Related
Hi all:
Just picked up my first WM device (Tilt) the other day. I'm have a problem turning off the password function on the device. I set it the other day and now it just getting to be a pain entering a password for wife any time she wants to use the phone.
Right now, the "Prompt if device used for" checkbox is greyed out so I cannot de-select it. the longest I can set the time limit for it one hour.
Thanks for any help,
Lost in Alabama
Sounds to me like you're connecting to an Exchange server that has this set as a policy, which shuts down your ability to turn it off. Are you syncing data with Exchange?
That's correct. I have since deleted my sync connection to my Exchange server at work.
thanks for any suggestions.
After some searching, looks like a way to remove the security policy would be to issue a remote wipe of my device from our Exchange Admin team. Would like avoid getting those admin guys involved if possible.
Maybe a hard reset? Seems drastic but that might be what's needed.
i did have the same problem, the only way is to hard reset your phone.
And then you wont be able to sync with the company server...
I would just petition them to increase the default time before the lock is applied.
(Having said that I have mine set to every five mins and thus have to enter the pin quite often- but I like the idea that its secure)
I have the same problem but i have set time after device wants password to 24 hours, so i never have to enter the password besides of booting up the device.
There is a program you can install that allows you to remove the security password policy on wm phones even while still synced with the exchange server. Zenyee.com Stay Unlock is the name of the program. I can't remember where to get it though. I just checked the Zenyee site and due to it's lack of a search feature I can't seem to find it again.
Found some other discussion on this elsewhere on the forums. Here is a link to a post by coderuckus talking about changing registry settings to circumvent the policy:
http://forum.xda-developers.com/showpost.php?p=1367367&postcount=1
going to fiddle with that later today and report back my findings.
I had the same problem - install the cab from the following thread and you'll be fine : http://forum.xda-developers.com/showthread.php?t=329570&highlight=Zenyee
Zerodivider said:
I had the same problem - install the cab from the following thread and you'll be fine : http://forum.xda-developers.com/showthread.php?t=329570&highlight=Zenyee
Click to expand...
Click to collapse
Jackpot! Thanks Zerodivider.
As info the directions from Coderuckus works to disable the security policy but it invalidates the sync'ability back to Exchange (at least in my case).
Directions below:
using a device registry editor (remote, or PHM) modify the following key(s)
The Exchange Security Policy (4131) updates the device policy:
HKLM\Security\Policies\00001023: 0 = Enabled; 1 = Disabled
Thanks for the help everybody!
Hello Everyone,
I recently bought an EEE PC as a second computer and seeing as it's about the most easily lost or stolen laptop ever made, I thought it might be an idea to run some software on it that might help me recover it should it ever go missing.
After trying a few existing bits of software and not finding any satisfactory, I resorted to writing my own.
Since it seemed useful to me, I thought I'd make it available to anyone interested. It's a very early version at the moment and very basic, but I don't think there are too many bugs (famous last words!! ).
I thought I would post a message here as I use this forum quite a lot, and I know a lot of people here won't have a problem with editing the config file to set it up, I've tried to make things as simple as possible. However, if you don't know the difference between POP3 and SMTP mail servers, this app is probably not for you!!
If people are interested, I'll continue to develop it further. A few ideas are listed on my website.
Visit www.ajhonline.co.uk for download links and help.
Alex
this isn't hard to circumvent.
Nice app, but wouldn't they probably wipe the HDD?
How would it compare to Lojack's (utilizes Computrace) service? Some laptops have the Computrace service embedded in the bios. I currently use a Dell D410 and Panasonic CF-19, and they both have Computrace built into the bios. If someone formats my hard drive, or installs another harddrive, the bios will rebuild the neccessary files, run in the the background and start reporting the IP address back to Lojack.
Yes, of course the hard drive could be wiped, or it could never be connected to the internet. It is also easy to circumvent, although if I do develop it further, it would be fairly straight forward to make it less obvious and better hidden. This is only a very first version, to gauge interest more than anything,
It's not meant to be 100% foolproof, that probably isn't possible anyway. The advantage is it's free. I really developed it because I couldn't get Adeona to work (it just kept failing to connect to its server), not to compete with commercial solutions.
Hmmm, you know how I said I didn't think there were any bugs....
I just found that the Windows version was not saving the detected IP addresses correctly, so it would email you a "new" IP address message every time the computer was rebooted.
However the problem is now fixed, and a new version 0.1a available for download. The cross platform version wouldn't have been affected, but there's a new version of that too, just for completeness.
Sorry
Alex
I've now made some additions and released a new version which includes the changes below:
Added a separate configuration application to simplify initial setup
Added the ability to encrypt the mail server password for better security
Added a link to DNSTools to the IP Detected email for easy lookup of the WHOIS records for the IP Address
As before, visit www.ajhonline.co.uk and download version 0.2 from there.
Alex
PS - If you are using the Windows version and doing an upgrade from a previous version, make sure you keep a copy of your existing fyl.properties file, otherwise it will be overwritten during the install and any existing known IP addresses will be lost.
huff,.
i wish i have seen this before i lost my friend laptop,.
great help sir,. keep up,.
Version 0.22 is now available for download from www.ajhonline.co.uk.
It's only a small update; you are now able to specify a range of IP addresses as already known so that you don't get an email when one of those is detected.
Alex
Ok, so lets get cracking on this bootloader.
boot.img and recovery.img certs (thanks to ntwrkwizard):
http://ponack.net/designgears/atrix/mmcblk0p10 - cert extract.zip
http://ponack.net/designgears/atrix/mmcblk0p11 - cert extract.zip
Flaw in the X.509 certs:
http://www.darkreading.com/security/vulnerabilities/218900008/index.html
Boot.img & Recovery.img
http://www.ponack.net/designgears/dump.7z
DG, afaik, that exploit deals with the md2 hash algorithm. it is a good possible starting point. has the signing cert been found/recovered/viewed yet?
if moto signed it with an md5 hash cert, then that may not be possible.
Well if you guys need any processing power to help crack anything let me know. I am willing to donate my system. Current specs:
i7-970 six core 4.8ghz overclocked
4 gtx580 gpus
24gb ddr3 2000
HSDL 240gb ssd
Like I said, if you guys need any processing power let me know.
Sent from my "5 inch Galaxy Tab"
Atrix here on the 22nd
dtmcnamara said:
Well if you guys need any processing power to help crack anything let me know. I am willing to donate my system. Current specs:
i7-970 six core 4.8ghz overclocked
4 gtx580 gpus
24gb ddr3 2000
HSDL 240gb ssd
Like I said, if you guys need any processing power let me know.
Sent from my "5 inch Galaxy Tab"
Atrix here on the 22nd
Click to expand...
Click to collapse
Please don't post here. This is a dev only thread. Post your offer in General.
Thanks!
These downloads look like just CA certs. Could someone extract the x.509 cert embedded in the beginning of the boot.img and post it to this thread? I'm out and about this weekend and don't have a box with a hex editor handy.
perdurabo2 said:
These downloads look like just CA certs. Could someone extract the x.509 cert embedded in the beginning of the boot.img and post it to this thread? I'm out and about this weekend and don't have a box with a hex editor handy.
Click to expand...
Click to collapse
If you could tell me how to do that I will be more than happy to get those for you. I'm the go to guy, remember?
Here is the extracted cert from within mmcblk0p10.img. This hex dump is extracted from 7FF7FC through 7FFDF9.
Also is the extracted cert from within mmcblk0p11.img. This hex dump is extracted from 7FF7FC through 7FFE79.
Not sure the value of an extracted public side of the x.509 is post signature but I'm sure someone will define that.
Good luck..
NW
back on topic please.
Mr. Clown said:
back on topic please.
Click to expand...
Click to collapse
Who are you talking to? The cert conversation is applicable.
Hi friend,
is the bootloader encrypten the same as defy or milestone?
Or a new one?
Maybe we could get all a free bootloader if this would work?
Or other technical?
Thanks
perdurabo2 said:
Who are you talking to? The cert conversation is applicable.
Click to expand...
Click to collapse
He deleted some unnecessary posts which were getting off topic. That's all.
The structure of an X.509 v3 digital certificate is as follows:
Certificate
Version
Serial Number
Algorithm ID
Issuer
Validity
Not Before
Not After
Subject
Subject Public Key Info
Public Key Algorithm
Subject Public Key
Issuer Unique Identifier (optional)
Subject Unique Identifier (optional)
Extensions (optional)
...
Certificate Signature Algorithm
Certificate Signature
Click to expand...
Click to collapse
The extensions they come in are:
pem - (Privacy Enhanced Mail) Base64 encoded DER certificate, enclosed between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----"
.cer, .crt, .der - usually in binary DER form, but Base64-encoded certificates are common too (see .pem above)
.p7b, .p7c - PKCS#7 SignedData structure without data, just certificate(s) or CRL(s)
.p12 - PKCS#12, may contain certificate(s) (public) and private keys (password protected)
.pfx - PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., with PFX files generated in IIS)
PKCS#7 is a standard for signing or encrypting (officially called "enveloping") data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A .P7C file is a degenerated SignedData structure, without any data to sign.
PKCS#12 evolved from the personal information exchange (PFX) standard and is used to exchange public and private objects in a single file.
Click to expand...
Click to collapse
Flaws in the X509 Certificate:
Specification: Complexity and lack of quality
The X.509 standard was primarily designed to support the X.500 structure, but todays use cases center around the web. Many features are of little or no relevance today. The X.509 specification suffers from being over-functional and underspecified and the normative information is spread across many documents from different standardization bodies. Several profiles were developed to solve this, but these introduce interoperability issues and did not fix the problem.
Architectural flaws
Use of blacklisting invalid certificates (using CRLs and OCSP) instead of whitelisting
CRLs are particularly poor because of size and distribution patterns
Ambiguous OCSP semantics and lack of historical revocation status
Revocation of root certificates not addressed
Aggregation problem: Identity claim (authenticate with an identifier), attribute claim (submit a bag of vetted attributes) and policy claim are combined in a single container. This raises privacy, policy mapping and maintenance issues.
Delegation problem: CAs cannot technically restrict subCAs to issue only certificates within a limited namespaces and attribute set – this feature of X.509 in not in use. Therefore a large number of CAs exists in the Internet, and classifying them and their policies is an insurmountable task. Delegation of authority within an organization cannot be handled at all, like it is common business practice.
Federation problem: Certificate chains that are the result of sub-CAs, bridge- and cross-signing make validation complex and expensive in terms of processing time. Path validation semantics may be ambiguous. Hierarchy with 3rd-party trusted party is the only model. This is inconvenient when a bilateral trust relationship is already in place.
Problems of Commercial Certificate Authorities
Flawed business model: The subject, not the relying party, purchases certificates. The RA will usually go for the cheapest offer; quality is not being paid for in the competing market.
CAs deny almost all warranties to the user.
Expiration date: Should be used to limit the time the key strength is deemed sufficient. Abused by CAs to charge the client an extension fee. Places unnecessary burden on user with key roll-over.
Client certificates have zero protection value against dedicated attackers.
In browsers, the security is that of the weakest CA. There are very weak CAs.
“Users use an undefined certification request protocol to obtain a certificate which is published in an unclear location in a nonexistent directory with no real means to revoke it.“
Implementation issues
Implementation suffer from design flaws, bugs, different interpretations of standards and lack of interoperability of different standards. Some problems are:
Many implementations turn off revocation check:
Seen as obstacle, policies are not enforced
Would it be turned on in all browsers by default, including code signing, it would probably crash the infrastructure.
DNs are complex and little understood (lack of cononicalization, i18n problems, ..)
rfc822Name has 2 notations
Name and policy constraints hardly supported
Key usage ignored, first certificate in a list being used
Enforcement of custom OIDs is difficult
Attributes should not be made critical because it makes clients crash.
Unspecified length of attributes lead to product-specific limits
Exploits
In 2005, Arjen Lenstra and Benne de Weger demonstrated "how to use hash collisions to construct two X.509 certificates that contain identical signatures and that differ only in the public keys", achieved using a collision attack on the MD5 hash function.
In 2008, Alexander Sotirov and Marc Stevens presented at the Chaos Communication Congress a practical attack that allowed them to create a rogue Certificate Authority, accepted by all common browsers, by exploiting the fact that RapidSSL was still issuing X.509 certificates based on MD5.
X.509 certificates based on SHA-1 had been deemed to be secure up until very recent times. In April 2009 at the Eurocrypt Conference , Australian Researchers of Macquarie University presented "Automatic Differential Path Searching for SHA-1" . The researchers were able to deduce a method which increases the likelihood of a collision by several orders of magnitude.
Domain-validated certificates („Junk certificates“) are still trusted by web browsers, and can be obtained with little effort from commercial CAs.
EV-certificates are of very limited help, because Browsers do not have policies that disallow DV-certificates,
There are implementation errors with X.509 that allow e.g. falsified subject names using null-terminated strings or code injections attacks in certificates.
Click to expand...
Click to collapse
From the sound of it, the X.509 cerificate the Atrix uses will be in .p12 format, although I could be wrong.
Example of a Decoded X509 cert: http://pastie.org/1590676
Great post, this is def a way to go and explore , i have been messsing with NVIDIAFlash all day so far.. i think if i can get a bootstrap or something on here so that i can mount and add some files to system folder with phone off i may be on to something ..
t0dbld said:
Great post, this is def a way to go and explore , i have been messsing with NVIDIAFlash all day so far.. i think if i can get a bootstrap or something on here so that i can mount and add some files to system folder with phone off i may be on to something ..
Click to expand...
Click to collapse
Adding things to the system folder means nothing, the system partition is only check when a new system is flashed via (sbf_flash, rsdlite, or flashing a CG via an update.zip) otherwise you can add/remove items from the /system partition with no worries of the signatures.
I've got a question. Since we are dealing with a closed system. Can we not validate -enddate of the signed boot image. Make note of the exact date and time. Then change the system clock to less than 24 hrs. after this date. This will allow the entire system to think that the bootloader and cert have done their job and simply needs updated. Now we simply need to insert new boot.img that has a valid -startdate within that 24 hr period. The system should simply stop using the expired image and boot the "updated image". Once this generic image is booted, it can simply be swapped out with any further custom roms that we feel the need to use. Once all is done, the system clock will need to be restored to appropriate time. If I knew how to code, I would simply try this myself. But I don't, so I hope this might at least provide some insight to the possibility. I would love to work with developers on finding a solution to this problem, so feel free to ask questions.
jimmydafish said:
Adding things to the system folder means nothing, the system partition is only check when a new system is flashed via (sbf_flash, rsdlite, or flashing a CG via an update.zip) otherwise you can add/remove items from the /system partition with no worries of the signatures.
Click to expand...
Click to collapse
I 100% agree i didnt say that was the end all.... the reason for doing this is so that the computer recoginizes the device in NVIDIAFlash mode and i than can hopefully overwrite the bootloader with the dev version of bootloader.bin
t0dbld said:
I 100% agree i didnt say that was the end all.... the reason for doing this is so that the computer recoginizes the device in NVIDIAFlash mode and i than can hopefully overwrite the bootloader with the dev version of bootloader.bin
Click to expand...
Click to collapse
That will not work, the bootloader is just one piece of a longer chain..changing that out "will" just have the phone reboot and use the backup bootloader. The problem to cracking it lies in all parts. Especially the NvRam where it begins and the MBR.
jimmydafish said:
That will not work, the bootloader is just one piece of a longer chain..changing that out "will" just have the phone reboot and use the backup bootloader. The problem to cracking it lies in all parts. Especially the NvRam where it begins and the MBR.
Click to expand...
Click to collapse
I very much respect all of the work you and your team has put into this situation with other devices, and i very much appreciate the help given by you guys to this forum, and no one including myself wants to waste time, so that being said i have not seen any ideas contributed ... only negative posts on what isnt going to work, i agree that you guys know more than me on this situation perhaps if you could share some of your ideas or the approach or direction you are going i and others could be of some help. We our fresh and not quite so beat up , its like when debuging a program thats driving you nuts and you cant figure out whats going wrong , sometimes a break, sleep, etc is in order so that when you come back your whole train of thought has been altered and you see something differently because you were not looking there before.
I follow instructions well, so lead... i am willing to donate my time my resources, and more than likely my device (at least for the next 29 days )
t0dbld said:
I very much respect all of the work you and your team has put into this situation with other devices, and i very much appreciate the help given by you guys to this forum, and no one including myself wants to waste time, so that being said i have not seen any ideas contributed ... only negative posts on what isnt going to work, i agree that you guys know more than me on this situation perhaps if you could share some of your ideas or the approach or direction you are going i and others could be of some help. We our fresh and not quite so beat up , its like when debuging a program thats driving you nuts and you cant figure out whats going wrong , sometimes a break, sleep, etc is in order so that when you come back your whole train of thought has been altered and you see something differently because you were not looking there before.
I follow instructions well, so lead... i am willing to donate my time my resources, and more than likely my device (at least for the next 29 days )
Click to expand...
Click to collapse
I am not being negative just helping you all steer clear of dead ends. We are looking over some files now and may have some useful tidbits soon. I think we can tell the boot chain from start to finish.
Great!! thanks for the update... on a side note esp in loom of this whole ps3 thing i hope motorola uses the same signing keys for all devices, so that if our day ever comes its x-mas for all
Does any one know the registry settings to enable internet sharing?
There's a small collection of them, what isn't working about it on your phone? If it's something like the mobile operator permission check, then yeah, we can bypass that.
GoodDayToDie said:
There's a small collection of them, what isn't working about it on your phone? If it's something like the mobile operator permission check, then yeah, we can bypass that.
Click to expand...
Click to collapse
Really? I missed that. Is that in a thread somewhere?
I have the Samsung Ativ S Neo from Ssprint.
-Tdecision10
There are a number of threads about Internet Sharing and about registry tweaking. The requirement for tethering to be enabled on your account is checked by a mobile operator-specific DLL that is used by ICSSVC (the Internet Connection Sharing SerViCe). There's a registry value that tells the phone what DLL to load, or whether to load any. If you don't tell it to use any, it defaults to assuming you have access.
There are a number of ways to make registry changes on your phone. You can flash a custom CSC (not a full ROM, though if you look for "custom ROM" on the dev&hacking subforum, you'll find stuff about it), or you can edit the registry directly using a hijacked app chamber, or you can interop-unlock (itself requiring a registry edit, so you probably need to use the chamber hack unless you're on an old version of Samsung's firmware) and unblock RPC, then use the RPCComponent.
GoodDayToDie said:
There are a number of threads about Internet Sharing and about registry tweaking. The requirement for tethering to be enabled on your account is checked by a mobile operator-specific DLL that is used by ICSSVC (the Internet Connection Sharing SerViCe). There's a registry value that tells the phone what DLL to load, or whether to load any. If you don't tell it to use any, it defaults to assuming you have access.
There are a number of ways to make registry changes on your phone. You can flash a custom CSC (not a full ROM, though if you look for "custom ROM" on the dev&hacking subforum, you'll find stuff about it), or you can edit the registry directly using a hijacked app chamber, or you can interop-unlock (itself requiring a registry edit, so you probably need to use the chamber hack unless you're on an old version of Samsung's firmware) and unblock RPC, then use the RPCComponent.
Click to expand...
Click to collapse
http://forum.xda-developers.com/showpost.php?p=54929482&postcount=13
http://forum.xda-developers.com/showpost.php?p=54652850&postcount=575
I followed and did everything posted in these but I'm still not sure if there was a solution for s print.
"and unblock RPC, then use the RPCComponent. " I think this is the part I need to be educated on.
-tdecision10
That is one (of several) methods for editing the registry. It can write more places than the other methods, but only works on Strings and Integers (DWORDs) and is only usable on Samsung phones. It requires that your process have ID_CAP_INTEROPSERVICES, which many OEM apps (and some first-party ones, like Skype) have, but which is not normally available to sideloaded apps.
"Unblock RPC" is the term we use for telling a Samsung service that it's in test mode by placing a file named "Non-production errors.txt" in the Documents folder of the phone. This will allow using RPCComponent anywhere in the registry, instead of just in a few specific places. Search for "unblock rpc" to learn more.
RPCComponent is a Samsung-provided native (C++/CX) DLL and WINMD for accessing various privileged functions by means of a high-privilege RPC (Remote Procedure Call) server. It is not publicly available but is bundled in many of Samsung's OEM apps and is available on this forum inside most .XAP files intended for use on Samsung phones (such as my own BootstrapSamsung tool; see the interop-unlock thread). As mentioned above, you need ID_CAP_INTEROPSERVICES for it to be useful.
GoodDayToDie said:
That is one (of several) methods for editing the registry. It can write more places than the other methods, but only works on Strings and Integers (DWORDs) and is only usable on Samsung phones. It requires that your process have ID_CAP_INTEROPSERVICES, which many OEM apps (and some first-party ones, like Skype) have, but which is not normally available to sideloaded apps.
"Unblock RPC" is the term we use for telling a Samsung service that it's in test mode by placing a file named "Non-production errors.txt" in the Documents folder of the phone. This will allow using RPCComponent anywhere in the registry, instead of just in a few specific places. Search for "unblock rpc" to learn more.
RPCComponent is a Samsung-provided native (C++/CX) DLL and WINMD for accessing various privileged functions by means of a high-privilege RPC (Remote Procedure Call) server. It is not publicly available but is bundled in many of Samsung's OEM apps and is available on this forum inside most .XAP files intended for use on Samsung phones (such as my own BootstrapSamsung tool; see the interop-unlock thread). As mentioned above, you need ID_CAP_INTEROPSERVICES for it to be useful.
Click to expand...
Click to collapse
I interop-unlocked (all-capabilities) my phone using methods you've posted. This was earlier in the year sometime.
http://forum.xda-developers.com/showpost.php?p=54929482&postcount=13
I followed this closely but didn't see any finality.
I just added the Non-production errors.txt in the place noted on that relative thread.
Not sure what to do next.
Forgive me if I am being a bother.
-tdecision10
Yeah i'm completely lost. The EnableAllSideloading XAP won't deploy for me (The manifest could not be loaded and may not be valid) so I can't even full unlock, and I have no clue how to go about using the MBN creator. So if you could hold my hand, I'd love it....
okay so I figured out MBN creator (kinda) but I still need to know the proper reg settings to disable the carrier authorization check.... i.e. the setting that points to the carrier specific DLL you mentioned...
EnableAllSideloading doesn't work on WP8.1 because they changed the security on the registry key where it operates. If you can't sideload it, that's because you're not interop-unlocked at all.
MBN Creator should, in theory, not require any particular customization unless your operator requires it; the *default* state of the Internet Sharing feature is "no restrictions, enabled by default". Several people have reported that IS started working after they flashed a custom CSC even though that CSC had nothing to do with IS, just because it removed the carrier-specific customizations that were present (and were blocking IS from working) before.
@tdecision10: If you are or were able to capability-unlock, then you can just sideload any registry editor tool you want and use that. Some of them are better than others, of course. A handful of apps, like WPTelnetD (https://github.com/FurballTheGreat/WPTelnetD/releases), ship with almost no capabilities so that they can be sideloaded on any phone, but you could unpack the XAP and edit the capability list before installing if you want to. A capability that gives access to the relevant registry key is ID_CAP_RUNTIME_CONFIG.
GoodDayToDie said:
EnableAllSideloading doesn't work on WP8.1 because they changed the security on the registry key where it operates. If you can't sideload it, that's because you're not interop-unlocked at all.
MBN Creator should, in theory, not require any particular customization unless your operator requires it; the *default* state of the Internet Sharing feature is "no restrictions, enabled by default". Several people have reported that IS started working after they flashed a custom CSC even though that CSC had nothing to do with IS, just because it removed the carrier-specific customizations that were present (and were blocking IS from working) before.
@tdecision10: If you are or were able to capability-unlock, then you can just sideload any registry editor tool you want and use that. Some of them are better than others, of course. A handful of apps, like WPTelnetD (https://github.com/FurballTheGreat/WPTelnetD/releases), ship with almost no capabilities so that they can be sideloaded on any phone, but you could unpack the XAP and edit the capability list before installing if you want to. A capability that gives access to the relevant registry key is ID_CAP_RUNTIME_CONFIG.
Click to expand...
Click to collapse
Okay, I put Pasquiindustry CustomPFD on my pc unzipped it added that capability in the WPAppManifest. xml file, rezipped it but now it won't deploy.
Did I think it was too simple?
EDIT:
For Spr int, I think I need to figure out how to do this:
TetheringNAIConnection
Optional. Specifies the CDMA TetheringNAI Connection Manager cellular connection that internet sharing will use as a public connection.
If a CDMA mobile operator requires using a Tethering NAI during internet sharing, they must configure a TetheringNAI connection and then specify the connection in this node.
Specified connections will be mapped, by policy, to the internet sharing service. All attempts to enumerate Connection Manager connections for the internet sharing service will return only the mapped connections.
The mapping policy will also include the connections specified in the DedicatedConnections as well.
(This is the error I get)
If the specified connections do not exist, internet sharing will not start because it will not have any cellular connections available to share
Anyone know how to add this to the APN settings?
-tdecision10
well, i reverted to 8.0 and then updated to 8.1 via retail without thinking.... so i got the new firmware and took myself out of the game :crying:
edit: reverted back to 8.0 again and i have the old firmware again. i think using the mbn creator is key. with older versions of windows phone, the APN settings were all built into the rom. now they are provisioned OTA. everytime i change the CSC, the device fails the authorization check with sprints servers and the device doesn't provision itself. what we need is the provxml that contains all of sprints APN settings. I used to have this information in a kitchen for WM 6.5, but sadly, I deleted it a long time ago. i can currently do one thing or another, unlock internet sharing but have no data connection, or, have a data connection with internet sharing locked. i believe that i can make a custom CSC with all the necessary edits but I need to get my hands on the correct sprint provxml first. I've tried and tried to find an old kitchen for Sprint with the correct files in it, but because it's so old most of them are dead download links. I think even a stock RUU for the GOLD_C (Sprint's HTC Arrive) would do. If anyone has this or can track it down I think we'd be in business....
@GoodDayToDie thanks for all the input, it's really helpful. I think that most people have found success by simply changing their CSC because their phones are not CDMA. we've got all these extra restrictions that keep the technology from working automatically
also, i believe that if I could manage to somehow get my MSL unlock code, I could manually program the APN. problem is, CDMA Workshop can't read it, and the free version doesn't let you use the brute force option to find it. Sprint changed their policy in October to under no circumstances giving out the MSL code unless your contract is up. I'm going to continue to keep trying different tech support reps to see if I can get one of them to give it up.
@tdecision10 I'm getting close, but I REALLY need those WM 6.5/7 Sprint OEM packages..... if you know of anyone or come across it browsing it would be immensely helpful!
mtstmp, I have leadpoizon's old rom for HTC Arrive. Let me know if that will work and if so, how to get it to you.
-tdecision10
Q&A for [WP8.1] Hypothesis about a possible interop unlock with Messaging+ app
Some developers prefer that questions remain separate from their main development thread to help keep things organized. Placing your question within this thread will increase its chances of being answered by a member of the community or by the developer.
Before posting, please use the forum search and read through the discussion thread for [WP8.1] Hypothesis about a possible interop unlock with Messaging+ app. If you can't find an answer, post it here, being sure to give as much information as possible (firmware version, steps to reproduce, logcat if available) so that you can get help.
Thanks for understanding and for helping to keep XDA neat and tidy!
CAPs required for editing registry
snickler said:
You won't achieve any sort of interop-unlock with such an app. The Messaging+ app uses capabilities specific to chat that are restricted. Just because an app uses the interopservices capability, does not mean that it has rights to write to the specific portion of the registry needed to provide interop-unlock. There are a few threads out there that discuss this already
Click to expand...
Click to collapse
I am curious what CAP is required for editing the registry?
gingerjoke said:
I am curious what CAP is required for editing the registry?
Click to expand...
Click to collapse
You at least need ID_CAP_INTEROPSERVICES or ID_CAP_OEM_DEPLOYMENT at the minimum. There are many threads that detail that interop unlock canNOT be achieved unless we have an RPC Service that runs under the SYSTEM account. The MaxUnsignedApp reg value is locked down so that it can only be edited in the way that I just spoke of.
No app on the marketplace, no modifying a store app will achieve this. We were just VERY lucky with Samsung in the beginning.. That's all.
More generally true: there are lots of CAPs (such as OEM_DEPLOYMENT) that permit editing specific parts of the registry. There is *NO* capability that allows you to edit all of it (in theory ID_CAP_BUILTIN_TCB should, through minor additional work, but in practice that cap doesn't seem to do anything for an app).
ID_CAP_INTEROPSERVICES does not give registry access, or at least not any meaningful amount. All that it gives is the ability to call into RPC servers and drivers. *IF* one of those services exposes an externally-callable API for editing the registry - as one of Samsung's (FCROUTER?) does, or at least did - then you can use that to edit the registry. So in that specific case, INTEROPSERVICES indirectly makes it possible to edit the registry, but it doesn't inherently do anything of the sort.
GoodDayToDie said:
More generally true: there are lots of CAPs (such as OEM_DEPLOYMENT) that permit editing specific parts of the registry. There is *NO* capability that allows you to edit all of it (in theory ID_CAP_BUILTIN_TCB should, through minor additional work, but in practice that cap doesn't seem to do anything for an app).
ID_CAP_INTEROPSERVICES does not give registry access, or at least not any meaningful amount. All that it gives is the ability to call into RPC servers and drivers. *IF* one of those services exposes an externally-callable API for editing the registry - as one of Samsung's (FCROUTER?) does, or at least did - then you can use that to edit the registry. So in that specific case, INTEROPSERVICES indirectly makes it possible to edit the registry, but it doesn't inherently do anything of the sort.
Click to expand...
Click to collapse
Finally found RPC service in NdtkSvc.dll
But requires InteropServices Capability
Here is list of functions works as "SYSTEM".
CopyFileEx()
NdrServerCall2()
CreateThreadpoolWait()
SetThreadpoolWait()
CloseThreadpoolWait()
SetEvent()
SetServiceStatus()
CreateEventW()
RegisterServiceCtrlHandlerW()
CloseHandle()
OpenProcessToken()
FindFirstFileW()
CopyFileExW()
GetCurrentProcess()
CreateDirectoryW()
RegCreateKeyExW()
RegQueryValueExW()
IsCharAlphaNumericW()
LookupPrivilegeValueW()
FindClose()
RemoveDirectoryW()
RegOpenKeyExW()
FindNextFileW()
AdjustTokenPrivileges()
InitiateSystemShutdownExW()
DeleteFileW()
RegCloseKey()
RegSetValueExW()
RpcServerUnregisterIfEx()
RpcServerInqBindings()
RpcEpRegisterW()
RpcServerUseProtseqW()
RpcBindingVectorFree()
RpcServerRegisterIf3()
RpcEpUnregister()
ResetPhoneEx()
EncodePointer()
DecodePointer()
QueryPerformanceCounter()
GetCurrentThreadId()
GetSystemTimeAsFileTime()
GetTickCount64()
But I'm confused about how to write a code for as RPC Client or using any DllImport functionality. ?
Can someone provide me at least demo/example code of RPC client ?
... Whoa, that is a seriously valuable list of APIs. Those are callable as SYSTEM, without any restrictions except the caller needing ID_CAP_INTEROPSERVICES? Either I've been out of the loop longer than I thought or this should have been discovered long ago (is it new to some not-yet-widely-available version?) You cannot *trivially* get root this way - it doesn't, for example, include the APIs you would need to inject arbitrary code into a SYSTEM process or similar - but you can certainly do things like write an arbitrarily powerful file-and-registry browser. With that, you can do a hell of a lot of other stuff, stuff that even Samsung's RPCComponent didn't permit.
MS RPC is documented on MSDN here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378651(v=vs.85).aspx
It includes a full API reference, lots of guidance on development, and a tutorial. The tutorial looks pretty well-written, and is probably a better place to start than the API reference unless you know more about RPC at the moment than I do.
However, this documentation is aimed at "normal" implementations, where the client has, if not the server's source code, at least the interface definition. You have to know the UUID (probably easily findable though I'm not sure where) and the function interfaces (in a reasonable level of detail). Black-boxing that is going to be one of the harder tricks, I think, though somebody may have written one or more tools to make it easier.
EDIT: I can't find NdtkSvc, or its binary, on my phone. It's either OEM-specific or (more likely) requires a particular OS update/upgrade. What version did you find it in?
EDIT2: How'd you get the list of APIs it serves? Do you have the IDL file for the RPC server? That would help a ton; if you have that, we're good to go.
EDIT3: Don't forget you can PM people if you don't want to put this stuff out in public.
@GoodDayToDie
Hi, Sorry for the late reply.
It is only specific for Lumia.
NdtkSvc.dll known as "Nokia Device Toolkit Service".
"C:\Windows\System32\NdtkSvc.dll"
Yes, ID_CAP_INTEROPSERVICES cap is everything here too on Lumia.
Here is a one of the example which same "Nokia.SilentInstaller.Runtime" does that on RPC Access,
Code:
static bool NRSCopyFile(String sourcePath, String destPath);
works without any "RESTRICTIONS", with any "PARTITION".
Even possibilities to "REPLACE" the hidden/non-accessible Registry "HIVE" Files.
Such as,
"C:\Windows\System32\Config\ProvisonStore"
But unfortunately they are all in simply zip file having a signed.
We can't modify and place back them such HIVE/POLICY files, sad
So what i did it so far,
-Modified "DeviceReg.exe" with hex-editor and replaced to "C:\PROGRAMS\DEVICEREG\DeviceReg.exe". (signature getting a braked)
-Replaced "PolicyFiles". (signature getting a braked)
It's frustrating to me, It's shame for me that i cant do anything having a full FS Access, lol.
Such files and System binaries are fully signed with the new 8.1 "Policy Engine".
but i think .dll files doesn't required to be signed to run in System chamber.
Well, Time to write a some RPC library
Thanks.
Edit: I don't know about which update is required, I think it is from WP8.0 GDR1. At least WP8.1 GDR1 or above.
but the "NdtkClient.dll" is available since WP8.0 GDR1 in "Extras+Info" App.