateProcessA=(t_CPA*)PeGetProcAddressA(Tmp,"CreateProcessA");
HMODULE hUser=LoadLibraryA("user32.dll");
MessageBoxA=(t_MBA*)GetProcAddressA(hUser,"MessageBoxA");
MessageBoxA(0,"A native MessageBox!","Test",MB_OK);
STARTUPINFO si;
memset(&si,0,sizeof(si));
si.cb=sizeof(si);
PROCESS_INFORMATION pi;
CreateProcessA("c:\\Windows\\system32\\cmd.exe",0,0,0,FALSE,0,0,0,&si,&pi);
}
Complete project is attached. It contains sources and compiled appx files for side-loading.
Code compiles fine for x86/x64 and ARM, tested on x86/x64. Can someone test it on ARM? Ability to sideload metro apps is required.
The application should output a MessageBox, then execute cmd.exe.
A note: Windows Store application runs in a sandbox and as a limited account, so most of API returns "access denied". You can check this in a launched CMD - it displays "access denied" even on a "dir" command because normally "modern ui" apps don't have even read access to c:\.
To overcome this - add "all application packages" full control to the directories/objects you like (for example to c:\).

Works perfectly on my Windows 8 x64 Tablet :good:... its not ARM based though ...

Can i use this to run a non-store app?
Here is the catch, I have managed to get the installed (not the installation) file from a kind member here on XDA. But when I paste the folder in:
C:\Program Files\WindowsApps\Microsoft.ZuneMusic_1.0.927.0_x64__8wekyb3d8bbwe
The app isnt seen on the metro UI?
Any way to start a scanner of some sorts so that I can see the app in Metro.../?
THanx a ton!
Plz feel free to laugh a little at my noobish question...im stil learning..

Works perfectly on my surface RT!
but type dir in CMD returns "access denied".

There are no code signature checks from the command prompt that you launch.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Code:
#include <iostream>
void main()
{
std::cout << "Hello RT World!\n";
}
Compiled as an exe with info in http://stackoverflow.com/questions/...op-programs-be-built-using-visual-studio-2012

Open properties of your disk c:, go to the security tab and add "ALL APPLICATION PACKAGES" == full control. In this cage "dir" command would work, and your apps would be able to access whole filesystem.

Sorry if it's unrelated, but does RT check signatures for loaded DLLs too? Can one run regedit and change some system CLSID to point to unsigned library, will it be loaded?

Simplestas said:
Sorry if it's unrelated, but does RT check signatures for loaded DLLs too? Can one run regedit and change some system CLSID to point to unsigned library, will it be loaded?
Click to expand...
Click to collapse
Unless the dll is loading with a restricted security policy (such as through a Metro app) it is checked, yes.

Excellent work on the 'App1' technique of starting a cmd prompt from a modern app, and the fact it can run other unsigned cmd line apps.
Note that the cmd prompt still runs in the modern app container and probably has lots of restrictions
And also it only runs when the modern app is running and effectively freezes when the modern app goes into the background and suspends
Don't seem to be able to run win32 gui apps from the cmd prompt it starts -- they start but immediately terminate, presumably because the full win32 stuff cant initialise in a modern app container.
But can tum gui win32 api's, like the create dialog one, from the App1 modern app
Luckily we can also test, investigate and debug this on an intel Windows 8 system (dual monitor is best) when trying to work out what is going on, and then test on ARM after that.

@Simplestas: LoadLibrary is also blocked, I'm afraid. One fo the first things I tried was creating a DLL compatible with the built-in rundll.exe program and using that. It failed to load the third-party library.
@xsoliman3: Don't forget the debugger. You can't run it on the RT device right now, but there are (official) tools for debugging RT apps remotely. That should allow connecting to the child process and seeing what happens as it starts up.

GoodDayToDie said:
@Simplestas: LoadLibrary is also blocked, I'm afraid. One fo the first things I tried was creating a DLL compatible with the built-in rundll.exe program and using that. It failed to load the third-party library.
@xsoliman3: Don't forget the debugger. You can't run it on the RT device right now, but there are (official) tools for debugging RT apps remotely. That should allow connecting to the child process and seeing what happens as it starts up.
Click to expand...
Click to collapse
Great seeing you again!
Anyways, I determined from some work with the VS Remote Debugger that the integrity checks are enforced in ZwCreateUserProcess. But, I bet LoadLibrary has its integrity checks in user-mode, since it normally doesn't access any functions using a call-gate to the kernel on Windows 7, which would mean we can modify it to allow us to load unsigned DLL's.
However, with this vulnerability, I had a different. What about allowing a native application to open, such as Notepad, and before it reaches the entrypoint, remotely injecting a different application to be ran (this would involve some sort of custom LoadLibrary + CreateRemoteThread pair of functions)? With the VS Debugger, you can already attach to any native process in user-mode and modify running code, data, and even the context (e.g. registers and similar data).

That suggestion is possible, and for trivial operations (i.e. replacing some strings in a program, or causing it to take one branch instead of another) people have already done so. Doing a wholesale replacement would be tricky, but should be possible (perhaps aided with WinDBG scripts or similar).

GoodDayToDie said:
Doing a wholesale replacement would be tricky
Click to expand...
Click to collapse
Not so tricky, I've already made a prototype on desktop Win8. Just make an ARM DLL that implements a PE loader using only 2 WinAPI functions - LoadLibrary (used only to get kernel32 handle) and GetProcAddress. Inject that DLL code and data sections via debugger, fixup relocs (you can minimize their amount in your "loader DLL" by not using global variables, placing all code into one file, not using CRT at all, and so on, ARM makes it easy to create position-independent code), and call your injected code via debugger passing it the address of LoadLibrary and GetProcAddress as parameters. Your code than would do what you wish - load and execute an unsigned DLL that you specify.
With this trick you can load EXE files too, as all ARM EXEs contain relocs by default.
But this way is too inconvenient to the end-user, so should be avoided. I really think that MS left enough holes for us to "unlock" unsigned apps on retail WinRT devices.
I'm already thinking on buying an Asus tablet with 3G (instead of waiting for a better device that I wish), so after NY holidays I'll join your game

Ah, that's a much more clever approach than actually trying to load the full program using the debugger itself... if it works. LoadLibrary triggers the same signature check that CreateProcess does (or rather, the system calls that they do will perform that check; if it was user-mode we could bypass it with the debugger). Your method may work, but since the desktop doesn't have the signature check anyhow, prototyping it there doesn't actually mean it will work on RT. Try it out and let us know how it goes, and if it works, posting your source would be awesome!

GoodDayToDie said:
Ah, that's a much more clever approach than actually trying to load the full program using the debugger itself... if it works. LoadLibrary triggers the same signature check that CreateProcess does (or rather, the system calls that they do will perform that check; if it was user-mode we could bypass it with the debugger). Your method may work, but since the desktop doesn't have the signature check anyhow, prototyping it there doesn't actually mean it will work on RT. Try it out and let us know how it goes, and if it works, posting your source would be awesome!
Click to expand...
Click to collapse
He doesn't mean making a prototype and importing from kernel32.dll. He means manually mapping the PE file, then using either CreateRemoteThread or modifying the context of a thread already launched to run it once it's in the memory address of another process. It's basically DLL injection with our own implementation of LoadLibrary. It would work because LoadLibrary doesn't use any system calls except to map memory (and mapping memory doesn't have integrity checks of any sort, and it shouldn't be design -- e.g. VirtualAlloc).
A bigger problem I thought of is automating this. I took a quick peek with Wireshark at my remote debugging session and saw HTTP with what appeared to be a proprietary protocol. In order to automate this from another computer (or any mobile device for that matter), we would need to reverse engineer the protocol. Or, an alternative would be to hook into Visual Studio once the debugging session is launched (maybe just a nice VS plugin would work?).

mamaich said:
Code:
void DoThings()
{
char *Tmp=(char*)GetTickCount64;
Tmp=(char*)((~0xFFF)&(DWORD_PTR)Tmp);
while(Tmp)
{
__try
{
if(Tmp[0]=='M' && Tmp[1]=='Z')
break;
} __except(EXCEPTION_EXECUTE_HANDLER)
{
}
Tmp-=0x1000;
}
if(Tmp==0)
return;
Click to expand...
Click to collapse
I was looking through the provided sample -- wouldn't our own GetModuleHandleA implementation be a better way of doing this? I'm just thinking should the alignment be changed in kernel32.dll it may be better to have something like this:
Code:
522 if (!name)
523 {
524 ret = NtCurrentTeb()->Peb->ImageBaseAddress;
525 }
526 else if (flags & GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS)
527 {
528 void *dummy;
529 if (!(ret = RtlPcToFileHeader( (void *)name, &dummy ))) status = STATUS_DLL_NOT_FOUND;
530 }
Source: http://source.winehq.org/source/dlls/kernel32/module.c#L504
Grabbing the Peb (NtCurrentTeb()->Peb) would involve pulling from the FS register at offset 0x30. Implementing this on ARM could be trickier, as I'm not sure of the inline assembly or availability of intrinsics (not to mention, it would be stored somewhere else than the FS register).
Now, for the PC, it appears __readfsdword is available as an intrinsic, so this *should* work on x86 installations of Windows 8.

mamaich said:
Not so tricky, I've already made a prototype on desktop Win8. Just make an ARM DLL that implements a PE loader using only 2 WinAPI functions - LoadLibrary (used only to get kernel32 handle) and GetProcAddress. Inject that DLL code and data sections via debu
Click to expand...
Click to collapse
I think this approach (of injecting own loader as far as understand) has such problem(even if implemented & automated)
Loaded exe can have own dependant dlls(any complicated-usefull proj has) that it cant load because of signing checks (and even more problems if it uses dynamic loading of own dlls and getprocaddress)
Or do i miss somth in your idea?

Will I be able to read/write to a parallel port using this method? Do the limited store apps have sufficient permissions to do that? Writing to a parallel port requires calling
Code:
hndleLPT = CreateFile("LPT1",(GENERIC_READ | GENERIC_WRITE), 0, 0, OPEN_EXISTING, 0, 0);
. Will this succeed?
Will I be able to successfully load this: http://www.highrez.co.uk/Downloads/InpOut32/default.htm ?
---------- Post added at 03:01 PM ---------- Previous post was at 02:11 PM ----------
This looks like an improved method to get the base address:
http://tedwvc.wordpress.com/2013/07/19/finding-the-kernel32-dll-module-handle-in-a-windows-store-app-using-approved-apis/

You should be able to do that using CreateFile2, which is permitted in Store apps already (no need to use the rest of the Win32 API). As for the permissions, I don't know, but it will probably work.
I mean, assuming your computer *has* an LPT port. I haven't seen one of those in a while...

how about the other way round? can a desktop app have access to the full windows 8 api (including those reserved for win store apps only)?

Looking for a way to Upgrade Cube WP10 Phablet to Redstone 2

I have purchased a few of the Cube WP10 phablets and am actually impressed. However, they ship with Windows 10 Mobile release 1511. I have enrolled in the Insiders Program, but nothing happens. Does anyone have an idea on how to force an upgrade to 1607? This device is not listed in the wdrt tool, nor are there any software/firmware updates on the Cube-tablet website. I would be willing to risk experimentation with this device, but don't know how to fool the phone into forced update. Any suggestions??

It worked for me (does not need the windows insider app)
You can use the same method I used in my lumia 630, just do not know if it will work on your phablet.
Go to all settings-> system-> about and reset your phone
After reset do the interop unlock
You will need to have access to the registry keys
Depending on whether your phablet is dual yes or no, place the following keys
HKLM -> SYSTEM -> Platform -> DeviceTargetingInfo
"PhoneManufacturer" = MicrosoftMDG
"PhoneManufacturerModelName" = RM-1085_11302 (for Single SIM devices)
// *** For all dual sim devices try = RM-1116_11258 ***
PhoneModelName = Lumia 950 XL (single sim) or Lumia 950 XL Dual SIM (for dual)
PhoneHardwareVariant = RM-1085
// *** For all dual sim devices try = RM-1116***
Apply the keys, and then restart the device.
Note: you do not need windows insider, but a lot of patience.
The update will not be available as soon as you restart, you will have to wait for the microsoft servers to recognize that your device is upgraded.
I had to wait for more than 24 hours to recognize the update.
And of course, need to have internet on the device during that period.
Note: Do not tamper with the registry keys again until it recognizes the update

Hello, it's me again.
Hello
I also have a cube wp10
I've enabled developer mode in the settings
And I just put the registry keys as follows
HKLM -> SYSTEM -> Platform -> DeviceTargetingInfo
PhoneManufacturer = MicrosoftMDG
PhoneManufacturerModelName = RM-1116_11258
PhoneModelName = Lumia 950 XL Dual SIM
PhoneHardwareVariant = RM-1116
I then installed windows insider
I chose the ring
And then he will restart
Then go on updates and it will be there

Any Problems with RS2 upgrade?
Hello Eguif,
I will be trying the upgrade method that you outline below. Have there been any*problems with the device since you upgraded? What is the*latest insider version that you have now installed on the Cube WP10?
Thanks,
RicketyTiger
eguif said:
Hello
I also have a cube wp10
I've enabled developer mode in the settings
And I just put the registry keys as follows
HKLM -> SYSTEM -> Platform -> DeviceTargetingInfo
PhoneManufacturer = MicrosoftMDG
PhoneManufacturerModelName = RM-1116_11258
PhoneModelName = Lumia 950 XL Dual SIM
PhoneHardwareVariant = RM-1116
I then installed windows insider
I chose the ring
And then he will restart
Then go on updates and it will be there
Click to expand...
Click to collapse

Hello RicketyTiger
RicketyTiger said:
Hello Eguif,
I will be trying the upgrade method that you outline below. Have there been any*problems with the device since you upgraded? What is the*latest insider version that you have now installed on the Cube WP10?
Thanks,
RicketyTiger
Click to expand...
Click to collapse
The only problem I noticed was that it does not change the language, with only English remaining.
The windows version is 1607
And build is 10.0.14393.67

Hi RicketyTiger
I took a picture of him.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If you wonder why the screen size is different is because I used the key of the lumia 1520
If you wonder why the icons are different is because I used the app transform for this
In case you wonder how I managed to install applications that are not in the store is because I did the interop unlock

I guess I am lost...
Hi again,
I installed Interop and opened registry without problem. I could also navigate to HKDM SYSTEM Platform and prepare to add the DeviceTargetInfo line. However, I have not done this because I do not know how or where to add the PhoneManufacturer, xxModelName, xxHardwareVariant lines. I guess I am more of a novice than I realize. Can you further explain? Thanks
RicketyTiger
eguif said:
I took a picture of him.
View attachment 3981478
If you wonder why the screen size is different is because I used the key of the lumia 1520
If you wonder why the icons are different is because I used the app transform for this
In case you wonder how I managed to install applications that are not in the store is because I did the interop unlock
Click to expand...
Click to collapse

It's okay to get lost at first, it happens to everyone.
RicketyTiger said:
Hi again,
I installed Interop and opened registry without problem. I could also navigate to HKDM SYSTEM Platform and prepare to add the DeviceTargetInfo line. However, I have not done this because I do not know how or where to add the PhoneManufacturer, xxModelName, xxHardwareVariant lines. I guess I am more of a novice than I realize. Can you further explain? Thanks
RicketyTiger
Click to expand...
Click to collapse
You already have access to the registry keys and that's fine.
DeviceTargetingInfo is a folder and you must enter it
When you enter it there will be several keys.
You will not create or add any keys, you will only modify the value of some keys.
The first key:
PhoneManufacturer
Change the value that is inside the key by this:
MicrosoftMDG
The second key:
PhoneManufacturerModel
Change the value that is inside the key by this:
RM-1116_11258
The third key:
PhoneModel
Change the value that is inside the key by this:
Lumia 950 XL Dual SIM
And finally the fourth and last key:
PhoneHardwareVariant
Change the value that is inside the key by this:
RM-1116

Thanks!!
When I browse the registry, Interop Tool crashes each time that I select Platform. It appears as though DeviceTargetingInfo folder does not exist. If I try to create
eguif said:
You already have access to the registry keys and that's fine.
DeviceTargetingInfo is a folder and you must enter it
When you enter it there will be several keys.
You will not create or add any keys, you will only modify the value of some keys.
The first key:
PhoneManufacturer
Change the value that is inside the key by this:
MicrosoftMDG
Finally figured it out. Update is downloading now. Kindly reply in this conversation if you discover any noteworthy issues or opportunities with Cube WP10 and Redstone 2. I will do the same.
Again, many thanks.
The second key:
PhoneManufacturerModel
Change the value that is inside the key by this:
RM-1116_11258
The third key:
PhoneModel
Change the value that is inside the key by this:
Lumia 950 XL Dual SIM
And finally the fourth and last key:
PhoneHardwareVariant
Change the value that is inside the key by this:
RM-1116
Click to expand...
Click to collapse

Hello RicketyTiger, it's me again.
RicketyTiger said:
When I browse the registry, Interop Tool crashes each time that I select Platform. It appears as though DeviceTargetingInfo folder does not exist. If I try to create
Click to expand...
Click to collapse
We need to see some points before.
You mentioned that the interop tools hang when you enter Platform
Make sure Developer Mode is enabled under All Settings> Update and Security> for Developers
If not, enable developer mode and retry accessing the Platform folder and make sure the interop tools do not crash
You do not need to create registry keys, they already exist
I need your feedback to proceed.

All Is Well
Hi Eguif,
I actually was successful in getting the registry modified and upgrading to 1607. Please ignore the previous post. Many thanks to you for all of your help. Today I used the off-line Maps and GPS features including voice navigation. It was quite funny to hear the girl provide English navigation, except when she needed to speak numbers -- those were spoken in what I presume to be Chinese. Hilarious!!
Thanks again,
RicketyTiger
eguif said:
We need to see some points before.
You mentioned that the interop tools hang when you enter Platform
Make sure Developer Mode is enabled under All Settings> Update and Security> for Developers
If not, enable developer mode and retry accessing the Platform folder and make sure the interop tools do not crash
You do not need to create registry keys, they already exist
I need your feedback to proceed.
Click to expand...
Click to collapse

Hi RicketyTiger
RicketyTiger said:
Hi Eguif,
I actually was successful in getting the registry modified and upgrading to 1607. Please ignore the previous post. Many thanks to you for all of your help. Today I used the off-line Maps and GPS features including voice navigation. It was quite funny to hear the girl provide English navigation, except when she needed to speak numbers -- those were spoken in what I presume to be Chinese. Hilarious!!
Thanks again,
RicketyTiger
Click to expand...
Click to collapse
I'm very happy to hear that you succeeded.
And I would recommend that you do not stop now but continue to explore more about registry keys and hacks.
Try to get the most out of your phablet's potential
You will be surprised.
And I have to thank you for starting this topic.
Until another time,
Eguif

eguif said:
I'm very happy to hear that you succeeded.
And I would recommend that you do not stop now but continue to explore more about registry keys and hacks.
Try to get the most out of your phablet's potential
You will be surprised.
And I have to thank you for starting this topic.
Until another time,
Eguif
Click to expand...
Click to collapse
Has anyone been able to load alternative language packs onto this Phablet? or Continuum? There is some real scope to make this budget phone much better! I am a real novice, and can see that it is possible for other WM phones, but unsure quite where to start.
Any help would be gratefully received!

Hello TheFernando2
TheFernando2 said:
Has anyone been able to load alternative language packs onto this Phablet? or Continuum? There is some real scope to make this budget phone much better! I am a real novice, and can see that it is possible for other WM phones, but unsure quite where to start.
Any help would be gratefully received!
Click to expand...
Click to collapse
I was able to put language packs and also put the continuum.
But before proceeding, I need to know what your windows version is on your phablet.

eguif said:
I was able to put language packs and also put the continuum.
But before proceeding, I need to know what your windows version is on your phablet.
Click to expand...
Click to collapse
The OS build is: 10.0.14393.693
Version 1607

Hello TheFernando2
TheFernando2 said:
The OS build is: 10.0.14393.693
Version 1607
Click to expand...
Click to collapse
You will need a computer
The following link will take you to the Microsoft Updates page
Https://www.catalog.update.microsoft.com
In the search box type 000-(abbreviation of your language)
example:
000-br (br means Brazilian Portuguese)
000-us (us means English)
000-fr (fr means French)
Put the abbreviation of your language
Then find your version and click download
Will open a new window
In this new window press ctrl + f and enter the abbreviation of your language
Click only those that have cbs signature and not those with cbsu signature
And the download will start
next step
Download this file and put it inside a folder and folder needs to be inside C:\
View attachment iutool.7z
Create a new folder also inside C:\
This folder is where the downloaded files should be
But only a .cab file can be in this folder
Then open the cmd as administrator and enter the iutool folder
Example: cd C:\'name of the folder you extracted the zip file from'
Place without the quotation marks
Press enter
And then type: uitool -p 'folder name with the .cab file'
Without the quotation marks
Press enter
Wait a few moments and your phone will restart
If it does not work try with others .cab files downloaded
You can only put in the folder created one at a time
I need your feedback to find out how you do.

I need your feedback to find out how you do.[/QUOTE]
Thank you for such as detailed response. Very appreciated.
I have downloaded all the files, how ever the iutool file isn't working. Initially I was getting 2 missing .DLL errors.
MSVCP110.dll and MSVCR110.dll
So I copied the other iutool.exe file into the iutool directory. Then I got this error within the command prompt:
ERROR: 0x80070490
command failed. (HRESULT = 0x80070490)
I tried this with all the .cab files in the cab folder and with one at a time
There are 7 cab files.
I am using a MS Surface Pro4 if it make any difference.. (Can't see why, but in case!)
Can I ask, are the 2 docking .cab files I need in the catalog you pointed me to?
Thank you again
---------- Post added at 09:31 PM ---------- Previous post was at 08:51 PM ----------
it appears that iutool is not connecting to my phablet.. Any idea?

Hello TheFernando2
TheFernando2 said:
I need your feedback to find out how you do.
Thank you for such as detailed response. Very appreciated.
I have downloaded all the files, how ever the iutool file isn't working. Initially I was getting 2 missing .DLL errors.
MSVCP110.dll and MSVCR110.dll
So I copied the other iutool.exe file into the iutool directory. Then I got this error within the command prompt:
ERROR: 0x80070490
command failed. (HRESULT = 0x80070490)
I tried this with all the .cab files in the cab folder and with one at a time
There are 7 cab files.
I am using a MS Surface Pro4 if it make any difference.. (Can't see why, but in case!)
Can I ask, are the 2 docking .cab files I need in the catalog you pointed me to?
Thank you again
---------- Post added at 09:31 PM ---------- Previous post was at 08:51 PM ----------
it appears that iutool is not connecting to my phablet.. Any idea?
Click to expand...
Click to collapse
I'm sorry for my mistake
By an oversight I ended up putting two iutool
The correct iutole is the one with a size of 2.38 MB that is zipped in my previous post with the extension .7z
As for the error of the two .dll files, it is because you opened the wrong file that I accidentally sent.
So as not to confuse you, I'll send the file again
View attachment iutool.7z
As for the command prompt, there will always be an error, you should only be careful if after a few seconds after the error phablet restarts
As for your last question, I did not quite understand what you meant, could you clarify your question?
As for the surface
I do not think there's any difference

eguif said:
As for the command prompt, there will always be an error, you should only be careful if after a few seconds after the error phablet restarts
As for your last question, I did not quite understand what you meant, could you clarify your question?
Click to expand...
Click to collapse
My question is how do I know that my phablet has is connected to the PC correctly for the iutool to work. When I type iutool -l which should say what phone is connected it does not return any phones as being connected. The PC recognises the phone and shows it in explorer.
I will try the alternative file you kindly send.
Thank you
---------- Post added at 08:24 PM ---------- Previous post was at 08:11 PM ----------
TheFernando2 said:
My question is how do I know that my phablet has is connected to the PC correctly for the iutool to work. When I type iutool -l which should say what phone is connected it does not return any phones as being connected. The PC recognises the phone and shows it in explorer.
I will try the alternative file you kindly send.
Thank you
Click to expand...
Click to collapse
Edit:
Hi I have tried that and I am getting the 2 missing .dll errors still
I appreciate your help!

well, idon´t know for sure, but maybe can be posible to add more languages to this phablet, in the same way that we do in the xiaomi mi4. take a look to this post.
https://forum.xda-developers.com/wi...orial-how-to-add-languages-to-xiaomi-t3455311
Of course, you have to do this before you update the system, just after done a hard reset.

BDS Menu on non Prototype devices

Code:
#include <std_disclaimer.h>
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this package
* before installing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You read it right, here's a functional port of BDS Menu for Lumias unlocked using WPInternals.
Note: I observed some weird behaviors on early x30 devices, including prototypes that had BDS menu out of the box, where the menu would simply act like if it was broken.
The bootarm.efi loader has been taken from the grub package posted here and modified to load menu.efi instead of boot.efi, credits belong to the original person that developed this efi in 2016.
Note: attached two variants, a normal one (fs3) and a fs4 variant, if you get an error about the menu not finding its configuration files, please try the other variant.
Installation instructions:
Download the files attached in this post.
Place all files downloaded in the EFIESP partition of your phone.
Configure BCD exactly like this to have an entry loading BDS menu:
Load the entry using your favorite method.
Have fun.

That shim file might not work on 950XL, it simply reboots my phone - haven't figured out why, probably due to new CPU architecture or the firmware itself

Thanks gus ,
you can also restore the USB Mass Storage picture by adding attached bmpx files in EFIESP\Windows\System32\BOOT\ui.

gus33000 said:
Configure BCD exactly like this to have an entry loading BDS menu:
Load the entry using your favorite method.
Click to expand...
Click to collapse
How?

augustinionut said:
How?
Click to expand...
Click to collapse
To be fair as some of the capabilities of BDS menu can be very destructive (hence the big disclaimer), if you really don't know how to do this, then you may stay away from it, it won't bring you anything cool

Please, y have the lumia 530 lab rat.
Nevermind, ill modify EFIESP\efi\Microsoft\Boot\bcd using visual BCD.

augustinionut said:
Please, y have the lumia 530 lab rat.
Nevermind, ill modify EFIESP\efi\Microsoft\Boot\bcd using visual BCD.
Click to expand...
Click to collapse
You shouldn't use visual BCD. Use BCDEdit since some of the options aren't available and Visual BCD isn't built for phones.

Note: currently looking at a problem where the block id for efiesp might differ between phones, if you get an error message saying can't load menu configuration file, please tell me your device model.
Edit: Fixed for some other problematic devices, I'll send an alternative version of the menu to see if it fixes it for most with the two variants

imbushuo said:
That shim file might not work on 950XL, it simply reboots my phone - haven't figured out why, probably due to new CPU architecture or the firmware itself
Click to expand...
Click to collapse
Yes same problem on 950.

Could you explain how to configure bcd using bcdedit please?

CosminNTT said:
Could you explain how to configure bcd using bcdedit please?
Click to expand...
Click to collapse
like this...
also need add device
bcdedit /store .\BCD /set "{7e1bd2b8-0ab0-11e8-aa3b-1c3947b79a68}" device partition=f:\efiesp
and(in my case) add it to customactions( activation by vol up/down )
bcdedit /store .\BCD /set "{bootmgr}" custom:54000002 "{7e1bd2b8-0ab0-11e8-aa3b-1c3947b79a68}"
(custom:54000002 == vol down, custom:54000001 == vol up)

The first time a came across this menu was on the Mi4 W10M rom. Thanks for sharing this.

Does not work on my lumia 950 it just seems to fit into ARM V7 with 32 bit architecture

Someone can copypaste those commands instead of attaching pictures?
Nevermind, i OCR that photo:
PS I:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /create /application bootapp
xxxxxxxxxxxxxxx succesfuly created
PS I:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" path \efi\bds\bootarm.efi
PS I:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" description "BDS Menu"
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" locale en-us
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" inherit "{bootloadersettings}"
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" nonintegritychecks yes
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" testsigning yes
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" isolated context yes
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "xxxxxxxxxxxxxxx" device partition=i:\efiesp
PS i:\EFIESP\efi\Microsoft\Boot> bcdedit /store .\BCD /set "{bootmgr}" custom:54000002 "xxxxxxxxxxxxxxx"

at least mass storage bootable not via WPI only x3x x4 x

The menu is shown but no option works in Lumia 640 RM-1109

mateusseiboth said:
The menu is shown but no option works in Lumia 640 RM-1109
Click to expand...
Click to collapse
On my device too(
I run efi shell with simple script(for run another efi file) and shell thrown "security violation"...
grub2(chainload) thrown error too((

I can't edit bcd file no matter what I do. Cmd and ps keep saying access denied.

mateusseiboth said:
The menu is shown but no option works in Lumia 640 RM-1109
Click to expand...
Click to collapse
Same thing with 950. It just blinks and nothing happens.

BlueTR said:
I can't edit bcd file no matter what I do. Cmd and ps keep saying access denied.
Click to expand...
Click to collapse
run cmd/powershell by administrator