DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

Briefcase · May 28, 2012

inket said:
****, then. You seem to know your stuff, any ideas about possible weak areas of the OS ?

I'm not one of the hardcore hackers here, I did dig into the network setup app and noticed the possibility of an exploit but once I informed Heathcliff about that he already had his proof of concept finished and was looking into the driver stuff. I'm not hardcore enough to deal with the low level hacking stuff (disamble arm dlls and such). But I do read a lot here at this forum and that's how you pick up on things.

- Bootloader attemps seems to be stuck for now, at least for the phones that have Nokia DLOAD, it's very hard to bypass the certificate required for flashing or to find a exploit that allows for arbitrary code execution. This is really hardcore stuff.

- Network setup attempts are stuck because of the reasons mentioned in my previous post

- There is also some research done by trying to understand the update progress via Zune. This traffic is encrypted but we don't know yet if the keys used for that are static or dynamic (different for each phone). We did found some keys in the Nokia DLOAD bootloader, but we don't know if they are public or private. If public we may only be able to read the content, not to alter (and reencrypt). This proces is in an early stage.

- Just mentioned STK app possibilities (maybe it's possible to run code via an infected sim card if exploits exist in the app ('s driver) that handles these kind of operations). Not even started yet/requires special hardware.

- Other nokia app's that require interop permissions. I think this is unlikely too be successful as these apps do not use configuration files (like Network Setup's 'database') but instead use hardcoded registry keys inside the program. Changing these values would require altering the program=>mismatch in signatuer=>no go.

Nokia and MS clearly did not make our lives easy, but to be fair I actually think this is a good thing too. With a system as secure as this we are also protected from attempts to hack the system for other reasons than we have (software piracy (very bad for a developers point of view!)/malicious software/etc).

iawa · May 28, 2012

surya467 said:
Was the network setup app already in your firmware when u bought it and turned it ON or did u have to download it from the maretplace?

If u downloaded from marketplace then it is of no use..
thanks for letting know

I know I have updated it via Marketplace but not sure if was on there. Would a factory reset tell me? It is an unlocked Cyan model (hence I think it was on there to help with whatever SIM was installed).

surya467 · May 28, 2012

so guys anyy work??

trenbeth · May 28, 2012

Two questions:

Are we able to get the individual files (like coredll.dll) of WP7 from the filesystem dump (of those Lumias with Qualcomm bootloader)? If so, how do we get them?

I discovered that if you connect the Lumia 800 by USB to the PC, and have Zune running, then the Lumia can use the Internet connection of the PC through USB. Is this a known feature?

ap3rus · May 28, 2012

trenbeth said:
I discovered that if you connect the Lumia 800 by USB to the PC, and have Zune running, then the Lumia can use the Internet connection of the PC through USB. Is this a known feature?

Yes, for every Windows Phone, not just Lumia.

http://www.microsoft.com/windowsphone/en-us/howto/wp7/start/connecting-how-and-when.aspx

And when your phone's connected to your computer using a USB cable and your computer is connected to a network, your phone will choose your computer's network connection over the other connections.

iawa · May 28, 2012

Kind of annoying it just doesn't work the other way OTB too!

inket · May 29, 2012

This might be interesting: http://www.youtube.com/watch?v=XQFkhZ0Y3dw

http://www.slideshare.net/securityninja/securitybsides-london-windows-phone-7

biktor_gj · May 29, 2012

Hey everyone,

I was hoping to be able to crack Nokia's osbl, but time already run out and wasn't able to get it. So sorry, guys, but I had to return both Lumias. It's been a fun month, and at least I helped getting custom roms for at least some of you.

I'll be uploading here all the files I have on my computer so anyone can mirror them or use them for whatever you might need. If I can help you with something else (development related please) feel free to drop me a PM.

Once again big thank you to Ultrashot, Beidl, Xsacha, cdbase, ceesheim, HeathCliff & everyone that helped out with this. Now back to my (almost) forgotten Galaxy S2 & to try Boot 2 Gecko and see what progress has been done since the last time I checked

surya467 · May 29, 2012

biktor_gj said:
Hey everyone,

I was hoping to be able to crack Nokia's osbl, but time already run out and wasn't able to get it. So sorry, guys, but I had to return both Lumias. It's been a fun month, and at least I helped getting custom roms for at least some of you.

I'll be uploading here all the files I have on my computer so anyone can mirror them or use them for whatever you might need. If I can help you with something else (development related please) feel free to drop me a PM.

Once again big thank you to Ultrashot, Beidl, Xsacha, cdbase, ceesheim, HeathCliff & everyone that helped out with this. Now back to my (almost) forgotten Galaxy S2 & to try Boot 2 Gecko and see what progress has been done since the last time I checked

ohh manh!
:/
it was awesome having u around..thanks for everything, i wish it would be possible for the other 800's as well.
as we knw we still have 900 and 610 as well.
hope someone can do somthing about this.

inket · May 29, 2012

Yeah, thanks for everything biktor_gj.

dy_domyoung · May 29, 2012

i think i may cry, thank you anyways biktor_gj, hopefully some one will carry on your work and find a way for all lumia's to be fully unlocked.

Fair well

vadash · May 29, 2012

Its really sad to read this, but all the effort is apreciated, thanks for all

beidl · May 31, 2012

biktor_gj said:
Hey everyone,

I was hoping to be able to crack Nokia's osbl, but time already run out and wasn't able to get it. So sorry, guys, but I had to return both Lumias. It's been a fun month, and at least I helped getting custom roms for at least some of you.

I'll be uploading here all the files I have on my computer so anyone can mirror them or use them for whatever you might need. If I can help you with something else (development related please) feel free to drop me a PM.

Once again big thank you to Ultrashot, Beidl, Xsacha, cdbase, ceesheim, HeathCliff & everyone that helped out with this. Now back to my (almost) forgotten Galaxy S2 & to try Boot 2 Gecko and see what progress has been done since the last time I checked

Sad to read this. I salute you, dude! You did a great job and allowed the few lucky users to enjoy their devices more than before.
If some day we will both have the same/similar devices again, maybe we can do some bootloader experiments!

Have fun, and most importantly: Thank you!

g-gabber · Jun 1, 2012

Some information from my side, nokia implemened own protocol used by Nokia Care Suite to read informations about the phone, imei, sn, model, type etc. This protocol is based on JSON. I managed to find the handler, and reverse it. I also recognized that nokia use jsoncpp open source. Lucky this is an open source project, and they have Bugs Tracker here. There is a very interesting report called "Crash on specific partial Json string. - ID: 3495702". This "partial Json string" is:

PHP:

"0, \"test_string\", 2, [ 2006, 1, 1, 12, 28, 57 ] ] }\n"

I tested this with nokia implementation, and this is true the process which is responsible for JSON message handling was crashed after sending this string. No clue if we can exploit it, maybe some one can it check more deep.

br g

Bph&co · Jun 2, 2012

g-gabber said:
No clue if we can exploit it, maybe some one can it check more deep.

br g

Hi,

NCSD v 1.9, send "ControlLogging" with arg "ON", do the crash test, then send
the same with arg "OFF". Not sure if you crash the exe clean up code will
close the file(probably not), but since they update with append(), data should
be in the FS(if not too much buffering).

File(ncsdapp_log.txt) is in the last partition, the user part, you can find it with
simple binary search in the partition also.

Edit: check attached example

BR

Bph&co · Jun 2, 2012

It seems this string causes some kind of crash in the current NCSD json implementation. It is not the whole string, but the lack of left curly bracket most probably. After testing with some variants of the string, the result is always the same:

Code:

Enter:CNcsd::RecvData 
Leave:CNcsd::RecvData 
CNcsd::Receiver Recv Data [4 bytes]: "0, 8"
Enter:CNcsd::HandleJsonMessage 
Enter:CNcsd::Process 
Parsing succeeded

- result is for "0, 888888888888888888888888888888"

The logging stops, also the handler stops responding. I guess is not possible
to trap the exception via modding of the nscd executable, we need proper OS
crash dump to see what really happens. Maybe ultrashot and co have a clue
how to enable this in the custom rom ?

BR

rescbr · Jun 4, 2012

Have anyone seen this?

When we initially identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft, we immediately began investigating Microsoft’s signing infrastructure to understand how this might be possible. What we found is that certificates issued by our Terminal Services licensing certification authority, which are intended to only be used for license server verification, could also be used to sign code as Microsoft. Specifically, when an enterprise customer requests a Terminal Services activation license, the certificate issued by Microsoft in response to the request allows code signing without accessing Microsoft’s internal PKI infrastructure.

http://blogs.technet.com/b/srd/arch...added-to-the-untrusted-certificate-store.aspx

inket · Jun 4, 2012

We could maybe try to reverse engineer the marketplace transaction with that fake certificate. Possible ?

jbbandos · Jun 5, 2012

inket said:
We could maybe try to reverse engineer the marketplace transaction with that fake certificate. Possible ?

Or we could try signing a Qualcomm boot loader with that certificate and flash in on a Lumia 800. It should work...

inket · Jun 5, 2012

I think the flashing process requires a firmware signed by Nokia, not Microsoft. Zune updates may be another story.

DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

Senior Member

New member

Senior Member

Senior Member

Senior Member

New member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Attachments

Senior Member

Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts