Search results

Yes, you can root with magisk, but your are fixed to the firmware version you had, theres no (known to me) way to further update your system with new security patch releases without reset the system and lose your data. I personally lost the battle and bricked my "bootloader open" Honor, but...

hi, even it doesnt look like, but that, for my best recognition, was the one i choosed the first time. I even tried to reapply this image with no luck, choosing your twrp recovery image. perhaps i would go the hard way and factory reset und start from scratch with oreo 360er image i'll report...

Here's the ff entry I had flashed. best donpromillo

perhaps you're right, but the update.zip and the update_all_hw.zip from ff were shown as compatible, but not yet released for model Stf-L09. is the oeminfo part of the update_all_hw.zip? if yes, would it make sense to reflash only this part? best donpromillo

Hi, thanks I'll try asap. The complete firmware version is attached as image cheers donpromillo

I'm at 9.0.1.157, as you can see, a early bird, got it with firmwarefinder and flashed with huru upater and. runs without error until now, but I'm not able to further update, because of the encrypted partitions thanks in advance donpromillo

hi gaguga, could you plz list the necessary steps? tried to translate the original post at 4pda.ru, but that gave me no glue about thanks donpromillo

i did it yesterday using ff and the stf-09SC432B362 (look at Screenshots which one) and the phone updates without errors or problems regards

Need a second post for more pictures (png is limited to 256 kb per post ????) So here are the next 2, (Oh I swapped the titel of the pictures,so please swap them in your mind to get it right: enabled is disabled and disabled is enabled, but only in this post, the former got the right titel -...

Hi merwin, I've just the same behavior with my nl 925. Yesterday I disabled all background processes, Bluetooth, 3g and even 2g connection, location sensor, shortly all things that can be disabled. But unfortunately my drain rate was about 5%, the same as with all background processes...

I'll send you a pm after uploading the files. First flash the sd3_lumia_12220 to partition sd[x]3, after successful done, flash the Lumia_800_12220_8773_full_unlock_with_marketplace.nb to partition sd[x]9. Regards Donpromillo

Hi The Xev, here is, what ultrashot answers to a pm sent to him regarding the marketplace error: Using this I was able to build a 12773 image with full unlock by ultrashot from stock rom. Regards DonPromillo

Hi, All,you need to know is written in the threads I mentioned in my last post. I prefer the Linux dd method, other like the Nokia care suite method, I think it depends on your Linux skills, which U use If you do not need the unlock, use navifirm to download a stock rom, you can open the...

Thats the reason, because I advised you to sell it. If you don't know how to flash your lumia to another custom rom or to a stock rom, you should read here or in the developer-forum . If you feeling able to do the mentioned steps to flash (and keeping in mind, that there is a ability to...

MSFT announces trouble with some certs and stops publishing marketplace apps Hi, has somebody of you the here named apps in a version before MSFT stops publishing? Could we investigate the certs they used in that app to see, what's meant by Regards Donpromillo

I had this issue using a custom cooked rom that used ultrashots full unlock and flashed it onto my lumia. Everything works ok as long I did not update to Tango. After the helpful advice from ultrashot to change a file in the unlock-package and recook and reflash averything is ok. So your lumia...

Hi, Yes, I use appreviations, and most people understand the term cert in this way And Yes, Google sometime fails (to much advertising???) You read the wrong news http://forum.xda-developers.com/images/smilies/smile.gif Even if I stated above, that we are at a dead end: if you've read the...

Hi Heathcliff74, if you read this and this, you'll see, that the collision isn't neccessary in our case. The thing that we need is the Activation Cert of a Term Server, cause this is also a "code signing Cert" and allows to sign every code (in unpatched environments) as it was done by MSFT...

Hi Heathcliff; I think, that the common on both certchains is MS Root authority, which signed the "Microsoft Windows Mobile Firmware Installation PCA" and the Licensing CA from a TS-Server too. (see attached Picture taken from "Default Certs" in OSBuilder ). So the 1. task is to get the...

Hi Jaxbot, Not necessary to get exactly the cert from Trojan, every Ts activation cert could help, if it was createt before 5/12.The difference between the cert used by flame and any activation cert is, that this cert was prepared by a md5 collission, so it was usable to attack vista and win 7...

This is what MSFT has found so far (read more here), so my hope is to get such a Terminal Services activation license. Then we can see what's possible with it Regards

hello inket You are right, wp7 isn't vulnarable in the way that the Trojan flame used to attack systems. Even if WP7 was vulnarable, you execute the code in the chamber with lowest privileges and would need an extra exploid to gain higher privileges. But that is not the way I would use a code...

Because it seems, there are no new ideas to get a solution for nokia dload bootloaders, I want to bring a old one in new flavor: As discussed here and here the MS Cert Chain is (was) vulnerable. I personally mean that "is still" vulnerable on non patched systems (like WP7 Roms before May...

There is a very good video tutorial in the "WP7 KITCHEN" thread here at xda by barin, the developer of osbuilder Regards Donpromillo

Hi ultrashot, I extracted the package from the rom made by biktor_gj in the lumia unlock thread . The unlock, WP7 root tools an all interop/unlock features and apps in my self cooked rom work as expected. So I had no reason to think about change the unlock package, especially because the...

Hi bkotyik, Got the same error here with lumia. Searched MSFT q&a-site for the error number and got: this is normal behavior, because the backup made by Zune before upgrade is only a restore point in case the update failed, not a full backup. There was a sentence "if your upgrade finished...

Marketplace error 805a0190 after upgrading unlocked nokia 800 to tango 8773 Hi, thanks for that great tool, which made me able to successful build my own custom rom in minutes. Just one error remains: after upgrading my rom to 8773 (tango) using zune marketplace gives error 805a0190 when...

Hi, Tried it on my unlocked Lumia 800, but it doesnt seem to work. I got no error message after reboot and was still able to access marketplace. My former account was the preselected one Regards Donpromillo Sent from my Lumia 800 using Board Express

So by now I'm able to build a rom based on the australian country_variant from navifirm, which is: OS 8107 (mango) Firmware 12070 full unlocked (using Ultrashots packages) able to upgrade to Tango (8773) able to upgrade OEM packages by Nokia (12220 inkluding tethering) just one open point...

Hello ChrisKringel, thanks so far, even if it is not satisfying, because biktor_gj left this community. So I will try to learn to cook my own rom. Regards DonPromillo

Hi Dolan Thanks for your reply. Are you able to update to tango based on your method? What rom file did u use to flash? The one mentioned in the guide? Regards

Somebody tried to update the custom rom to tango 8773 and Nokia OEM with tethering? Hi has somebody of you successfully updated the custom rom for Lumia 800 to tango? I tried it after successfully flashed this rom to my Qualcomm-enabled nokia. The first update (8112) was done successful and...

Hi, As far as I read the blog the right way, we are late, cause the vulnerability had been closed by MSFT. So what's needed is somebody, who activates a Terminal Server some weeks ago. This activation seems to create a certificate, that's usage isn't restricted, so it can be used to sign other...

My Backups are always 6,5 GB of data, my phone had 5 gB free memory so there seems a difference to the whole partition size of 15 GB, except the backuped date are compressed and encrypted. And I managed now the complete sniff. In capture settings one can activate the capture of hotplugged...

Hi biktor_gj, I tried to open your usb-sniffs, but it failes, cause my usblyzer is ver 2.0 Build 25 and reports, that your files are older, unsupported version. Which one do u use? BTW: Did not have the chance (and time) to sniff the second part after reboot yet. There is a difficulty to...

More Info: I started to USB-Sniff a backup again, and here is what I see: This is just before the phone reboots. If you read the blog of the linked page in my previous post, you'll see, that there is a small difference to the MTPz handshake described in that blog. I do not know, if my...

I read the windows phone architect guide once more and I think, there are some remarkable sentences: "ULDR is updatable and is secured in other ways, such as having restrictions on running code not in ROM and via a hardware flash lock" "The ULDR supports the following boot modes: Service Mode...

So I extracted the content of Sldr (especially MSXIPKERNEL_uldr). Is it possible to rebuild the modules (dll's) from the packages so one can analyze the dlls? Regards

Thanks for information. According to a pdf about the architecture of WP7 I read meanwhile, Uldr contains XIP(executable-in-place) RAMIMAGE of the Update Loader version of the System Update Loader and is locked while OS is running. It Become readable/writable when in update mode. (see attached...

Hi sharpgfx, wouldn't you agree, that's a waste of energy to run your pc, which consumes much more than 500mA like the nokia charger, only to charge your phone? regards donpromillo

Hi Pleaze, look at the attached pictures. Did somebody of you have this seen , when connected the lumia in restoremode (camera button pressed on reboot until vibration) : How can I access the UldrStorage? If I connect the phone in restoremode in Linux, the phone reboots 10 seconds after the...

I search for a possible way to use a Zune restore point made before a device update to be edited. So fare I found it is a crypted cbc stream, but the uncrypted header seems to have similar structure information than a full dump of the sdx9 partition of the phone. Regards Donpromillo

Is it programatically possible to do it? Means: are the structures like in a filesystem, so someone can reconstruct it from raw reading? Do you have some sources to read about "wm_store" storage devices? Thanks in advance Donpromillo

Hi, first thanks for your great tool. Second: is it possible to extract the content of a the "user" part from a full dump of the nand from lumia? Thanks DonPromillo

Now I'm a little bit confused. I sniffed the network traffic from my pc when backup of my wp7 runs (phone is in Airplan-mode, only PC is connect to network, wp7easybackup as backupprogram). 2 things I see so far: 1. if my pc is fresh rebooted, then the only traffic to ms is retrieving...

Hi Heathcliff74 you are correct, I forgot to disable the wlan on phone, so at the start of WP7EaSYbackup, it was able to connect to MSFT. If I disable all, even 3g/2G Connections, then Easybackup stopps working, in the logfile you can see that it could not connect to the updateserver...

I searched a bit in rom-files and found OEM_7x30_MODEM.cab. It contains a file "modem" which seems interesting in 2 ways. First: I'm a lazy man and enthusiast of analogism and think, that developers at microsoft are lazy too and reuse code : Is it possible, that the procedure to pack the...

Thanks, I tried this, but xidump crashes on my w7_x64. all other tools I tried weren't able to extract the imgfs-part from a dump of partition 9. I do not know, if its really neccessary to extract the dump, but thought, it would be easier to unterstand the file and folder organization on the...

No, this is a certificate with a private key that could be used to encrypt something. Normaly the private key of that cert is not marked as exportable, so you can use this cert only on one computer, cause you cannot move the private key. I found a tool to export the private key as a first step...

Unfortunatly, OsBuilder latest failed to dump. I'll try with imgfstools. DonPromillo