Microsoft offering free unlocks, 2 app sideload limit

[GoodDayToDie]

Well, I'll have to do more investigation, but off the top of my head there's one obvious problem: you're trying to set MaxUnsignedApp as a String value rather than a DWORD.

With that said, WP8 has a "limited provisioning" function. It quite possibly restricts what providers (such as Registry, FileSystem, HotSpot, etc.) can be used...

 

[IzaacJ]

Yeah, that might be a reason, but I doubt it since the unedited file sadly renders the same result.

 

[cpuguy]

As @thals1992 mentioned, the AETX contains a certificate store for Microsoft's "Enterprise" applications. It contains the top CA (Symantec Enterprise Mobile CA for Microsoft) as well as what seems to be a unique SPC linking it back to the original App Studio account (the SPC certificate's subject contains my unique ID). The SPC certificate (public key only) contains the "Enterprise" OID (2.16.840.1.113733.1.8.52.1).

The "EnrollmentToken" found in the provxml content is contained in a <AET> element. This element is signed using the standard XML signing format. So if we were to modify it and inject our stuff in there, we'd still need to sign it using a valid MS certificate (I'm guessing). Nonetheless, this is a provxml request so, who knows what other kind of data we can put in there...

One more thing that I could add is that the "AETX" file types are associated to "\programs\EnterpriseInstall\EnterpriseInstall.exe". The application is launched with the following argument: TOKEN={0}&TYPE=.AETX (where {0} is something - maybe the XML content of the <AET> element?). This is the exact same application that's used for regular XAP files; the only difference is the "TYPE" query string is set to ".XAP" instead of ".AETX". I'm able to call this exe and pass the parameters manually using my "Native Toast Notification Launcher" app and inputting the following URI (replace {0} and {1} accordingly): app://DA52FA01-AC0F-479D-957F-BFE4595941CB/DefaultTask?TOKEN={0}&TYPE=.{1}

Note: I haven't tried to actually pass the <AET> data yet to EnterpriseInstall.exe, I'm too tired, I'll try that tomorrow...

 

[snickler]

As @thals1992 mentioned, the AETX contains a certificate store for Microsoft's "Enterprise" applications. It contains the top CA (Symantec Enterprise Mobile CA for Microsoft) as well as what seems to be a unique SPC linking it back to the original App Studio account (the SPC certificate's subject contains my unique ID). The SPC certificate (public key only) contains the "Enterprise" OID (2.16.840.1.113733.1.8.52.1).

The "EnrollmentToken" found in the provxml content is contained in a <AET> element. This element is signed using the standard XML signing format. So if we were to modify it and inject our stuff in there, we'd still need to sign it using a valid MS certificate (I'm guessing). Nonetheless, this is a provxml request so, who knows what other kind of data we can put in there...

One more thing that I could add is that the "AETX" file types are associated to "\programs\EnterpriseInstall\EnterpriseInstall.exe". The application is launched with the following argument: TOKEN={0}&TYPE=.AETX (where {0} is something - maybe the XML content of the <AET> element?). This is the exact same application that's used for regular XAP files; the only difference is the "TYPE" query string is set to ".XAP" instead of ".AETX". I'm able to call this exe and pass the parameters manually using my "Native Toast Notification Launcher" app and inputting the following URI (replace {0} and {1} accordingly): app://DA52FA01-AC0F-479D-957F-BFE4595941CB/DefaultTask?TOKEN={0}&TYPE=.{1}

Note: I haven't tried to actually pass the <AET> data yet to EnterpriseInstall.exe, I'm too tired, I'll try that tomorrow...

Whoa! How did you find the guid for the EnterpriseInstaller?

 

[GoodDayToDie]

Maybe out of HKCR? Though that would probably get you the EXE path instead (which I see you also have). In any case, invoking the app installer from another app would be very cool.

 

[cpuguy]

Whoa! How did you find the guid for the EnterpriseInstaller?

Most EXE <-> GUID links can be found in "\Windows\System32\Manifests". The EnterpriseInstaller GUID (as well as tasks and arguments) are found in "EnterpriseInstall.xml" As a side note, you'll notice in the XML file that the path to the executable is "\programs\EnterpriseInstall\EnterpriseInstall.exe"... That's not very useful right now since we can't launch it directly (...for now...) - we need to launch it using the GUID which is close enough.

 

[fariborz2]

Hi