WindowBreak works without chevron. You can developer and interop-unlock your device with it out of the box.
The WindowBreak Project
- Thread starter Jaxbot
- Start date
-
- Tags
- unlock windowbreak
WindowBreak works without chevron. You can developer and interop-unlock your device with it out of the box.
hey ii was just wonderiing, as nobody rarely mentions the dell venue pro, if something was going to be actually done for it. I know you said dont post stuff liike this but its just that ive never heard something like this or anything done about the Dell Venue Pro.
Thanks
I'll let that one slide, since you're polite and read the post
I would like to support the DVP, but I have no clue how it operates, what it can do, etc. If someone could point me toward the actual diagnostics XAP, I'll take it apart and try to figure out if it has any holes.
Out of the box to interop. There's no need (or reason) to use Chevron prior to it.
That's a paradox, though. We need registry access to unlock it, and can only access the registry after it's unlocked.
Yeah I meant if it was from dev unlock or chevron labs to interop, you could remove the known file problem.I'll let that one slide, since you're polite and read the post
I would like to support the DVP, but I have no clue how it operates, what it can do, etc. If someone could point me toward the actual diagnostics XAP, I'll take it apart and try to figure out if it has any holes.
Out of the box to interop. There's no need (or reason) to use Chevron prior to it.
That's a paradox, though. We need registry access to unlock it, and can only access the registry after it's unlocked.
Oh man, MS really did a ****ty job creating a corrupted zip reader.
It executes every little **** from all over the OS.
This makes me laugh so bad.
It even shows the zip "tree", but even from there when clicking it just "oh, a xml file, ill just copy that one to '\provxml'".
Retard´ness level that this even works = 9001/9000
Great job Jaxbot
It executes every little **** from all over the OS.
This makes me laugh so bad.
It even shows the zip "tree", but even from there when clicking it just "oh, a xml file, ill just copy that one to '\provxml'".
Retard´ness level that this even works = 9001/9000
Great job Jaxbot
"If someone could point me toward the actual diagnostics XAP, I'll take it apart and try to figure out if it has any holes."I'll let that one slide, since you're polite and read the post
I would like to support the DVP, but I have no clue how it operates, what it can do, etc. If someone could point me toward the actual diagnostics XAP, I'll take it apart and try to figure out if it has any holes.
Out of the box to interop. There's no need (or reason) to use Chevron prior to it.
That's a paradox, though. We need registry access to unlock it, and can only access the registry after it's unlocked.
- Latest diagnosis from version 7740 in attachment ("Sammy" Omnia 7)
"Sammy", Jaxbot gets the joke
- samsung zip file name
"If someone could point me toward the actual diagnostics XAP, I'll take it apart and try to figure out if it has any holes."
- Latest diagnosis from version 7740 in attachment ("Sammy" Omnia 7)
"Sammy", Jaxbot gets the joke
- samsung zip file name
That I do. I actually meant the DVP diagnostics app, though =PBy the way, can someone confirm if WindowBreak is working on 7740 Samsung devices? Getting some odd reports, want to double check on them.
I just reflashed the stock ROM and ran through the update process all the way up to 7720. For some reason, I cannot get it to load the webpage.
By the way, can someone confirm if WindowBreak is working on 7740 Samsung devices? Getting some odd reports, want to double check on them.
I just wanted to try it out on a fresh phone...
Update: If I click the link on the first page, I get an about page... But, I just tap held the link to open it in a new tab, and it worked fine... Awesome work...
Yup, device specific exploits are still required. Jaxbox found a way to get files on the phone and move them around on the phone without the need of the official Chevron Labs unlock. Some restrictions do apply that also hold for Chevron Labs regarding file management, e.g. writing to \Windows is restricted. In fact this exploit is a little more restrictive than Chevron Labs unlock because it only allows know mime types to be copied to the phone, whereas with Chevron Labs you could deploy any file [as long as you don''t try to overwrite files with file handles open or ROM files].
Fortunately with this hack found by jaxbox it is possible to place provxml files on the phone. These files allow editing of the registry and therefor jaxbox was able to interop unlock his 1st gen Samsung with his exploit.
Unfortunately however, new drivers for our phones (which are standard for new Nokia's, HTC's (and even Samsungs i think)) are more locked down and thus do not allow registry editing via provxml anymore. At last they try to make is as hard as possible by only allowing (or restricting) a few provxml operations of which registry editing isn't included. It is therefor required that we also find exploits in these drivers to be able to write to the registry.
Those 2nd exploits needed are hard to find and most probably device specific because drivers are device specific as well. Fortunately we have the best of the best with Heathcliff74 and jaxbox and a few others which it''s a shame i forgot the name of ;-).
Hope this helps you to understand the problems we are dealing with.
Last edited:
Cool! Ridiculous that I didn't think of this myself
I will send you the password of the dbz files when I get home. I don't have it here.
But the real problem for HTC and NOKIA are the whitelists. I've been working on this for the past time. And today I made more progress. I developed a new way of debugging native 3rd party dll's/drivers. U can isolate functions and call them from a test app for unit-testing. This makes testing a lot easier. This will help me find exploits much faster. I can even call the whitelist functions of HTC and NOKIA on my Samsung now
Good find!!
Heathcliff74
Thats look cool man
If I got a dollar for every time I got called "jaxbox"
Good summary of the exploit, though! Nokia and HTC are the hard ones. Even new Samsungs are able to use this afaik, so that scratches one demographic off the list.
Still working on HTC and Nokia.. have a few ideas, but still need to brainstorm a little.
The MIME thing is really killing me on HTC... :\ any bright ideas?
This is the latest.
I already analyzed it once. I couldn't find an exploit back then. You can have a shot at it
Heathcliff74
Hi guy,
I had initially chevron unlock, then I decided to try this. Windowbreak also, but after I windowbreK, I lost my data connection, how to fix that?
Restart your phone. If that doesn't work, windowbreak again and try again, or deploy Samsung 3G repair from Heathcliff: http://xdaforums.com/attachment.php?attachmentid=776605&d=1320794157
Hi guy,
I had initially chevron unlock, then I decided to try this. Windowbreak also, but after I windowbreK, I lost my data connection, how to fix that?
If you have a 2nd gen samsung the Repair3G.xap will not work. In that case download the Wireless Manager from the Samsung Zone in the marketplace. Select a different operator and then select your own operator. You'll have your 3G back.
Good luck,
Heathcliff74
Well then even if provxmls cannot do registry edits, then you could still probably do file operations in which you can put files into \windows directory, iff they still allow file operations with them.
What this could do is change a .reg file in that directory that is used every time it boots. I've been trying to do that with my current phone but haven't found any file that is used each boot.
What this could do is change a .reg file in that directory that is used every time it boots. I've been trying to do that with my current phone but haven't found any file that is used each boot.
Last edited:
That was one of my ideas. Need a Nokia to mess with
I was able to copy into \windows with my Focus, but I'm not sure how that helps me. Any file I can overwrite that will provision automatically, e.g. on boot? All the mxip files seem to be cold-boot only.
That was one of my ideas. Need a Nokia to mess with
I was able to copy into \windows with my Focus, but I'm not sure how that helps me. Any file I can overwrite that will provision automatically, e.g. on boot? All the mxip files seem to be cold-boot only.
Can you please double-check that? So far I know you can't deploy file to the Windows folder this way.
Not directly. I had to copy into provxml and then use provisioning to move it.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
99"What am I doing, why am I here, what is this about, and where am I going with this."
Hello all. After dealing with rumors, rumors of rumors, and the like, I've finally managed to disclose something I hold very dear to me: the WindowBreak project.
As the name suggests, this is a jailbreak project for Windows Phone 7. I started something a while back that had little success, but through the months, I've managed to figure out something that should bring light into the Windows Phone jailbreaking scene.
Real quick, though:
What this is: A project, with information about some interesting exploits I found, and a call for the community to dive in.
What this isn't: A full fledged jailbreak. Please don't post replies such as "when will XXXX device be supported". It just wastes time, and I assure you, I want every device included.
It also is not a full unlock. Just interop.
The details
So here's the sitch. We all know how Heathcliff74's interop unlock works. XAP files are just ZIP files, and ZIP files can have entries that allow extracting in parent directories.
Interesting thing is, this can be done using the ZipView application, which normally stores data in \Application Data\Volatile\Zipview\<random id>
Thus, creating a directory in a ZIP file called ../../../../provxml will copy all those files into the \provxml\ folder upon extraction.
See what I did there?
Limitations
Of course, there are limitations.
1) We cannot extract into \Windows\. There's a policy that prevents it.
2) The bad one: We can only extract known MIME types, at least to my knowledge. This is because the files are only extracted when they are clicked on in ZipView. And clicking on a .dbz file, for example, will just say the file type is not supported. Bummer.
What we can do...
As mentioned above, this can be used for a fresh out of the box jailbreak for Samsung devices, using provxml. Here's a video of that:
Try it yourself: with a Samsung device, go to http://windowsphonehacker.com/windowbreak and press WindowBreak Me.
In theory, this would be all we need to jailbreak most Windows Phone devices. Unfortunately, Nokia and HTC devices block the registry entries in provisioning files. I'm not sure what the extent of this "whitelist" (or is it a blacklist?) is, and details/tests on this would be appreciated.
What needs to be done...
Nokia: I don't have a Nokia device, but I've been working a great deal on figuring out how to crack it's shell, and have a couple of ideas. If I'm able to get my hands on a Nokia device soon, I'll try some of these unorthodox exploits out, otherwise I'll need some daring volunteers.
HTC: I do have an HTC device, but I can't figure out how to extract the files for the Connection Setup program. If someone can give me details on what the password encryption is on it, etc, for the HTC interop unlock, that would be much appreciated.
Other devices: Not a lot of demand for these (and LG needs no jailbreak, since it has MFG), but if something comes up, feel free to share where the provisioning files exist and I'll see about "windowbreaking" them.
So this is my little project, and I hope the details I'm sharing will lead to further development. My personal device (Samsung Focus) is easily interop unlocked now, without costing me a cent. I'd really like this to be the case for everyone; I'm not saying the $9 unlock for Chevron Labs is bad, in fact, it's greatly supported homebrew. What I am saying, though, is that freedom is still possible, and regardless, any developments made here will further support interop unlocking on Chevron/apphub unlocked devices. With that in mind...
Merry Christmas.
Special thanks to: Heathcliff74 for much of the research and idea behind the exploit
All the supporting members of XDA, who bring appreciation for what we do. Thank you.14Cool! Ridiculous that I didn't think of this myself
I will send you the password of the dbz files when I get home. I don't have it here.
But the real problem for HTC and NOKIA are the whitelists. I've been working on this for the past time. And today I made more progress. I developed a new way of debugging native 3rd party dll's/drivers. U can isolate functions and call them from a test app for unit-testing. This makes testing a lot easier. This will help me find exploits much faster. I can even call the whitelist functions of HTC and NOKIA on my Samsung now Working on it right now.
Good find!!
Heathcliff746Wow. It actually worked. Changed some stuff around, added folders and files into a Marketplace XAP and then had Fiddler replace it when downloading. .. trick works, XAP installs, etc. Beautiful... just beautiful. *sob* I can really make something out of this
Nice call!
P.S. apparently i was wrong about the size check. Was pretty sure I wasn't, though. Not sure what happened, but it works right now, so I'll just not complain.4DBZ Password
030D681B-1DFC-4bd0-A72A-A9B3CCCDA653
---------- Post added at 10:30 AM ---------- Previous post was at 10:29 AM ----------
Oh and it was found here http://xdaforums.com/showthread.php?p=189168884First of all, the OS version does *not* matter here, it's all about the firmware version or bootloader version.
Second, "jailbreak" is a very ambiguous term on WP7, and one I really wish people wouldn't use, because there are multiple levels of unlocking.
The first, developer-unlock, is actually a feature of the OS and is supported by Microsoft. All phones can be dev-unlocked, but normally you have to pay for it (an AppHub account, intended for Marketplace developers, lets you unlock up to 3 phones and install up to 10 unsigned apps on each, for $99/year). Students can get a free account through DreamSpark, but only for one phone and up to three unsigned apps at once. There's another way, for $9 a ChevronWP7 Labs token lets you unlock one phone and put up to 10 unsigned apps on it. Unfortunately, those tokens are sold out and we have heard nothing on them getting any more (had to be approved by Microsoft). There are also some hacks that will dev-unlock a phone, such as WindowBreak (this thread). There aren't currently any such hacks available for HTC, though.
Next, there's interop-unlock. This means removing the 3- or 10-app limit, and also allowing the installation of apps that can use system components (drivers and long-running services) to break out of their sandboxes. These apps, commonly called "interop" apps after the ID_CAP_INTEROPSERVICES line in their manifests' that enables this capability, include things like registry editors and the HtcRoot project. All ways of getting interop-unlock are based on hacks. For Samsung phones, WindowBreak can be used to interop-unlock at the same time as dev-unlock. For HTC phones, though, you need to first be dev-unlocked before you can interop-unlock.
The third level is called "full unlock" and means the policy system that controls app sandboxing and user permissions has been disabled completely. Any app can run, and all apps run with full access to the whole device. Although this heightens the risk of malware or o accidentally damaging the device, it also allows all kinds of cool features to be added right into the phone, as well as enabling some very cool apps (including ports of WinMo apps). Currently, the only way to get full-unlock is to use a custom ROM.
In order to use a custom ROM, your device must have an unlocked bootloader. This is done by installing an alternate bootloader called RSPL, and can be made permanent by installing HSPL. You can read the DFT (Dark Forces Team, who are responsible, directly or indirectly, for almost all custom ROM achievements on WP7) threads on R/HSPL on this forum. Although all first-gen HTC phones are now supported for xSPL, be aware that it can only be installed over stock SPL (bootloader) versions on 3.1 or lower. Most fully up-to-date phones will be running SPL 5.x.
For you, in particular, you can either try interop-unlocking, or you can try installing an unlocked bootloader and a custom ROM. The first option preserves your phone data, but is less permissive in what you can do. The second option allows almost anything, but you'll have to wipe the phone and will also be at the mercy of any bugs in the custom ROMs. Additionally, either option may require rolling back the phone in some way (firmware for interop-unlock, SPL for bootloader unlock), and interop-unlock will require first getting dev-unlock (may cost money).
