[TEST MODE] Windows Phone 8/8.1 for Retail Device

djamol · Oct 29, 2015

Hello Folks,
We are introducing a way to apply @Myrianchan's WindowsRT "Test Mode" hack to Windows Phone 8/8.1 and Windows 10 Mobile Preview builds before 10572.
Yeah,Actually this not my complete hack but @Myriachan discovered wonderful hack I've ever seen. So the FULL credits goes to her of course.
Probably to Enable test Mode for Phone you have to Full Registry Access to configure the BCD objects "Boot Configuration Data".
Yeah, we have vcReg editor base upon this for Lumia Devices.
This is NOT specific about the LUMIA device but for now we have only lumia device with FULL Registry Access.

**********
CAUTIONS.
please, DON'T BE STUPID. IT'S UEFI Hacking. Bricking chances is maximum and potentially too Dangerous.
It can be a permanent damage to the Device and no one will recover your device. like[Nokia/Microsoft Care. ATF Box]
So the, I'm/Any other XDA Member not responsible for any damage to your device. Use it on your own risk.
**********

Introduction to Test-Signing.
Test-signing refers to using a test certificate to sign a pre-release version of a driver package for use on test computers. In particular, this allows developers to sign kernel-mode binaries by using self-signed certificates, such as those the MakeCert tool generates. Starting with Windows Vista, this capability allows developers to test kernel-mode binaries on Windows with driver signature verification enabled.
More details are here.

Introduction to Test-Signing Hack for Windows Phone.
Specifically, the "Trusted Boot Security Feature Bypass Vulnerability – CVE-2015-2552" is Myriachan's jailbreak exploit.

The exploit itself is simple. Run an administrator PowerShell (can't be cmd), and execute the following command, then reboot:

bcdedit /set '{current}' loadoptions '/TŅSTSIGNING'

(The Ņ character is Unicode character U+0145, which you can find in Character Map if you need it.)
Your system will come up in "test signing" mode, along with a watermark on the desktop indicating this. While in test-signing mode, applications still have to be signed, but they can be signed by anyone, including your own self-signed certificates.

How to sign executables for this is mostly beyond the scope of what I'm posting. Use makecert and signtool. Your certificate must be at least 2048-bit RSA. When using signtool, be sure to timestamp your executable (/t option), use page hashing mode (/ph) and SHA-256 (/fd SHA256).

More Details of why this works:
http://pastebin.com/w5U2qTR0
Source

How to Enable Test-Sign on Windows Phone.
Yeah, It is also Simple.
Not Got much time to write simple tool for it. (I'll attached xap here later)

You have to write this Registry Key and Value.

1. Deploy and RUN VcReg Editor.
2. Select "HKEY_LOCAL_MACHINE"
3. Select "String"

Enter Without Quote.
Path:

Code:

"BCD00000001\objects\{7619dcc9-fafe-11d9-b411-000476eba25f}\Elements\12000030"

(your guid may vary)

Key:

Code:

"Element"

Value:

Code:

"/TŅSTSIGNING"

*** NOTE THAT, "Ņ" character is Unicode character U+0145. So don't mess with it. Probably Copy and Paste it. ***

4. HIT WRITE BUTTON !!!
5. REBOOT DEVICE.
That's It.

To verify Test Mode is Actually Enabled or Not
Read the below registry key and value.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control]
"SystemStartOptions"
It should have Included a value of "TESTSIGNING"(theres other strings too,forget them) . If not that mean it didn't work.

*** This is permanent TEST-SING mode. After the Hard reset it will stay "ENABLED". if you want to disable simply flash the Stock ROM***

Thanks,
Credits.
Special thanks to @vcfan, Without his RPC Code really unreachable registry access.
@Myriachan For this wonderful discovery.

djamol · Oct 29, 2015

Reserved Post for Official Test packages.

Microsoft.MS_TSHELL.MSN.MainOS.spkg
(Remove ".zip" extension)

djamol · Oct 29, 2015 at 5:35 AM

Reserved for Custom Packages.
Also You can post your custom package in this thread, I'll attach here to this post.

tfwboredom · Oct 21, 2012 57 59 0

How are we supposed to find our GUID in case it's different?

Wack0Distractor · Nov 3, 2015 at 7:32 PM

I got code execution as SYSTEM through this.

See http://forum.xda-developers.com/windows-phone-8/general/code-execution-test-mode-t3239066

titi66200 · Nov 3, 2015 at 9:02 PM

Do not works on my lumia 1020 with this GUID how can i find GUID?

Wack0Distractor · Nov 3, 2015 at 9:22 PM

titi66200 said:
Do not works on my lumia 1020 with this GUID how can i find GUID?

I think the easiest way would be to grab the BCD from one of your phone's FFUs (convert it to VHD, open it with winimage, go to the first partition (FAT32), it'll be in \efi\microsoft\boot), then run the exploit in PowerShell in the directory you extracted the BCD to like:

bcdedit /store BCD /set '{default}' loadoptions '/TŅSTSIGNING'

then load the BCD as a registry hive in regedit and search it for "STSIGNING", find the GUID as the result.

titi66200 · Nov 4, 2015 at 12:06 PM

Works on Lumia 830 Windows Phone 8.1 Version 8.10.15148.160 but not on Lumia 1020 Windows Mobile 10 Version 10.0.10581.0.

ngame · Nov 4, 2015 at 1:11 PM

titi66200 said:
Works on Lumia 830 Windows Phone 8.1 Version 8.10.15148.160 but not on Lumia 1020 Windows Mobile 10 Version 10.0.10581.0.

This patched on 10581 do the thing I did .
flash back your 1020 to 8.1 and get Insider Slow ring update (it's build 10166)
do Interop Unlock using VCReg v2.2 . in build 10166 this bug is still presents .

winphouser · Jul 3, 2015 158 153 0

???

520, 640xl

Get 10166 before they close the entrance!!

madycoot · Nov 30, 2015 at 5:10 PM

need help on iball I701

djamol said:
Reserved Post for Official Test packages.

Microsoft.MS_TSHELL.MSN.MainOS.spkg
(Remove ".zip" extension)

Hello sir i have Iball I701 windows * tablet n i want to make it android can it be possible n can u plz guide me how i can make this possible plz thank you

Ranjan kataria · Sep 7, 2015 27 2 0

madycoot said:
Hello sir i have Iball I701 windows * tablet n i want to make it android can it be possible n can u plz guide me how i can make this possible plz thank you

Though my vision isn't possible if then thumbs up ?

titi66200 · Dec 6, 2015 at 1:37 PM

Is there any way to do this on Win10 10.0.586.29?

djamol · Dec 6, 2015 at 2:11 PM

titi66200 said:
Is there any way to do this on Win10 10.0.586.29?

No. Not Possible.
It has been patch in build 572.
So it will not work on later builds untill secured boot if OFF.

titi66200 · Dec 6, 2015 at 2:16 PM

My bootloader is unlocked with Windows Phone Internals.
I can deploy testsigning packages?

djamol · Dec 6, 2015 at 2:39 PM

titi66200 said:
Is there any way to do this on Win10 10.0.586.29?

titi66200 said:
My bootloader is unlocked with Windows Phone Internals.
I can deploy testsigning packages?

Yes.
Put device into MassStorage Mode.
Bcdedit.exe /store D:\xyz -set TESTSIGNING ON
Or through reg edit.
Refers official msdn page.

titi66200 · Dec 6, 2015 at 7:30 PM

bcdedit /store H:\EFIESP\efi\Microsoft\Boot\BCD -set TESTSIGNING ON
But error
An error occurred while trying referencing the specified entry.
The specified file can not be found.

djamol · Dec 7, 2015 at 4:18 AM

titi66200 said:
bcdedit /store H:\EFIESP\efi\Microsoft\Boot\BCD -set TESTSIGNING ON
But error
An error occurred while trying referencing the specified entry.
The specified file can not be found.

Hmm, then edit BCD entries through vcRegEditor.
Grab BCD (Its hive file) from FFU or your device.
"C:\EFIESP\efi\Microsoft\Boot\BCD"
run whatever commands. (like dual boot)
Observe objects and elements.
Write same Object Elements using vcreg Editor.
while writing to the BCD use this "BCD00000001" instead of "BCD".
Cheers...

Here is some test entries from Engineering Device.
GlobalSettings

Code:

[HKEY_LOCAL_MACHINE\BCD\Objects\{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}\Elements\16000049]
"Element"=hex:01

Boot Manager.

Code:

[HKEY_LOCAL_MACHINE\BCD\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\16000049]
"Element"=hex:01

titi66200 · Dec 7, 2015 at 11:19 AM

Found "Microsoft.BaseOS.EnableTestSigning_BCDStore_0.reg" in EFIESP.bin from RM825_1232.2101.1239.3001_PROD_developer_265_01_86530.ffu

Code:

[HKEY_LOCAL_MACHINE\BCD]

[HKEY_LOCAL_MACHINE\BCD\Objects]

[HKEY_LOCAL_MACHINE\BCD\Objects\{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}\Elements]

[HKEY_LOCAL_MACHINE\BCD\Objects\{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}\Elements\16000049]
"Element"=hex:01

[HKEY_LOCAL_MACHINE\BCD\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements]

[HKEY_LOCAL_MACHINE\BCD\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\16000049]
"Element"=hex:00

djamol · Dec 7, 2015 at 11:35 AM

titi66200 said:

Found "Microsoft.BaseOS.EnableTestSigning_BCDStore_0.reg" in EFIESP.bin from RM825_1232.2101.1239.3001_PROD_developer_265_01_86530.ffu

Code:

[HKEY_LOCAL_MACHINE\BCD]

[HKEY_LOCAL_MACHINE\BCD\Objects]

[HKEY_LOCAL_MACHINE\BCD\Objects\{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}\Elements]

[HKEY_LOCAL_MACHINE\BCD\Objects\{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}\Elements\16000049]
"Element"=hex:01

[HKEY_LOCAL_MACHINE\BCD\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements]

[HKEY_LOCAL_MACHINE\BCD\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\16000049]
"Element"=hex:00

Yes. Exactly.

[TEST MODE] Windows Phone 8/8.1 for Retail Device

Senior Member

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member