[GUIDE] Full FileSystem Access over SFTP / CMD over SSH on Windows 10 Mobile

Search This thread

AshleyT

Senior Member
Oct 26, 2011
157
67
Salerno
@AshleyT , you didn't follow instructions... It tells you exactly how to do it. It doesn't NEED astoria, but the wconnect tools make it easy for the key file to be created.

Can you explain me what I'm doing wrong? Here's what I do:

- Edit and check all the registry keys;
- Enable Developer Mode, activated Device Discovery;
- Turned on Pair Mode;
- Opened Pagent;
- Set connection using Swish (IP:192.168.0.5 Path:/ Username:sirepuser (also tried Sirepuser));
- Try to connect, accept and store the key;
- Permission denied without asking for password.

I used it flawlessly on build 10536 following the whole guide, but now I'm stuck. What am I missing? :confused: Thank you!
 
Last edited:

AshleyT

Senior Member
Oct 26, 2011
157
67
Salerno
You completely forgot the part about the privkey and the use of Pagent...

Yes, my question is: how can I get privkey if wconnect doesn't work anymore?

EDIT: I'm really sorry, I tried wconnect usb instead of wconnect 192.168.0.5 and now it worked! D: I don't know why but now I got it! Thanks (and sorry) again!
 
Last edited:

snickler

Retired Forum Mod / Inactive Recognized Developer
Aug 17, 2010
1,320
1,133
Dub V
www.sinclairinat0r.com
Yes, my question is: how can I get privkey if wconnect doesn't work anymore?

EDIT: I'm really sorry, now it worked! D: I don't know what I was doing wrong but now I got it! Thanks (and sorry) again!

Try this. Turn off the USB debugging option in the settings. Turn it back on. Tap pair device then use "wconnect IPADDRESS" when it asks for a pin, type it in. It SHOULD fail after that but it doesn't matter. Follow the rest of the instructions to get the private key.
 
  • Like
Reactions: AshleyT

titi66200

Senior Member
Jun 2, 2009
1,495
432
PERPIGNAN
Thanks works fine on build 10.0.10586.11

Edit 1: Can't change "OEMSettings.reg" in windows\packages\registry folder ?

Edit 2: Works with Totalcommander and wfx_sftp_1_4_63_6 plugin.
 
Last edited:
  • Like
Reactions: winphouser

xboxmod

Senior Recognized Developer
May 20, 2007
994
2,010
42
Gap
Not working on build 10.0.10586.29

Hi
For me Sftp always work on build 10.0.10586.29
maybe because i have added thoses registry key in the OEMSettings.reg before update to 10.....
as you mentionned it is not possible to replace this file using sftp....
But you can with the mtp trick....
 
Last edited:

winphouser

Senior Member
Jul 3, 2015
158
158
[Tweaks.xml] Enable Full FS over SFTP

Code:
  <contributor>snickler @ xda-developers</contributor>

  <tweak category="System" name="Enable Full FS over SFTP" type="toggle">
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-home-dir" type="string" default="%FOLDERID_SharedData%\PhoneTools\">
      <value>C:\</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="default-home-dir" type="string" default="%FOLDERID_SharedData%\PhoneTools\">
      <value>C:\</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-mkdir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-open-dir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools(\\.*)*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-read-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-remove-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-rmdir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-stat-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
    <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-write-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
      <value>.*</value>
    </entry>
  </tweak>

Ping @sensboston @kwanice @vcfan @Pasquiindustry
 

winphouser

Senior Member
Jul 3, 2015
158
158
[Tweaks.xml] Enable KeepWiFiOnSvc (W10, Reboot)

Code:
  <tweak category="Network" name="Enable KeepWiFiOnSvc (W10, Reboot)" type="toggle" description="Keeps WiFi on while screen is locked" reboot="true">
    <entry path="HKLM\SYSTEM\CurrentControlSet\Services\KeepWiFiOnSvc" name="Start" type="dword" default="4">
      <value>2</value>
    </entry>
  </tweak>

? Tweaks.xml updated: https://raw.githubusercontent.com/sensboston/WPTweaker/master/WPTweaker/Tweaks.xml
 

wuiyang

Member
Jun 22, 2014
38
2
Pahang
sorry if this is a stupid question... where can I download WConnect?
EDIT: found it, after connect to my phone's data, I am able to view everything, but not copy it to somewhere, what shall I do?
 
Last edited:

Trur

Member
Dec 29, 2007
11
0
Utrecht
www.roswebnet.com
Hi I've MS Lumia 640 XL LTE (RM-1062_1030), Windows Version 10.0.10586.218

I followed first step about RootTool.

" The following keys should be set ..."

but when i press write and then later read - no changes. I still have old %FOLDER...% values for all strings.

By wconnect IP I am getting this error:

Error bootstrapping the device. Error code = 8

However, it creates privkey.pem that I can easily convert. Further when I am using winscp to connect to device I am getting this error:

"Authentication log (see session log for details):
Using username "sirepuser".
Authenticating with public key "imported-openssh-key".

Authentication failed."


Any suggestions? Thank you.
 

winphouser

Senior Member
Jul 3, 2015
158
158
@Trur, using original WPTweaker

1. Set: NdtkSvc Path ➡ c:\windows\system32\ndtksvc.dll

2. Wait 60 seconds. Then reboot

3. Set: Full FS over SFTP ➡ On

4. Reboot

Sent from mTalk
 

Trur

Member
Dec 29, 2007
11
0
Utrecht
www.roswebnet.com
@winphouser

Thank you for your response.
I can install Root Tool via WPAD(8.1) without problems. However, when i try WPTweaker 1.4.3 I am getting this msg:

"Error - Package could not be registered."

Before installation I have enabled in Root Tool -> Jailbreak Lumia -> Interop Unlock (I got success msg). I've tried to Install wptweaker, but I got the same error. Then I tried capability Unlock and Unlock Windows Capabilities, but without success. :(
 

Satirus

Senior Member
Jun 10, 2012
106
6
Manaus
@winphouser

Thank you for your response.
I can install Root Tool via WPAD(8.1) without problems. However, when i try WPTweaker 1.4.3 I am getting this msg:

"Error - Package could not be registered."

Before installation I have enabled in Root Tool -> Jailbreak Lumia -> Interop Unlock (I got success msg). I've tried to Install wptweaker, but I got the same error. Then I tried capability Unlock and Unlock Windows Capabilities, but without success. :(
You're using wrong app to deploy those xaps. You can use wp power tools... And root tool does not apply a validating interop-unlocking. You should try with vcreg 1.5 on wp power tools.
 

Trur

Member
Dec 29, 2007
11
0
Utrecht
www.roswebnet.com
Ok let see One more time.
i ve installed wp power tools and successfully deployed vcREG:Lumia. However, I found only version 1.2 not 1.5 of vcreg. In addition I've used a vcREG_1_2_W10.xap loaded with wptools.

I checked:
Live Interop/Capability Unlock and Live Full FS Acces. Than I've rebooted phone(I ve also tried without reboot)

However, no registers were updated from the list of this topic.

Connection:
"Authentication log (see session log for details):
Using username "Sirepuser".
Authenticating with public key "imported-openssh-key".

Authentication failed."

:(

Any advice? what I miss?

Thank you.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 32
    Hi all,

    This guide uses the built-in SSH server on the phone that gets activated once you enable Device Discovery to give us TRUE full file system access. MTP doesn't truly give full file system access as there are files and folders that aren't accessible still.

    NOTE: The automation of the steps listed in this whole guide has been incorporated into an easy GUI within @gus33000 's app called Interop Tools. Big thanks to him for taking the time to simplify this whole process.



    Many thanks to @gus33000 [For the simplification and guinea pig process ] and @black_blob [ For making me try the UMCIAuditMode trick again]!

    Manual Steps for SFTP


    Tools needed



    Steps:

    • If you're using @djamol's Root Tool, use @vcfan's Lumia Registry Editor for this
    • The following keys should be set to the following string values under the Path of System\Currentcontrolset\control\ssh\sirepuser

      Represented in this guide as key: value

      stfp-home-dir : C:\
      default-home-dir : C:\
      sftp-mkdir-rex : .*
      sftp-open-dir-rex : .*
      sftp-read-file-rex : .*
      sftp-remove-file-rex : .*
      sftp-rmdir-rex : .*
      sftp-stat-rex : .*
      sftp-write-file-rex : .*
      auth-method : password
      user-pin : 1234
    • After you've verified that at least one of these keys have been set, exit the app
      [*] Go to the phone settings app and put your Windows 10 Mobile phone in Developer Mode, activate Device Discovery then turn on Pair mode
      [*] Pair to your phone using WConnect, either from usb connect mode ("wconnect usb") or IP (wconnect youripaddress) using the pin on your device
      [*] When this is complete, go to %USERPROFILE%\appdata\local\Microsoft\WConnectSrv. In this directory, you should see a privkey.pem file. Hold on to this
      [*] Open up PuttyGen, click on the Conversions menu and then click Import key. Point to the path that contains the privkey.pem file, then press Okay
      [*] Back in PuttyGen, click on the Save private key button and then save the .ppk file off somewhere that you'll remember.
      [*] Open Pagent, click Add key and point to the .ppk file you generated before. You'll want to make sure this is ALWAYS running.


    If using Swish
    • Go to Windows Explorer, dbl-click on the Swish icon under Devices and Drives. Click on Add SFTP Connection at the top
    • Enter in a label that you wish to save the connection present as .
    • Under host your phone's IP as Host.
    • Enter in Sirepuser as the User.
    • Enter / as the Path.
    • Press Create
    • Go back to the Swish folder then click on the connection that you just created (YOU MUST HAVE PAGENT RUNNING FOR THIS TO WORK).
    • When prompted, enter "1234" as the password.


    If using WinSCP:
    • Open WinSCP. Underneath of the Password box, click on Advanced.
      • Click on the SFTP menu item and set the Preferred SFTP protocol version to 2
      • Click on the SSH -> Authentication menu item. Click Allow agent forwarding, click on the ellipsis next to Private key file and choose the .ppk file you saved from PuttyGen
    • Press Ok to save the settings
    • Back on the WinSCP main screen, enter in your phone's Wi-Fi IP into host name and for the User name, type in Sirepuser. Press save and then save this session as a "Site" in WinSCP
    • Login. When prompted, enter "1234" as the password.
    • You'll receive an error initially about not being able to browse /C/ and blah blah. You can right-click and click on Goto Folder. /C/Data will be a nice folder to start at since that's where most of the goodies are.

    Voila, you should know be able to have full file system access.

    Now there are a FEW caveats to this..

    • If you're looking to modify/download any of the important files in the AOW folder, you won't be able to. For SOME REASON, it's returning "No such file or directory" if you try to download/modify some certain files. It will also return this if you try to do the same for the registry hives.
    • If you happen to remove all paired pins on your phone, you must add pin from the phone and use the pin as the password to your SFTP session


    I'm tired of my SFTP access cutting out because the WiFi disappears when the screen goes to lock >_<. What do I do?!?!!?

    Using the same Lumia Registry Editor from Djamol's Root Tool, Head to the \system\currentcontrolset\services\keepwifionsvc Path and set the following DWORD value

    Start => 2

    For some reason the service that keeps wifi running even while the screen is under lock is disabled on 10512. This enables it. Reboot and you'll have WiFi working under lock screen on 10512.




    Manual Steps for running CMD over SSH (assuming you've done the SFTP steps above) Redstone builds required. 10586.XXX builds will NOT work


    Tools Needed:

    • IoT Insider Preview ISO
    • Interop Tools - Download the latest arm package and all packages from the Dependencies directory. Install the dependencies first, THEN install the app.
    • Pageant
    • Putty

    Steps:

    First, you'll need to download the Windows IoT Core Insider Preview ISO. Mount it and then install the MSI. Next, you'll need to go into Disk Management (diskmgmt.msc) and create a new 4GB VHD by clicking Action-> Create VHD. Set the location to any place you wish for it to be, set the size to 4GB and keep the rest the same. Pay attention to the disk number shown in the Disk Management screen after you create and mount that VHD (They have a blue drive icon to the left of them).

    When this is complete, open up an elevated command prompt. Go to C:\Program Files (x86\Microsoft IoT\FFU.
    Run the following command:

    Code:
    dism.exe /Apply-Image /ImageFile:flash.ffu /ApplyDrive:\\.\PhysicalDriveN /SkipPlatformCheck

    Where N is the disk number. At this point, you should start seeing a bunch of volumes created. The MainOS volume is the one we'll care about.
    Go to that drive and copy the Windows\System32\cmd.exe and Windows\system32\en-us\cmd.exe.mui to your phone's Document's folder.

    Next step is to open up the Interop Tools app, and tap on the Interop Unlock menu item from the hamburger menu. Select the option to restore NDTKSvc, reboot.
    When the device comes back up, re-open Interop Tools and this time click on the Registry Editor from the hamburger menu.

    Enter the following values, then press Write Data:

    Registry Hive : HKEY_LOCAL_MACHINE
    Registry Type: String
    Registry Key Path: SYSTEM\Controlset001\Control\SSH\Sirepuser
    Registry Value Name: default-shell
    Registry Value Data: C:\Data\Users\Public\Documents\cmd.exe

    Write this key tap on the hamburger menu and go to the Registry Browser. Travel to HKEY_LOCAL_MACHINE -> SYSTEM -> ControlSet001 -> Control -> Ci.

    Tap the + button on the application bar and make sure the values are set to the following and then press Write:

    Registry Hive: HKEY_LOCAL_MACHINE
    Registry Type: Integer
    Registry Key Path: SYSTEM\ControlSet001\Control\CI
    Registry Value Name: UMCIAuditMode
    Registry Value Data: 1

    This actually enables the execution of unsigned executables. This is how we end up making CMD and the other programs work ^_^.

    Reboot your phone. Wait a good 3-5 minutes before you try doing anything because your phone will be acting very unstable (Some apps crashing, and others working).
    While you have pageant open and the private key added, open up a putty SSH session to your phone using the username of Sirepuser. You should be delighted at this point (If you did everything correctly) to see a Command Prompt. You should be getting random resource string errors when you try typing DIR, etc and this is due to the fact that we don't have the mui string in the correct place. Let's fix that.

    ONE BIG THING TO NOTE: running CMD in SSH is very sensitive to keystrokes. If you are typing a command and press backspace even once, then the command won't send at all. It will state that it doesn't recognize what you're doing, so be sure to type these things in FLAWLESSLY (yeah it's annoying)


    What we want to do now is then copy the cmd.exe to C:\Windows\System32 and the cmd.exe.mui to C:\Windows\System32\en-US. Run the following commands:

    copy c:\Data\Users\Public\cmd.exe c:\Windows\System32
    copy c:\Data\Users\Public\cmd.exe.mui c:\Windows\System32\en-US

    Back on your phone, go back to Interop Tools and click on the Registry Editor. Follow the same exact steps as you did for changing the default-shell key, but make one change:

    Registry Value Data: C:\Windows\system32\cmd.exe

    At this point, restart your putty session and then you'll be good to go with CMD running over SSH as SYSTEM!

    Extra:

    There was a reason I said to copy off the system32 folder somewhere... If you follow the same process to get the files to your Documents folder and move them over to system32, you can have quite a bit of exes to run from the command line. The easiest thing to do is to use xcopy to get everything there.

    Extra #2:
    You can run .NET Console apps in CMD if they are named the following 3 names: TailoredDeploy.exe, WConnectAgent.exe or WConnectAgentLauncher.exe.

    Make a directory on your SD Card named "test" or put it in the test directory on your phone's C: drive and it should go. Beware that the runtime is weird on the phone and not ALL things are possible to do with a .NET Console app

    PLEASE... For the love of god DO NOT add DefApps to the Administrators group if you don't want all of your apps to stop working



    Have fun ^_^

    Also...

    USE THIS AT YOUR OWN RISK! I AM NOT RESPONSIBLE IF YOU BLOW UP YOUR PHONE ON PURPOSE OR BY ACCIDENT :)
    6
    Great guide, @snickler!

    A few things I've found useful:
    1. Don't use the "Sirepuser" SSH/SFTP user for shell and file system access; it breaks deploying stuff to the phone (until you restore its default configuration). Instead, create a new user, give it the same username as your PC username, and set that one up (this is easy to do using the Interop Tools app). That lets you remote in to run arbitrary stuff, without screwing up your phone. It also means you don't have to supply a username anymore (at least for command-line tools); the client will use your username by default.
    2. If you want to add a bunch of programs but don't want to worry about putting them in the MainOS partition (which is limited size and doesn't get cleared on hard reset), consider
      Code:
      C:\Data\Test\Bin
      (or U:\Test\Bin, same thing), which is in the Data partition but also included in PATH by default.
    3. Two programs to make sure you have in your phone's PATH (or otherwise easily reached) are TLIST.EXE (task list, similar to the usual "tasklist.exe" on Windows except inexplicably superior; for example, it supports giving a tree output showing process ancestry) and KILL.EXE (again, much like "taskkill.exe" on Windows except better). These are included in the Win10IoT System32 directory.
    4. While SSH/SFTP have the huge advantage of security, the server on the phone kiiinda sucks. For much better performance, reliability, and compatibility, use TELNETD and FTPD, attached to this post. Copy the files to the phone, preferably somewhere easy like U:\Test\Bin. To start them, SSH to the phone, then run the commands
      Code:
      start TELNETD cmd.exe
      Code:
      start FTPD
      Note that this will leave them running at all times; use tlist.exe and kill.exe to shut them down when finished or you give anybody on the same WiFi as you total control of your phone! You can use the telnet client built into Windows (you'll need to enable it from OptionalFeatures.exe), or use the one that comes with the Linux subsystem for Windows (bash.exe), or use a third-party one like PuTTY. For FTP, you *can* just use command line or browser-based (or third-party) FTP, but the best option is just to use the built-in support in Explorer; just navigate to "ftp://<YOUR_PHONE_IP>" and you'll see the root of the phone's filesystem. Advantages:
      • Both FTP and Telnet are really fast. SSH/SFTP is good, these are better.
      • No need for third-party clients, setting protocol levels, etc.
      • FTPD doesn't choke on large files the way the phone's SFTP server does, at least for me.
      • TELNETD supports things like "backspace" and "arrow keys" and other highly-advanced concepts. Tab completion works!
      The obvious downside: there is no user authentication, no server authentication, no encryption, and no integrity checks. In other words, it is completely insecure. DO NOT USE THIS ON A SHARED WIFI NETWORK!
    5. For Powershell, use TELNETD. Either run powershell after connecting to telnet, or just launch TELNETD pointing at powershell.exe. If you want to run multiple instances of TELNETD, you have to put them on different ports; add a second parameter with the port number.
      Code:
      start telentd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2323
      Tell your telnet client to connect on that port ("telnet <PHONE_IP> 2323"). For me, everything I've tried so far is working. No doubled input, I can see all the output, I can run programs, error messages are colored red, etc.
    3
    Does anyone could export registry System\Currentcontrolset\control\ssh\sirepuser?
    On my 550 there is no keys at all.

    Use reg.exe (from IoT RPI), run via ssh session. Here are all commadls for this tool. In your case it should look like:
    Code:
    [B]reg.exe export HKLM\System\CurrentControlSet\Control\SSH\Sirepuser C:\Data\Users\Public\Documents\sirepuser.reg[/B]

    P.S. BTW, I've grabbed that file for you from my L-950; it was quicker than type this post-scriptum :D
    3
    [Tweaks.xml] Enable Full FS over SFTP

    Code:
      <contributor>snickler @ xda-developers</contributor>
    
      <tweak category="System" name="Enable Full FS over SFTP" type="toggle">
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-home-dir" type="string" default="%FOLDERID_SharedData%\PhoneTools\">
          <value>C:\</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="default-home-dir" type="string" default="%FOLDERID_SharedData%\PhoneTools\">
          <value>C:\</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-mkdir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-open-dir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools(\\.*)*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-read-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-remove-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-rmdir-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-stat-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
        <entry path="HKLM\System\Currentcontrolset\control\ssh\sirepuser" name="sftp-write-file-rex" type="string" default="%FOLDERID_SharedData%\\PhoneTools\\.*">
          <value>.*</value>
        </entry>
      </tweak>

    Ping @sensboston @kwanice @vcfan @Pasquiindustry
    3
    i may have found a way to get all privileges. i have code running now with mostly everything including SeTcbPrivilege