DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

ultrashot · Apr 25, 2012

djtonka said:
Ok I did it by pulling out battery and then HR. But I cant find any of this apps or extra themes etc...I can install many apps but not the ones with fullinterop required...any clue?

Are You sure You uploaded correct file? I have nothing from Your list

1) I am not a developer (his nick is written in the post)
2) I am quite sure file is correct - there are many reports about succesfull installation in russian forums.
3) Check mirror (Narod.ru) link.

djtonka · Apr 25, 2012

Ok L710 fully unlocked

Those 2 parts are wrong. I used to narod.ru

---------- Post added at 07:29 PM ---------- Previous post was at 06:40 PM ----------
http://www.youtube.com/watch?v=-rQbFp7yasc

biktor_gj · Apr 25, 2012

djtonka said:
Ok L710 fully unlocked
Those 2 parts are wrong. I used to narod.ru

---------- Post added at 07:29 PM ---------- Previous post was at 06:40 PM ----------
http://www.youtube.com/watch?v=-rQbFp7yasc

CAN WE KEEP THIS FOR DEVELOPMENT ONLY PLEEEEEEEEEEEEEASSSEEEEE?

Gift from our friends at Qualcomm:

Full AMSS firmware + Secboot Sources (Qualcomm loader)! Grab it while it's hot!

http://www.mediafire.com/?ir2h15f663ja6wc

beidl · Apr 25, 2012

biktor_gj said:
can we keep this for development only pleeeeeeeeeeeeeassseeeee?

Gift from our friends at qualcomm:

Full amss firmware + secboot sources (qualcomm loader)! Grab it while it's hot!

http://www.mediafire.com/?ir2h15f663ja6wc

epic! Nerd boner engaged!

EDIT: Does it contain any device specific code (like... defines for the 710s panel configuration) or is it for all msm7x30 based devices in general?
That wistron_wvga stuff surely looks interesting...

biktor_gj · Apr 26, 2012

beidl said:
epic! Nerd boner engaged!

EDIT: Does it contain any device specific code (like... defines for the 710s panel configuration) or is it for all msm7x30 based devices in general?
That wistron_wvga stuff surely looks interesting...

This source is, in theory, for the Hisense TS7008. No specific code for nokias, but is for the same platform, so it should, at least boot. And since nokia osbl should be based on secboot, we should be able to find similarities between both... maybe some unpatched hole too?
Worst case scenario, we could still get to know how it boots and debug a little more easily

EDIT:
Did anyone notice this on Nokia's DLOAD enabled SBL?
I0..ANDROID!

Interesting...

Sent from my GT-I9100 using XDA

murga · Apr 26, 2012

yep I saw it day ago... interesting indeed!

Konner920 · Apr 27, 2012

Note to everyone, it's probably easier to just do dd in Linux. I bricked my lumia 710 attempting in windows.

ombadboy · Apr 27, 2012

biktor_gj.. Flashed the UNLOCKED ROM last night for the 800, and I've noticed a couple of bugs, just wanted to let you know

- Some apps just won't uninstall. For some reason, 'pre-installed' apps won't uninstall, as well as some other 3rd party ones. i.e FourSquare shows up twice in my app list, one could be uninstalled, the other one uninstalls, and re-installs on reboot (same as the pre-installed apps).

-A few other apps show up installed twice as well..

-WP7EasyBackup doesn't seem to be working (however my backup was pre-flashing, so that may be the problem. Will look into it in more detail later on)

p.s DPPImplant from ultrashot works like a charm!

biktor_gj · Apr 27, 2012

ombadboy said:
biktor_gj.. Flashed the UNLOCKED ROM last night for the 800, and I've noticed a couple of bugs, just wanted to let you know

- Some apps just won't uninstall. For some reason, 'pre-installed' apps won't uninstall, as well as some other 3rd party ones. i.e FourSquare shows up twice in my app list, one could be uninstalled, the other one uninstalls, and re-installs on reboot (same as the pre-installed apps).

-A few other apps show up installed twice as well..

-WP7EasyBackup doesn't seem to be working (however my backup was pre-flashing, so that may be the problem. Will look into it in more detail later on)

p.s DPPImplant from ultrashot works like a charm!

Don't worry, I will build a new custom rom with full unlock based on Tango as soon as I find a firmware with full language support and not only English+Chinese... anyone knows where to find it? I only found one on navifirm and it was that english & chinese...

About bootloaders.... Anyone noticed this?

Code:

/sys_boot/keystore/key.str..Keystore read & decrypt failed!.Random seed init failed!....Security init (%d @ 0x%x)...
Security init status 0x%x...
DETAIL: Keys 0x%08x, 0x%08x, 0x%08x, 0x%08x.....°..â«`.ë³ÿÿê.@-éÛíÿëž.Oâ¦`.ë¬..â¤`.ë.0*ã. *ã..*ãÀ..âŸ`.ëÌ..â.`.ëä..â›`.ë«.Oâ™`.ë..*ãG.*ãš..ë..Pãì.Ÿ.ì Ÿ.ì.Ÿ..0..è.Ÿ.3ÿ/.Jÿÿë_±.ë..*ã‚c.ëVõÿë..Pã..*.....Ä..â…`.ë.
.*ãmc.ëtc.ë.@½èžþÿê.ÿ/á
[B]Security init skipped!..[/B]
======= Secure DLOAD started =======
Version: %d.%d.%d
Compiled: Feb 17 2012, 10:35:39.
====================================

Extracted from one of the latest OSBLs out there...
Anyway of tricking it into that USB HID device it shows sometimes after rebooting from the bootloader?

ombadboy · Apr 27, 2012

biktor_gj said:
Don't worry, I will build a new custom rom with full unlock based on Tango as soon as I find a firmware with full language support and not only English+Chinese... anyone knows where to find it? I only found one on navifirm and it was that english & chinese...

About bootloaders.... Anyone noticed this?

Code:

/sys_boot/keystore/key.str..Keystore read & decrypt failed!.Random seed init failed!....Security init (%d @ 0x%x)... Security init status 0x%x... DETAIL: Keys 0x%08x, 0x%08x, 0x%08x, 0x%08x.....°..â«`.ë³ÿÿê.@-éÛíÿëž.Oâ¦`.ë¬..â¤`.ë.0*ã. *ã..*ãÀ..âŸ`.ëÌ..â.`.ëä..â›`.ë«.Oâ™`.ë..*ãG.*ãš..ë..Pãì.Ÿ.ì Ÿ.ì.Ÿ..0..è.Ÿ.3ÿ/.Jÿÿë_±.ë..*ã‚c.ëVõÿë..Pã..*.....Ä..â…`.ë. .*ãmc.ëtc.ë.@½èžþÿê.ÿ/á [B]Security init skipped!..[/B] ======= Secure DLOAD started ======= Version: %d.%d.%d Compiled: Feb 17 2012, 10:35:39. ====================================

Extracted from one of the latest OSBLs out there...
Anyway of tricking it into that USB HID device it shows sometimes after rebooting from the bootloader?

You can find all the languages in this thread mate: http://xdaforums.com/showthread.php?t=1579419

ombadboy · Apr 27, 2012

Just out of curiosity (no chef my self), do you extract rom, replace langs and repack? Or is there more work to be done (for lang inclusions that is)

n73gamer · Apr 27, 2012

Guys dont give up! I hope you get the Bootloader unlocked soon for the Lumia 800 with the Nokia DLOAD

A friend of mine made this

:

Ricehead · Apr 27, 2012

Hey Guys just a little heads up, Zune is telling me i have an update but my phone's
Versions are as follows ;

OS: 7.10.8107.79
F/W Rev no. 1600.2487.8107.12070
H/W Rev no. 112.1402.2.3
Radio: 1.6.00.24
Bootloader: 7.35.0.0
Chip: 0.74.2.1

I will update an reply with any changes to the bootloader value and the result when going into the bootloader mode

Edit: This is a Nokia update not MS

The update downloaded really fast, Not a full ROM, I'm guessing. (Could be tweaks to the BL, Maybe they found a loophole before we did ?)

---------- Post added at 11:09 PM ---------- Previous post was at 10:40 PM ----------

Sorry wasn't anything important. Just the 12072 F/w
http://blog.vodafone.com.au/blog/nokia-lumia-800-firmware-12070-25042012/

BL Hasn't changed.

surya467 · Apr 28, 2012

yeaa...done this last nite...Theres a thread about this update..
battery performance
charging time fixed
camera addition
volume bug still not fixed

Konner920 · Apr 28, 2012

I'm probably either lost or just dumb, but can someone clarify with me if it's possible to even activate WP7 to access windows live services, I have the Lumia 710 and I have the Tango rom flashed.

edit: called microsoft and they gave me a product key.

EDIT2: it wont read on zune.

EDIT: last time I restarted zune and it works now.

biktor_gj · Apr 28, 2012

A little update...

Anyone over here knows assembler?

This function:

Code:

ROM:00005C40 ; ---------------------------------------------------------------------------
ROM:00005C40
ROM:00005C40 loc_5C40                                ; CODE XREF: ROM:00005A74j
ROM:00005C40                                         ; ROM:00005A98j ...
ROM:00005C40                 ADR     R0, aSecurityInitSk ; "Security init skipped!"
ROM:00005C44                 BL      sub_1DEF8
ROM:00005C48                 B       loc_5B1C
ROM:00005C48 ; ---------------------------------------------------------------------------

is called from:

Code:

ROM:00005A54 ; ---------------------------------------------------------------------------
ROM:00005A54
ROM:00005A54 loc_5A54                                ; CODE XREF: ROM:00005A14j
ROM:00005A54                 ADD     R2, SP, #8
ROM:00005A58                 ADD     R1, SP, #0xC
ROM:00005A5C                 ADR     R0, aSys_bootKeys_0 ; "/sys_boot/keystore/key.str"
ROM:00005A60                 BL      sub_B244
ROM:00005A64                 MOVS    R4, R0
ROM:00005A68                 ADREQ   R0, aKeystoreReadDe ; "Keystore read & decrypt failed!"
ROM:00005A6C                 BEQ     loc_5A94
ROM:00005A70
ROM:00005A70 loc_5A70                                ; CODE XREF: ROM:00005A50j
ROM:00005A70                 CMP     R4, #1
ROM:00005A74                 BNE     loc_5C40
ROM:00005A78                 ADD     R4, SP, #0x10
ROM:00005A7C                 MOV     R0, R4
ROM:00005A80                 MOV     R1, #0x24 ; '$'
ROM:00005A84                 BL      sub_5588
ROM:00005A88                 CMP     R0, #0
ROM:00005A8C                 BNE     loc_5A9C
ROM:00005A90                 ADR     R0, aRandomSeedInit ; "Random seed init failed!"
ROM:00005A94
ROM:00005A94 loc_5A94                                ; CODE XREF: ROM:00005A6Cj
ROM:00005A94                 BL      sub_1DEF8
ROM:00005A98                 B       loc_5C40
ROM:00005A9C ; ---------------------------------------------------------------------------

Now, how can we make the key.str reading fail so we can skip the security initialization? Maybe it's nothing, and if security init is skipped it breaks and doesnt even let you flash, but it's another approach to be looked at, no?

Any help out there?
Now to search the nand dumps to try to find that key.str...

EDIT:
Could it have something to do with this?

Code:

FUNCTION  OSBL_ENCRYPT_KEYSTORE

DESCRIPTION
   Encrypt plain key store file.
 
DEPENDENCIES
  Must be done before APPS is released.
  
RETURN VALUE
  None

SIDE EFFECTS
  None

===========================================================================*/
static void osbl_encrypt_keystore( bl_shared_data_type *bl_shared_data )
{
#ifdef FEATURE_SDCC_BOOT
  if ( FALSE == boot_encrypt_file(PLAIN_KEY_STORE_FILE_NAME, ENCRYPT_KEY_STORE_FILE_NAME) )
    OSBL_ERR_FATAL( BL_ERR_OSBL );
#endif
}

ombadboy · Apr 28, 2012

biktor_gj said:

A little update...

Anyone over here knows assembler?

This function:

Code:

ROM:00005C40 ; ---------------------------------------------------------------------------
ROM:00005C40
ROM:00005C40 loc_5C40                                ; CODE XREF: ROM:00005A74j
ROM:00005C40                                         ; ROM:00005A98j ...
ROM:00005C40                 ADR     R0, aSecurityInitSk ; "Security init skipped!"
ROM:00005C44                 BL      sub_1DEF8
ROM:00005C48                 B       loc_5B1C
ROM:00005C48 ; ---------------------------------------------------------------------------

is called from:

Code:

ROM:00005A54 ; ---------------------------------------------------------------------------
ROM:00005A54
ROM:00005A54 loc_5A54                                ; CODE XREF: ROM:00005A14j
ROM:00005A54                 ADD     R2, SP, #8
ROM:00005A58                 ADD     R1, SP, #0xC
ROM:00005A5C                 ADR     R0, aSys_bootKeys_0 ; "/sys_boot/keystore/key.str"
ROM:00005A60                 BL      sub_B244
ROM:00005A64                 MOVS    R4, R0
ROM:00005A68                 ADREQ   R0, aKeystoreReadDe ; "Keystore read & decrypt failed!"
ROM:00005A6C                 BEQ     loc_5A94
ROM:00005A70
ROM:00005A70 loc_5A70                                ; CODE XREF: ROM:00005A50j
ROM:00005A70                 CMP     R4, #1
ROM:00005A74                 BNE     loc_5C40
ROM:00005A78                 ADD     R4, SP, #0x10
ROM:00005A7C                 MOV     R0, R4
ROM:00005A80                 MOV     R1, #0x24 ; '$'
ROM:00005A84                 BL      sub_5588
ROM:00005A88                 CMP     R0, #0
ROM:00005A8C                 BNE     loc_5A9C
ROM:00005A90                 ADR     R0, aRandomSeedInit ; "Random seed init failed!"
ROM:00005A94
ROM:00005A94 loc_5A94                                ; CODE XREF: ROM:00005A6Cj
ROM:00005A94                 BL      sub_1DEF8
ROM:00005A98                 B       loc_5C40
ROM:00005A9C ; ---------------------------------------------------------------------------

Now, how can we make the key.str reading fail so we can skip the security initialization? Maybe it's nothing, and if security init is skipped it breaks and doesnt even let you flash, but it's another approach to be looked at, no?

Any help out there?
Now to search the nand dumps to try to find that key.str...

EDIT:
Could it have something to do with this?

Code:

FUNCTION  OSBL_ENCRYPT_KEYSTORE

DESCRIPTION
   Encrypt plain key store file.
 
DEPENDENCIES
  Must be done before APPS is released.
  
RETURN VALUE
  None

SIDE EFFECTS
  None

===========================================================================*/
static void osbl_encrypt_keystore( bl_shared_data_type *bl_shared_data )
{
#ifdef FEATURE_SDCC_BOOT
  if ( FALSE == boot_encrypt_file(PLAIN_KEY_STORE_FILE_NAME, ENCRYPT_KEY_STORE_FILE_NAME) )
    OSBL_ERR_FATAL( BL_ERR_OSBL );
#endif
}

I got some knowledge on MIPS assembly and some RISC, but that's about it.. not any ARM. Could help you with it after my exams are done, if you dont figure it out by then, since it's a hectic period at the moment!

Briefcase · Apr 28, 2012

biktor_gj said:

A little update...

Any help out there?
Now to search the nand dumps to try to find that key.str...

EDIT:
Could it have something to do with this?

Code:

FUNCTION  OSBL_ENCRYPT_KEYSTORE

DESCRIPTION
   Encrypt plain key store file.
 
DEPENDENCIES
  Must be done before APPS is released.
  
RETURN VALUE
  None

SIDE EFFECTS
  None

===========================================================================*/
static void osbl_encrypt_keystore( bl_shared_data_type *bl_shared_data )
{
#ifdef FEATURE_SDCC_BOOT
  if ( FALSE == boot_encrypt_file(PLAIN_KEY_STORE_FILE_NAME, ENCRYPT_KEY_STORE_FILE_NAME) )
    OSBL_ERR_FATAL( BL_ERR_OSBL );
#endif
}

Good catch, it seems that 'boot_encrypt_file' is not defined in the Hisense source? That's weird right? or have they stripped out everything regarding FEATURE_SDCC_BOOT?

g-gabber · Apr 28, 2012

If the security initialisation was skipped, that means that public-keys were not propetly loaded. Result you will be not able to load any cert for flash files

biktor_gj · Apr 28, 2012

g-gabber said:
If the security initialisation was skipped, that means that public-keys were not propetly loaded. Result you will be not able to load any cert for flash files

What I'd like to know if it security init is skipped, will it refuse to flash anything, or will it put itself in some 'developer mode'?
That 'Security init skipped!' message is a printf, which means its a debug message. You don't read debug messages in production phones unless you're a developer... or someone from Xda

Did you actually tried it or is it a guess?

DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

Inactive Recognized Developer

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Similar threads

Top Liked Posts