Writing to system files and registry?

[Myriachan]

Hi... I'm from the Windows RT jailbreaking world and don't have a Windows Phone, so please excuse my ignorance.

I have an exploit in Microsoft's Secure Boot code that works on all architectures. I suspect that the same bug works on Windows Phone 8. However, it requires writing to privileged areas of the system. This is easy in desktop Windows and in Windows RT, but I have no idea of its feasibility on Windows Phone 8.

Doss anyone here have insight into this? =^_^=

My RT jailbreak proof (8.1, so not the existing one):
https://mobile.twitter.com/Myriachan/statuses/365350790803619840

 

[petard]

Hi... I'm from the Windows RT jailbreaking world and don't have a Windows Phone, so please excuse my ignorance.

I have an exploit in Microsoft's Secure Boot code that works on all architectures. I suspect that the same bug works on Windows Phone 8. However, it requires writing to privileged areas of the system. This is easy in desktop Windows and in Windows RT, but I have no idea of its feasibility on Windows Phone 8.

Doss anyone here have insight into this? =^_^=

My RT jailbreak proof (8.1, so not the existing one):
https://mobile.twitter.com/Myriachan/statuses/365350790803619840

Unfortunately WP8 is locked down tight and no one can write to the OS partition as far as I know.

 

[Myriachan]

Unfortunately WP8 is locked down tight and no one can write to the OS partition as far as I know.

So to pull it off, you'd need an NT kernel privilege escalation exploit that could be done from a low box token in the WP8 sandbox...yuck. Possible, though. Such an exploit would obviate my exploit, though, because then you could make a side loaded app that jailbreaks the phone when you run it.

 

[frama001]

As I understand, some registry values can currently be modified via this app. Can't help much more unfortunately.

 

[aclegg2011]

some of the registry can be accessed, but not all. snickler, gooddaytodie and others are trying to find a way to write to registry. theres a thread on here that talks about the progress.

 

[GoodDayToDie]

In particular, we have read-only access to most of the registry, but not much (if any) in the way of write access, beyond what a handful of built in and OEM apps can do (OEM apps can have extra permissions; some store settings in the registry and/or change system configurations, but I haven't yet found a way to get arbitrary access).

Great work on that RT exploit, though. It actually may be useful on the phone even if we do find an arbitrary app EoP exploit - it could make it a lot easier to do certain things - but the most likely EoP is actually us finding a way to abuse an OEM (or built-in) app to change the registry and/or file system. If we can find that, a way to then run arbitrary code with full permissions would be a really useful thing to use such a hack for...