[SUCCESS] Interop-Unlocking LUMIA - with JTAG

lordmaxey · Apr 10, 2014

Hi there

Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.
As i already have ATF Box for a long time, i decided to buy JTAG activation and dolphin clip + lumia jigs, that i do not have to solder my phone.
Also i have ordered a Lumia 520 testing phone on ebay.

So, as the ATF Team made an awesome JTAG software update, i'm trying to interop unlock that Lumia 520 the hardware way, as just software seems to be too tough...

Well, what i did so far:
1. Freshly flashed Lumia 520 RM-914 with latest stock rom
2. Did the setup/beginning after turning it on for 1st time
3. developer unlocked it with SDK on PC
4. Made Full Dump with JTAG from dev-unlocked phone
5. Mounted MainOS partition of dump with program "OSFMount" (-->appears as Local harddisk example drive E: )
6.Loaded the SOFTWARE hive with regedit on PC from "E:\Windows\System32\config"
7. Edited the following values:
PortalUrlInt = http://127.0.0.1
PortalUrlProd = http://127.0.0.1
MaxUnsignedApp = 10003
8. unloaded SOFTWARE hive
9. unmounted dump-image
10. wrote image back via jtag

I thought it might be a good Idea to dev-unlock the phone before messing with the registry, to make sure "DeveloperUnlockState = 1" gets written the "legal" way, as the key is not available in registry before.
Maybe it's better to just modify an existing key, than adding a new one...

Well, long story short: The result is not totally satisfying.

After writing the modified image back to the EMMC, the phone is booting up, but i can NOT deploy homebrew apps that require interop unlock, like @GoodDayToDies "EnableAllSideloading.xap" for example.
But i can deploy "nomal" apps like @cpuguys "Toastlauncher" and @GoodDayToDies "Webserver"

The weird thing: If i check the reg-values via WebServer on the Phone, i can see my edited values.
So the changes ARE written to the phone. The phone just doesn't use them...

So, the good thing: phone is booting with modified rom :good:
But, the bad thing: Changes are not working.

EDIT:

SUCCESS!!!
After adding

i could successfully sideload "EnableAllSideloading.xap"

After executing enableallsideloading i could sideload latest WPHTweaks build.

Now i have 3rd tile row enabled!

awesome!

Also member @myst02 is working on interop-unlocking the lumia phones. So we decided to make this a together-project.
See his achievements here: http://xdaforums.com/showthread.php?t=2713098&page=10 :good:

lordmaxey · Apr 10, 2014

reserved

error0x0000034 · Apr 10, 2014

to be able to sideload EnableAllSideloading.xap you need to change following registry key:

Software\Microsoft\SecurityManager\CapabilityClasses
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS

have fun.

Amadeus01 · Apr 11, 2014

I have found this during smurfing on the internet.
Dont know if this is something worth trying, but maybe it gives you some pointers or help.

http://windowsphonehub.in/tutorials...eloper-unlock-windows-phone-sideload-10-xaps/

sensboston · Apr 11, 2014

lordmaxey said:
Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.

Good job!

lordmaxey said:
Let's get this rolling, guys! :good:

BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...

ngame · Apr 11, 2014

Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS

lordmaxey · Apr 11, 2014

sensboston said:
BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...

Yeah, but it's at least something worth trying

ngame said:
Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS

Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...

ngame · Apr 11, 2014

lordmaxey said:
Yeah, but it's at least something worth trying

Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...

I don't remember Ativ S Interop but I know it had a BootStrap app
maybe that app unlock this api i'm not sure but I know you have to open this cap first to run EnableAllCapabilities

ceesheim · Apr 11, 2014

Nice work :good:

so now , you can make a small bussines with this

interop unlock for only *** $

and you are now the one and only interop unlocked retail Lumia owner

lordmaxey · Apr 11, 2014

ceesheim said:
Nice work :good:

so now , you can make a small bussines with this
interop unlock for only *** $

Haha

Yay, i'm going to be rich

*lol*

ceesheim said:
and you are now the one and only interop unlocked retail Lumia owner

No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.

We'll see, but i'm curious

btw: Why are these damn smileys always displayed in the next line?

ceesheim · Apr 11, 2014

btw: Why are these damn smileys always displayed in the next line?

don't know , i just seen that too

error0x0000034 · Apr 11, 2014

lordmaxey said:
Haha Yay, i'm going to be rich *lol*

No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.

We'll see, but i'm curious

btw: Why are these damn smileys always displayed in the next line?

Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.

You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.

Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.

Best regards and good luck.

-W_O_L_F- · Apr 11, 2014

lordmaxey said:
Haha Yay, i'm going to be rich *lol*

No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.

We'll see, but i'm curious

btw: Why are these damn smileys always displayed in the next line?

Bootstrap Samsung will not work on Lumia.

lordmaxey · Apr 11, 2014

error0x0000034 said:
Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.

You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.

Like this then, right?

Ok, I'll try this next week, i sadly won't have time this weekend.

error0x0000034 said:
Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.

Best regards and good luck.

No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.

reker · Apr 11, 2014

It's not for Lumia only, it's a universal method for every WP8 devices (including emulator) that could enter MassStorage mode

And the Bootstrap app is not a magic, it use the system service by Samsung to modify the CapabilityClasses registry key mentioned by above and this could be done by modify reg hive directly

error0x0000034 · Apr 11, 2014

lordmaxey said:
Like this then, right?

Ok, I'll try this next week, i sadly won't have time this weekend.

exactly. I have done this on my Ascend W1 several times, but its easier, because I can enter Mass Storage Mode through bootloader.

No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.

I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:

best regards,
error0x0000034

lordmaxey · Apr 11, 2014

error0x0000034 said:
I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:

Me neither

Most credits go to X-Shadow from advance-box team.
Because i had the Idea of modifying the phone dump and read/write via JTAG.
But usually, ATF only supported bootloader repair via JTAG. So i contacted X-Shadow and within only two weeks he updated the jtag-application, and added Custom Read/Write to every part of the EMMC.

That's how i could dump the rom, modify it and write it back.
Absolutely awesome work from that team, just releasing a software because of ONE single inquiry.

:good::good::good:

GoodDayToDie · Apr 12, 2014

Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP

But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.

lordmaxey · Apr 12, 2014

SamWP8 tools on Nokia would be great.

I'll check that monday evening, when i'm back at my computer.

I'll keep you informed

ngame · Apr 13, 2014

GoodDayToDie said:
Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP

But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.

isn't it better to put FCROUTER and other samsung dlls in Windows folder?
as far as i know ID_CAP_INTEROPSERVICES allow it

[SUCCESS] Interop-Unlocking LUMIA - with JTAG

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Recognized Developer

Senior Member

Senior Member

Senior Member

Retired Forum Moderator

Senior Member

Retired Forum Moderator

Senior Member

Senior Member

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Inactive Recognized Developer

Senior Member

Senior Member

Similar threads

Top Liked Posts