[SUCCESS] Interop-Unlocking LUMIA - with JTAG

[lordmaxey]

A JTAG dump I made with ATF.

I will make dumps from some additional 520s to check again.

Great, it's good to see people trying this

Are you dumping the whole MainOS partition?
How are you mounting the *.bin file?
I used a freeware called OSFMount, works great.

 

[pete_es]

Great, it's good to see people trying this

Are you dumping the whole MainOS partition?
How are you mounting the *.bin file?
I used a freeware called OSFMount, works great.

Yes, the whole flash from phone. Then I use OSFMount to mount partitions as drive with associated drive letter.

Since there are rumors about direct unlocking (Simlock) of Lumia WP8 via USB there might be a security hole we don't know at this time.

I have several 520 to test. So I can play with WP8, WP 8.1 etc.

 

[tids2k]

Yes, the whole flash from phone. Then I use OSFMount to mount partitions as drive with associated drive letter.

Since there are rumors about direct unlocking (Simlock) of Lumia WP8 via USB there might be a security hole we don't know at this time.

I have several 520 to test. So I can play with WP8, WP 8.1 etc.

Good luck !

 

[chinitopex]

hi guys
have a doubt about this cause my phone is lumia 520 model
so.. i can unlock for use anything sim cards network?
how much?

 

[lordmaxey]

hi guys
have a doubt about this cause my phone is lumia 520 model
so.. i can unlock for use anything sim cards network?
how much?

No, not now.
Interop Unlock has nothing to do with SIM unlock.

 

[EnZl]

Can interop unlock help with notification delay? E.g. facebook or whatsapp message notification

Sent from my GT-N7100 using XDA Free mobile app

 

[titi66200]

No

 

[_wook_]

Lumia 1020 wp 8.1 (registry kept after update)

 

[djs92mg]

thinking

could you repack rom dump to be flashed by nokia care suit ?

 

[tfBullet]

could you repack rom dump to be flashed by nokia care suit ?

No.

Sure you could repack it, or even just modify a update package direcly but the phone would reject it because the signature is broken...

 

[megasounds]

No.

Sure you could repack it, or even just modify a update package direcly but the phone would reject it because the signature is broken...

OK is this an idea ??
try to flash the nokia phone with the original package ...but just seconds before flashing replace it with the "repacked" version
will this work ??

m

 

[tfBullet]

OK is this an idea ??
try to flash the nokia phone with the original package ...but just seconds before flashing replace it with the "repacked" version
will this work ??

m

No, the phone checks the signature, before anything is written to the storage

By useing JTAG we write more or less direclty to the flash storeage, therefor the phone has no chance to check anything,
This isn't anything like a normal software update you do by nokia care suite...
Please do a google search for JTAG, and take a look at the last post of the achievments topic
It might give you an idea...

I'm having exams right now, but i'm working out a cheap and easy way atm...

 

[ceesheim]

No, the phone checks the signature, before anything is written to the storage

By useing JTAG we write more or less direclty to the flash storeage, therefor the phone has no chance to check anything,
This isn't anything like a normal software update you do by nokia care suite...
Please do a google search for JTAG, and take a look at the last post of the achievments topic
It might give you an idea...

I'm having exams right now, but i'm working out a cheap and easy way atm...

correction, the phone still check signature of everything, just remove the sig of a file(.exe or spl or EFI ) and you will see it will be a non boot for you.
only things you could edit are .reg files and some .xml files

 

[tfBullet]

correction, the phone still check signature of everything, just remove the sig of a file(.exe or spl or EFI ) and you will see it will be a non boot for you.
only things you could edit are .reg files and some .xml files

Exactly, i refered to the update/install verification checks,
the boot time checks aren't touched/affected at all
Sorry for the confusion

 

[-W_O_L_F-]

OK is this an idea ??
try to flash the nokia phone with the original package ...but just seconds before flashing replace it with the "repacked" version
will this work ??

m

All exe, dll, kernel, bootloader files are signed. And signature is verified before every start up of those files. You can't change them if SecureBoot is enabled, otherwise OS won't boot.

 

[fonix232]

Just an idea, and please don't scoff me if it was already thought upon, but...
Why not just modify the signature key storage? I mean, wouldn't it be easier to patch that area, have a generic key inserted, grant it OEM level, and play further with that?

By my understanding, there are multiple levels of key storage, detailed HERE. Say, we patch the PK, to a custom, public one (I do understand the threat of this, having a public key, BUT. It could be worked around if a tool was to be used, which would generate a PK replacement before flashing, so that it would be a one-time use key only). Then any application signed with that key, any modified firmware anything can be easily installed, in theory. I do understand that it's a bit further thinking than working with registry hives, but after all, this would be the ultimate goal: unlocking our phones so it can load any app, firmware, etc. we want on it.

 

[hillbeast]

Just an idea, and please don't scoff me if it was already thought upon, but...
Why not just modify the signature key storage? I mean, wouldn't it be easier to patch that area, have a generic key inserted, grant it OEM level, and play further with that?

By my understanding, there are multiple levels of key storage, detailed HERE. Say, we patch the PK, to a custom, public one (I do understand the threat of this, having a public key, BUT. It could be worked around if a tool was to be used, which would generate a PK replacement before flashing, so that it would be a one-time use key only). Then any application signed with that key, any modified firmware anything can be easily installed, in theory. I do understand that it's a bit further thinking than working with registry hives, but after all, this would be the ultimate goal: unlocking our phones so it can load any app, firmware, etc. we want on it.

It's all a chain of trust that goes all the way back to the first boot loader, and the chain of trust is started up by the internal ROM built into the SoC, and secure boot is fused making it impossible to disable it, so the only way to get out of the chain of trust is to find an exploit somewhere in the chain that would allow higher level access to the hardware, say a bootloader exploit, and considering software is designed quite well these days, you'll be lucky to find an exploit any time soon.

You'd have more like trying to sign your own code with the private key, which could take thousands and thousands of years to brute force.

 

[fonix232]

It's all a chain of trust that goes all the way back to the first boot loader, and the chain of trust is started up by the internal ROM built into the SoC, and secure boot is fused making it impossible to disable it, so the only way to get out of the chain of trust is to find an exploit somewhere in the chain that would allow higher level access to the hardware, say a bootloader exploit, and considering software is designed quite well these days, you'll be lucky to find an exploit any time soon.

You'd have more like trying to sign your own code with the private key, which could take thousands and thousands of years to brute force.

You are right, but there must be a way to change certificates. Just to mention, the Nokia-Microsoft ownership change should have triggered a certificate replacement (as sending the original keys over any kind of medium would've been quite stupid). And I'm pretty sure Microsoft has a backup plan in case the certificates are leaked - because then they need to replace them on ALL phones, some way. And they can't just discard all the current stock, sold and unsold, and reprogram all SOCs in all phones.

I know it's a quite unlikely scenario, but Microsoft isn't the company that does not have any plan B-Z's for almost any occasion.

 

[ceesheim]

You are right, but there must be a way to change certificates. Just to mention, the Nokia-Microsoft ownership change should have triggered a certificate replacement.

there never was a Nokia cert on wp8.* because all was already signed by Microsoft.

 

[-W_O_L_F-]

there never was a Nokia cert on wp8.* because all was already signed by Microsoft.

PK is OEM cert. It CAN be updated, but we don't know how. And we don't even know where it is.