A quick tutorial of installing Windows RT 8.1 on recent Lumia

Search This thread

imbushuo

Member
Nov 21, 2015
16
49
2/18 Update:
USB charging and controller works, audio probably works. Here's some update on this project:

Battery
Put C:\DPP and C:\EFIESP back. Nokia's driver reads C:\EFIESP\Battery.json in kernel mode (WTF). If you have NokiaEnergyDriver.sys and other PMIC/PEP/MIPI BIF (on some models) drivers installed, you should get battery show up.

Sign drivers?
Yes. Sign everything to prevent bad things from happening. I used a commercial certificate for conveience :p, but you don't have to do that. Here's a handy script that generates a self-signed certificate and installs it on your phone: https://gist.github.com/imbushuo/4de89ad18a0f538d8ebd18bf6daca56a

Download it, run it as administrator and specify ImageDir to your phone's partition (in mass storage mode). Then sign all your drivers binaries (and catalogs as well) with the fingerprint provided.

When signing your drivers, remember timpstamp all drivers. DigiCert's help documentation is useful for signing binaries.

Turn off UMCI
See https://xdaforums.com/showpost.php?p=36394268&postcount=222. Set UMCIAuditMode key to allow all desktop applications and UMDF drivers load.

Make USB work
You will need several supplemental drivers from Windows Phone: BattFltr.sys, CAD.sys, ufx01000.sys, ufxsynposys.sys (or ufxchipidea.sys, depends on your chipset). Copy registry keys (HKLM\ControlSet001\Services and HKLM\ControlSet001\Enum\ROOT\CAD / HKLM\ControlSet001\Enum\ROOT\BattFltr) add supplemental WDF registry keys. Some files are attached as attachments, so you can take a look to get some idea about that.

Make Windows Store Apps work on unsupported resolution
See my blog post.

---------

While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no audio), I decided to post this thread as many people asked me about the tutorial. This is just a brief tutorial, you need to have plenty of time on this to make this happen. Be careful as some steps are very dangerous.

This tutorial is provided AS-IS, without any implicit or expressed warranties. By reading this brief tutorial, you are agreed that you are taking your own risk trying this. I am not responsible for any possible consequences of installing Windows RT or other non-Windows Phone OS on Lumia phones. If your phone ships with Windows 10 Mobile, then this tutorial might not fit you. You can try drivers from other models, but I have no guarantee on this.

General workflow
- Unlock your phone with WPInternals 2.4
- Enter mass storage mode, copy registry files from MainOS partition
- Copy files from DPP partition
- Download Windows RT 8.1 ISO (publicly available on Internet, Google it)
- Download a Lumia 2520 recovery image for some files (I will post these files later)
- Download a Windows Phone 8.1 firmware for your phone
- Extract drivers, re-assembly INF files
- Patch some drivers (see my note)
- Self-sign some drivers (see my note)
- Make sure you know what you are doing: Delete MainOS and Data partition, create new NTFS partition for Windows RT. Do not touch other partitions.
- Apply system image (dism works fine)
- Copy DPP files back (C:\DPP)
- Modify sysprep tasks (see my note)
- Apply BCD configuration
- Boot
- Let OOBE fail once
- Go to mass storage mode again, mount registry and force OOBE run again
- Have fun

Notes on this project

ACPI
Reading ACPI DSDT table will help you understand your phone architecture. ACPI tables are located in PLAT partition. It is easy to extract them with 7-zip (after converting FFU to VHD). To decompile dsdt.aml, you need to download iASL tool, which is available on Internet.

Certain devices, like touch screen or panel, require other devices have driver loaded and enabled. This is not shown in Qualcomm's ACPI implementation. In my case, I need PEP, PEP 3rd, GPIO, BAM, I2C Device, QMUX, Shared Memory drivers loaded to make touchscreen work. It varies by model.

Re-assembly INF files
Mount SYSTEM registry from your phone or FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections respectively. See some driver INF files to get some idea.

Remember to check ControlSet001\Service for additional information if necessary. If you are working on Windows Phone 8.1 firmware, check \Windows\System32\Packages to make sure you've got correct files and registry configs. These files are gzipped.

Patch drivers
Certain drivers read DPP partition for device-specific calibration information. While Qualcomm shares the codebase between Windows RT and Windows Phone, DPP partition is handled differently between platforms. You can search Unicode string "PhoneNT" to determine whether drivers read DPP or not.

To fool drivers think they are living in Windows Phone, you can create another multi-string value in the ProductOptions key. I created a value called "AnotherSuite" and filled "PhoneNT" in. Then I modified all "ProductSuite" Unicode strings in drivers to "AnotherSuite". Remember to re-calculate linker checksum (dependencies) and PE checksum.

This is critical to make wireless (Wi-Fi and Bluetooth) subsystem work.

Graphics
DO NOT use user-mode driver module from WP on Windows RT. The Windows Phone Qualcomm GPU driver does not implement DirectX 9, which is required by Windows desktop. Using WP UM driver will crash DWM.

To correctly enable GPU acceleration, use kernel driver and decoder module from your firmware, and user mode driver from Lumia 2520's recovery image. At least this works on Lumia 640 XL.

Touchscreen
Touchscreen works, however, WP driver reports wrong metric system to Windows RT. To workaround this, modify SYSTEM\TOUCH key, make some value larger than expected. See my value for 640XL in attachment.

Remove some sysprep tasks
Remove BCD and WinRE specialization and generalization tasks from sysprep task definition. OOBE will fail still. Boot to mass storage mode, mount SYSTEM registry, change setup type to 1 (see your current OS for ideas about other values), change program path to oobe\msoobe.exe. You should be able to see normal OOBE then.

BCD and Driver Signing
Test signing should be on. Disabling integrity check is recommended (though documentation says this key is ignored prior to Windows 10). Copy catalogs to the new OS, and self-sign drivers you patched.

Kernel Debugger
To enable WinDbg KD, modify your phone BCD:
Code:
bcdedit /store <Path> /dbgsettings usb TARGETNAME:WOATARGET
bcdedit /store <Path> /set {Your OS GUID} Debug On

Connect your phone to PC, start WinDbg, USB kernel debugging, target name "WOATARGET".

Have fun with Windows RT on Lumia, I am going to continue working on audio and battery :)
 

Attachments

  • Touchscreen-workaround.jpg
    Touchscreen-workaround.jpg
    179.3 KB · Views: 5,322
  • ufx01000.zip
    2.9 KB · Views: 1,358
  • ChargingArbitration.zip
    1.2 KB · Views: 1,163
  • Battfltr.zip
    1 KB · Views: 1,058
Last edited:

J0SH1X

Account currently disabled
Jan 3, 2014
1,614
2,292
Aachen
didnt you forgot to make efiesp guid to a efi partition else bcd cant be updated
 

Samuelgames

Senior Member
Aug 21, 2008
60
28
Is there a way to patch the kernel or a bypass to avoid SECURITY_SYSTEM BSOD on MSM8960 devices?

Thanks for your work. I hope to get a newer Windows Phone soon and try Win10PE, I'm working on a custom shell that hopefully grants it a good experience on handheld devices since we lack ARMv7 ShellExperiences
 
Last edited:
  • Like
Reactions: ManuelCrypt

wfnse

Member
Feb 5, 2018
7
0
Fantastic job :good:

Is it possible to enable a second external monitor via Miracast ?
What about bluetooth keyboard and mouse ?

Lumia 950/XL should also support 2x monitors ( DisplayPort/HDMI via USB-C ).
It also has more RAM and might run apps better than L640.
 

J0SH1X

Account currently disabled
Jan 3, 2014
1,614
2,292
Aachen
Qualcomm's firmware is weird, so I didn't do that. (They hard-coded something) Maybe I will try it later with a dev board and see what will happen.

thats weired on my 930 this is NEEDED to get rt to boot but weired enough my 640 lte doesnt boot it at alll but sadly i dont get how to reassamble the inf files (im litterally just comparing my compiled touch driver inf with the registry of my 930)
 

lumia 640

New member
Feb 5, 2018
3
0
I can not find the windows rt on the Internet. Can I send the file link download?

While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no r FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections res
 

XDASumiaki

Member
Jan 11, 2018
22
5
I knew this solution... so they cant make general Qualcomm drivers never. Device specification is nightmare. Better get a hammer and deepmagic :)
 

D-V-D-K

Member
Feb 2, 2014
5
0
Thank you for all the effort of going through this and providing the information.
Can somebody whoever upload fixed registry files and drivers? i was able to follow all steps successfully (except these parts) but on first boot i just get a blue screen with a sad smiley.

Also, i assumed you meant applying the install.wim image via DISM from the Windows RT 8.1 ISO.
(For those who need more help with this, Google: "Append, apply, and export volume images with a Windows Image (.wim) file",
i'm not allowed to post links due to post count).
 
Last edited:

xboxmod

Senior Recognized Developer
May 20, 2007
994
2,010
42
Gap
- Download a Lumia 2520 recovery image for some files (I will post these files later)


Use at your own risk!

Some Lumia 2520 Firmware And Driver Update ‎10. ‎6. ‎2014:
Code:
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20623735_d3143757b17f94d00f53dc6f3f4dbdf48c36430e.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624060_4b5dec4829bf5e013bf5e6c045a4ed9367afe88d.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624064_70ea6951b8f7c7d72963c38e302356f46642ec85.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624552_3c10b74a53f010a90539ea1e606f562d65a03082.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20626644_7f0f6945d5e0e19e78b3794490990145b98e2c0c.cab
http://au.ds.download.windowsupdate.com/d/msdownload/update/driver/drvs/2014/04/20639225_555ea122b93d34720513db1b344254a0a69a158c.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20639552_08956ac77c46334650fc675794d58325f279ddbb.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20640693_4d4f789e1349e350324fb7e31b60514ae191cb46.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20642401_1278d3d9f4ae8d1903ec0c6f0861ec9912139b96.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643591_beca8afddf93a8679f6e875f5abfc44f9395975a.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643598_4a154479fe2ad83eef04c99e96e44b0e88efce8e.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643814_2d9a86009238af018f92aa76a9be453ef9231424.cab
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 34
    2/18 Update:
    USB charging and controller works, audio probably works. Here's some update on this project:

    Battery
    Put C:\DPP and C:\EFIESP back. Nokia's driver reads C:\EFIESP\Battery.json in kernel mode (WTF). If you have NokiaEnergyDriver.sys and other PMIC/PEP/MIPI BIF (on some models) drivers installed, you should get battery show up.

    Sign drivers?
    Yes. Sign everything to prevent bad things from happening. I used a commercial certificate for conveience :p, but you don't have to do that. Here's a handy script that generates a self-signed certificate and installs it on your phone: https://gist.github.com/imbushuo/4de89ad18a0f538d8ebd18bf6daca56a

    Download it, run it as administrator and specify ImageDir to your phone's partition (in mass storage mode). Then sign all your drivers binaries (and catalogs as well) with the fingerprint provided.

    When signing your drivers, remember timpstamp all drivers. DigiCert's help documentation is useful for signing binaries.

    Turn off UMCI
    See https://xdaforums.com/showpost.php?p=36394268&postcount=222. Set UMCIAuditMode key to allow all desktop applications and UMDF drivers load.

    Make USB work
    You will need several supplemental drivers from Windows Phone: BattFltr.sys, CAD.sys, ufx01000.sys, ufxsynposys.sys (or ufxchipidea.sys, depends on your chipset). Copy registry keys (HKLM\ControlSet001\Services and HKLM\ControlSet001\Enum\ROOT\CAD / HKLM\ControlSet001\Enum\ROOT\BattFltr) add supplemental WDF registry keys. Some files are attached as attachments, so you can take a look to get some idea about that.

    Make Windows Store Apps work on unsupported resolution
    See my blog post.

    ---------

    While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no audio), I decided to post this thread as many people asked me about the tutorial. This is just a brief tutorial, you need to have plenty of time on this to make this happen. Be careful as some steps are very dangerous.

    This tutorial is provided AS-IS, without any implicit or expressed warranties. By reading this brief tutorial, you are agreed that you are taking your own risk trying this. I am not responsible for any possible consequences of installing Windows RT or other non-Windows Phone OS on Lumia phones. If your phone ships with Windows 10 Mobile, then this tutorial might not fit you. You can try drivers from other models, but I have no guarantee on this.

    General workflow
    - Unlock your phone with WPInternals 2.4
    - Enter mass storage mode, copy registry files from MainOS partition
    - Copy files from DPP partition
    - Download Windows RT 8.1 ISO (publicly available on Internet, Google it)
    - Download a Lumia 2520 recovery image for some files (I will post these files later)
    - Download a Windows Phone 8.1 firmware for your phone
    - Extract drivers, re-assembly INF files
    - Patch some drivers (see my note)
    - Self-sign some drivers (see my note)
    - Make sure you know what you are doing: Delete MainOS and Data partition, create new NTFS partition for Windows RT. Do not touch other partitions.
    - Apply system image (dism works fine)
    - Copy DPP files back (C:\DPP)
    - Modify sysprep tasks (see my note)
    - Apply BCD configuration
    - Boot
    - Let OOBE fail once
    - Go to mass storage mode again, mount registry and force OOBE run again
    - Have fun

    Notes on this project

    ACPI
    Reading ACPI DSDT table will help you understand your phone architecture. ACPI tables are located in PLAT partition. It is easy to extract them with 7-zip (after converting FFU to VHD). To decompile dsdt.aml, you need to download iASL tool, which is available on Internet.

    Certain devices, like touch screen or panel, require other devices have driver loaded and enabled. This is not shown in Qualcomm's ACPI implementation. In my case, I need PEP, PEP 3rd, GPIO, BAM, I2C Device, QMUX, Shared Memory drivers loaded to make touchscreen work. It varies by model.

    Re-assembly INF files
    Mount SYSTEM registry from your phone or FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections respectively. See some driver INF files to get some idea.

    Remember to check ControlSet001\Service for additional information if necessary. If you are working on Windows Phone 8.1 firmware, check \Windows\System32\Packages to make sure you've got correct files and registry configs. These files are gzipped.

    Patch drivers
    Certain drivers read DPP partition for device-specific calibration information. While Qualcomm shares the codebase between Windows RT and Windows Phone, DPP partition is handled differently between platforms. You can search Unicode string "PhoneNT" to determine whether drivers read DPP or not.

    To fool drivers think they are living in Windows Phone, you can create another multi-string value in the ProductOptions key. I created a value called "AnotherSuite" and filled "PhoneNT" in. Then I modified all "ProductSuite" Unicode strings in drivers to "AnotherSuite". Remember to re-calculate linker checksum (dependencies) and PE checksum.

    This is critical to make wireless (Wi-Fi and Bluetooth) subsystem work.

    Graphics
    DO NOT use user-mode driver module from WP on Windows RT. The Windows Phone Qualcomm GPU driver does not implement DirectX 9, which is required by Windows desktop. Using WP UM driver will crash DWM.

    To correctly enable GPU acceleration, use kernel driver and decoder module from your firmware, and user mode driver from Lumia 2520's recovery image. At least this works on Lumia 640 XL.

    Touchscreen
    Touchscreen works, however, WP driver reports wrong metric system to Windows RT. To workaround this, modify SYSTEM\TOUCH key, make some value larger than expected. See my value for 640XL in attachment.

    Remove some sysprep tasks
    Remove BCD and WinRE specialization and generalization tasks from sysprep task definition. OOBE will fail still. Boot to mass storage mode, mount SYSTEM registry, change setup type to 1 (see your current OS for ideas about other values), change program path to oobe\msoobe.exe. You should be able to see normal OOBE then.

    BCD and Driver Signing
    Test signing should be on. Disabling integrity check is recommended (though documentation says this key is ignored prior to Windows 10). Copy catalogs to the new OS, and self-sign drivers you patched.

    Kernel Debugger
    To enable WinDbg KD, modify your phone BCD:
    Code:
    bcdedit /store <Path> /dbgsettings usb TARGETNAME:WOATARGET
    bcdedit /store <Path> /set {Your OS GUID} Debug On

    Connect your phone to PC, start WinDbg, USB kernel debugging, target name "WOATARGET".

    Have fun with Windows RT on Lumia, I am going to continue working on audio and battery :)
    4
    It should be noted that sharing a premade image has a 80% risk of not working for most people, I've tried sharing drivers and on my phone they didn't work, but they worked on the other phone, same model, most likely because of firmware. In other news found a new way to integrate drivers that is way easier to implement if I was going to automate the whole process, currently experimenting with this idea. If it works out you may see the light of a proper RT installer some day... :)
    4
    Friends i have full L2520 installation iso with drivers etc...

    I uploaded it to server ;)

    https://drive.google.com/open?id=0B3Zc3kB_-SP0N0hNLWo3Q2E2dTA

    King regards :highfive:

    Have fun !! ;)
    2
    didnt you forgot to make efiesp guid to a efi partition else bcd cant be updated

    Qualcomm's firmware is weird, so I didn't do that. (They hard-coded something) Maybe I will try it later with a dev board and see what will happen.
    1
    Download Windows 8.1 RT ISO

    While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no r FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections res

    Hey bro, go to support.microsoft.com/en-au/surfacerecoveryimage, scroll down, you will see "1. Select your Surface device", choose Surface RT, next, fill in Serial Number box: 051905124352, and click Continue button, the download will start. (~2.90GB)
    I tried to do by this way :D
    Good Luck!