A quick tutorial of installing Windows RT 8.1 on recent Lumia - Windows Phone 8 Development and Hacking

2/18 Update:
USB charging and controller works, audio probably works. Here's some update on this project:
Battery
Put C:\DPP and C:\EFIESP back. Nokia's driver reads C:\EFIESP\Battery.json in kernel mode (WTF). If you have NokiaEnergyDriver.sys and other PMIC/PEP/MIPI BIF (on some models) drivers installed, you should get battery show up.
Sign drivers?
Yes. Sign everything to prevent bad things from happening. I used a commercial certificate for conveience , but you don't have to do that. Here's a handy script that generates a self-signed certificate and installs it on your phone: https://gist.github.com/imbushuo/4de89ad18a0f538d8ebd18bf6daca56a
Download it, run it as administrator and specify ImageDir to your phone's partition (in mass storage mode). Then sign all your drivers binaries (and catalogs as well) with the fingerprint provided.
When signing your drivers, remember timpstamp all drivers. DigiCert's help documentation is useful for signing binaries.
Turn off UMCI
See https://forum.xda-developers.com/showpost.php?p=36394268&postcount=222. Set UMCIAuditMode key to allow all desktop applications and UMDF drivers load.
Make USB work
You will need several supplemental drivers from Windows Phone: BattFltr.sys, CAD.sys, ufx01000.sys, ufxsynposys.sys (or ufxchipidea.sys, depends on your chipset). Copy registry keys (HKLM\ControlSet001\Services and HKLM\ControlSet001\Enum\ROOT\CAD / HKLM\ControlSet001\Enum\ROOT\BattFltr) add supplemental WDF registry keys. Some files are attached as attachments, so you can take a look to get some idea about that.
Make Windows Store Apps work on unsupported resolution
See my blog post.
---------
While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no audio), I decided to post this thread as many people asked me about the tutorial. This is just a brief tutorial, you need to have plenty of time on this to make this happen. Be careful as some steps are very dangerous.
This tutorial is provided AS-IS, without any implicit or expressed warranties. By reading this brief tutorial, you are agreed that you are taking your own risk trying this. I am not responsible for any possible consequences of installing Windows RT or other non-Windows Phone OS on Lumia phones. If your phone ships with Windows 10 Mobile, then this tutorial might not fit you. You can try drivers from other models, but I have no guarantee on this.
General workflow
- Unlock your phone with WPInternals 2.4
- Enter mass storage mode, copy registry files from MainOS partition
- Copy files from DPP partition
- Download Windows RT 8.1 ISO (publicly available on Internet, Google it)
- Download a Lumia 2520 recovery image for some files (I will post these files later)
- Download a Windows Phone 8.1 firmware for your phone
- Extract drivers, re-assembly INF files
- Patch some drivers (see my note)
- Self-sign some drivers (see my note)
- Make sure you know what you are doing: Delete MainOS and Data partition, create new NTFS partition for Windows RT. Do not touch other partitions.
- Apply system image (dism works fine)
- Copy DPP files back (C:\DPP)
- Modify sysprep tasks (see my note)
- Apply BCD configuration
- Boot
- Let OOBE fail once
- Go to mass storage mode again, mount registry and force OOBE run again
- Have fun
Notes on this project
ACPI
Reading ACPI DSDT table will help you understand your phone architecture. ACPI tables are located in PLAT partition. It is easy to extract them with 7-zip (after converting FFU to VHD). To decompile dsdt.aml, you need to download iASL tool, which is available on Internet.
Certain devices, like touch screen or panel, require other devices have driver loaded and enabled. This is not shown in Qualcomm's ACPI implementation. In my case, I need PEP, PEP 3rd, GPIO, BAM, I2C Device, QMUX, Shared Memory drivers loaded to make touchscreen work. It varies by model.
Re-assembly INF files
Mount SYSTEM registry from your phone or FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections respectively. See some driver INF files to get some idea.
Remember to check ControlSet001\Service for additional information if necessary. If you are working on Windows Phone 8.1 firmware, check \Windows\System32\Packages to make sure you've got correct files and registry configs. These files are gzipped.
Patch drivers
Certain drivers read DPP partition for device-specific calibration information. While Qualcomm shares the codebase between Windows RT and Windows Phone, DPP partition is handled differently between platforms. You can search Unicode string "PhoneNT" to determine whether drivers read DPP or not.
To fool drivers think they are living in Windows Phone, you can create another multi-string value in the ProductOptions key. I created a value called "AnotherSuite" and filled "PhoneNT" in. Then I modified all "ProductSuite" Unicode strings in drivers to "AnotherSuite". Remember to re-calculate linker checksum (dependencies) and PE checksum.
This is critical to make wireless (Wi-Fi and Bluetooth) subsystem work.
Graphics
DO NOT use user-mode driver module from WP on Windows RT. The Windows Phone Qualcomm GPU driver does not implement DirectX 9, which is required by Windows desktop. Using WP UM driver will crash DWM.
To correctly enable GPU acceleration, use kernel driver and decoder module from your firmware, and user mode driver from Lumia 2520's recovery image. At least this works on Lumia 640 XL.
Touchscreen
Touchscreen works, however, WP driver reports wrong metric system to Windows RT. To workaround this, modify SYSTEM\TOUCH key, make some value larger than expected. See my value for 640XL in attachment.
Remove some sysprep tasks
Remove BCD and WinRE specialization and generalization tasks from sysprep task definition. OOBE will fail still. Boot to mass storage mode, mount SYSTEM registry, change setup type to 1 (see your current OS for ideas about other values), change program path to oobe\msoobe.exe. You should be able to see normal OOBE then.
BCD and Driver Signing
Test signing should be on. Disabling integrity check is recommended (though documentation says this key is ignored prior to Windows 10). Copy catalogs to the new OS, and self-sign drivers you patched.
Kernel Debugger
To enable WinDbg KD, modify your phone BCD:
Code:
bcdedit /store <Path> /dbgsettings usb TARGETNAME:WOATARGET
bcdedit /store <Path> /set {Your OS GUID} Debug On
Connect your phone to PC, start WinDbg, USB kernel debugging, target name "WOATARGET".
Have fun with Windows RT on Lumia, I am going to continue working on audio and battery

Follow
Ty Imbushuo , GREAT WORK

didnt you forgot to make efiesp guid to a efi partition else bcd cant be updated

Is there a way to patch the kernel or a bypass to avoid SECURITY_SYSTEM BSOD on MSM8960 devices?
Thanks for your work. I hope to get a newer Windows Phone soon and try Win10PE, I'm working on a custom shell that hopefully grants it a good experience on handheld devices since we lack ARMv7 ShellExperiences

J0SH1X said:
didnt you forgot to make efiesp guid to a efi partition else bcd cant be updated
Click to expand...
Click to collapse
Qualcomm's firmware is weird, so I didn't do that. (They hard-coded something) Maybe I will try it later with a dev board and see what will happen.

Fantastic job :good:
Is it possible to enable a second external monitor via Miracast ?
What about bluetooth keyboard and mouse ?
Lumia 950/XL should also support 2x monitors ( DisplayPort/HDMI via USB-C ).
It also has more RAM and might run apps better than L640.

imbushuo said:
Qualcomm's firmware is weird, so I didn't do that. (They hard-coded something) Maybe I will try it later with a dev board and see what will happen.
Click to expand...
Click to collapse
thats weired on my 930 this is NEEDED to get rt to boot but weired enough my 640 lte doesnt boot it at alll but sadly i dont get how to reassamble the inf files (im litterally just comparing my compiled touch driver inf with the registry of my 930)

I can not find the windows rt on the Internet. Can I send the file link download?
imbushuo said:
While this project is not totally finished (e.g. No Battery status/charging unknown, no cellular, no r FFU, go to DriverDatabase\DriverPackages\<Some Driver Package>, each key in driver package key matches INF sections res
Click to expand...
Click to collapse

I use google translate so it's hard to follow, it's great when you have a video tutorial, everything is more intuitive and easy.

INF files Qualcomm ARM-based View attachment Inf.zip

prokakavip said:
I use google translate so it's hard to follow, it's great when you have a video tutorial, everything is more intuitive and easy.
Click to expand...
Click to collapse
If you are an end user I would recommend waiting for WPInternals partition dumps for your device

I knew this solution... so they cant make general Qualcomm drivers never. Device specification is nightmare. Better get a hammer and deepmagic

Thank you for all the effort of going through this and providing the information.
Can somebody whoever upload fixed registry files and drivers? i was able to follow all steps successfully (except these parts) but on first boot i just get a blue screen with a sad smiley.
Also, i assumed you meant applying the install.wim image via DISM from the Windows RT 8.1 ISO.
(For those who need more help with this, Google: "Append, apply, and export volume images with a Windows Image (.wim) file",
i'm not allowed to post links due to post count).

Die Anleitung ist jetzt auch in deutsch verfügbar und hier zu finden:
Windows RT 8.1 auf ein Lumia installieren

WPVision.de said:
Die Anleitung ist jetzt auch in deutsch verfügbar und hier zu finden:
Click to expand...
Click to collapse
I registered and it still said i'm not allowed to visit the forum because i dont have permission.

D-V-D-K said:
I registered and it still said i'm not allowed to visit the forum because i dont have permission.
Click to expand...
Click to collapse
That's correct, because you did not follow the guidelines.
The activation for this area is done manually by your first post.

Samuelgames said:
If you are an end user I would recommend waiting for WPInternals partition dumps for your device
Click to expand...
Click to collapse
Can you upload your partition dumps for 640xl?

Removed. Sorry I was being rash.

spavlin said:
INF files Qualcomm ARM-based View attachment 4410518
Click to expand...
Click to collapse
but theese inffiles arent redone from registry
for example touch driver is missing

imbushuo said:
- Download a Lumia 2520 recovery image for some files (I will post these files later)
Click to expand...
Click to collapse
Use at your own risk!
Some Lumia 2520 Firmware And Driver Update ‎10. ‎6. ‎2014:
Code:
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20623735_d3143757b17f94d00f53dc6f3f4dbdf48c36430e.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624060_4b5dec4829bf5e013bf5e6c045a4ed9367afe88d.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624064_70ea6951b8f7c7d72963c38e302356f46642ec85.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20624552_3c10b74a53f010a90539ea1e606f562d65a03082.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/03/20626644_7f0f6945d5e0e19e78b3794490990145b98e2c0c.cab
http://au.ds.download.windowsupdate.com/d/msdownload/update/driver/drvs/2014/04/20639225_555ea122b93d34720513db1b344254a0a69a158c.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20639552_08956ac77c46334650fc675794d58325f279ddbb.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20640693_4d4f789e1349e350324fb7e31b60514ae191cb46.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20642401_1278d3d9f4ae8d1903ec0c6f0861ec9912139b96.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643591_beca8afddf93a8679f6e875f5abfc44f9395975a.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643598_4a154479fe2ad83eef04c99e96e44b0e88efce8e.cab
http://au.ds.download.windowsupdate.com/c/msdownload/update/driver/drvs/2014/04/20643814_2d9a86009238af018f92aa76a9be453ef9231424.cab

Related

How To Download CE 6 OS design

Hi
I want to transfer my own windows ce 6.0 os design to a htc prophet ?
Is it possible?
I found a nk.bin file in os release dir. is it the same as nk.nbf or it needs something to be added to it like ipl/spl?
No.
Let me just verify that I understand you correctly:
You have Platform Builder for Windows CE (not Mobile) 6 and you compiled and OS.
Now you want to put it on your Prophet?
Here is why this can not work:
a) You do not have the hardware drivers. Even if by some miracle you got the Prophet BSP (board support package) from HTC, because CE 6 architecture is so different from CE 5 on which the BSP is based you would have to rewrite them.
b) The nk.bin Platform Builder produces is in plain binary format. The nk.nbf which the Prophet bootloader can recognize is in HTC's special encrypted format so the bootloader will not read the bin.
Yes. You get it right. I know if I want to use phone features completely I need BSP. But what if I want just use some standard features? just LCD and phone features.
Also I saw nbftool that decrypt and encrypt nbf files. Can I use it to encrypt files for prophet?
You need BSP for everything, not just "full features". Every little bit of hardware that connects to the CPU requires a driver unique for your device, that includes the screen, the digitizer (touch screen), hardware keys, USB port, SD card, etc.
This is why the Linux project for these devices hasn't moved beyond booting the kernel.
There are tons of work to be done (not to say it is impossible).
I am not sure about the nbftool but even if you manage to create an image that boots best case scenario is you will see something on the screen.
But you will have no way of controlling the device - no touch screen or keys, and no way to connect to it from windows since you do not have USB drivers.
Then what are the BSPs which exist in Wince by default. There is a ARMv4. How can I use it? Can you help me?
There is ARMv4 and there is Samsung, TI, Xscale, etc. Unlike x86 - all are different. Different memory map, different GPIO, different periferials.
Better waste your time on something else. Anyway CE 6 does not have phone features at all. Compile it for your PC and see that yourself.
mamaich said:
There is ARMv4 and there is Samsung, TI, Xscale, etc. Unlike x86 - all are different. Different memory map, different GPIO, different periferials.
Better waste your time on something else. Anyway CE 6 does not have phone features at all. Compile it for your PC and see that yourself.
Click to expand...
Click to collapse
I think ARMv4 BSP in Platform Builder already have enough driver for this type of CPUs. And HTC phones are ARMv4. So normaly I should be able to build and transfer my OS to there. CE 6 have buitin drivers for modem,LCD and so on. But there is no phone. Because phone is an app that runs on CE. So if I just want to use devices like modem It is enough. The problem is nbf files ae encrypted and os.bin file should encrypt to os.nb and then transfer to device.
shariat said:
I think ARMv4 BSP in Platform Builder already have enough driver for this type of CPUs. And HTC phones are ARMv4. So normaly I should be able to build and transfer my OS to there. CE 6 have buitin drivers for modem,LCD and so on. But there is no phone. Because phone is an app that runs on CE. So if I just want to use devices like modem It is enough. The problem is nbf files ae encrypted and os.bin file should encrypt to os.nb and then transfer to device.
Click to expand...
Click to collapse
you dont really understand the problem.
ARMv4 is not a cpu, it is the ARM version 4 instruction set ....
afaik your phone has some kind of OMAP.
i don't know if CE6 has a BSP for that, but even if it does, it will still not work without modifications.
a recent example. a friend of mine wanted to download a generix xscale 25x eboot (bootloader) to a device that had xscale 255. he almost killed the whole device because the RAM memory map of this generic eboot managed to overlap with the device's original bootloader memory space in ROM. (the virtual memory mapping differed in such an unlucky way.) and so the device's own bootloader thought it had to flash it in instead of loading it into RAM and it overwrote part of itself. luckily only the splashscreen got damaged...
(and of course the device would not boot this eboot.)
that's what happens when someone who has not ever dealt with hardware and memory mappings (i.e. you) tries to play with platform builder and flashing.
also, what is this about CE6 having built in drivers for the modem (you mean GPRS?) and LCD. it doesn't have the correct ones for your device.
and, the phone is more than just an app, it also needs drivers. the modem needs it too.
all in all...i strongly discourage you trying to flash that nk.bin.
it is not even in a format that your bootloader will understand, it is MS BIN format. the nk.nb0 in same release dir (or if there is none then cvrtbin will convert it) will be the raw format that needs to be encoded for nbf, but that is far from enough because it will never boot anyway. so forget this info.
cmonex said:
you dont really understand the problem.
ARMv4 is not a cpu, it is the ARM version 4 instruction set ....
afaik your phone has some kind of OMAP.
i don't know if CE6 has a BSP for that, but even if it does, it will still not work without modifications.
Click to expand...
Click to collapse
But at least the way of using loader is possible. Like how Linux is loaded
shariat said:
But at least the way of using loader is possible. Like how Linux is loaded
Click to expand...
Click to collapse
loader, for what purpose?
cmonex said:
loader, for what purpose?
Click to expand...
Click to collapse
For running WinCE , like Linux. Am i right? Linux devs uses Loader to load Linux on Mobile devices. I think I am confused. Help me on this. My purpose is to use my own OS design.
shariat said:
For running WinCE , like Linux. Am i right? Linux devs uses Loader to load Linux on Mobile devices. I think I am confused. Help me on this. My purpose is to use my own OS design.
Click to expand...
Click to collapse
well, for linux, the drivers have to be written too. (most of the time there are existing ones with source available that can be modified, though.)
so it is more complicated than that.
shariat: writing your own OS for this hardware is not impossible, but is not easy.
I suggest you go away for a while and get hold of platform builder and an arm reference guide and read everything you can about the device, the memory structure, your dedicated hardware structure, and then start writing.
Knowing how the hardware and CPU operate is fundamental to the OS you will write. Platform Builder will give you some source code access and help give you some ideas.
This is a nearly impossible task for a hobbyist coder. I'm sure people will help you, but you need to discuss what you have in mind.
Have a look here for some other easier ideas:
http://simpleos.iroot.ca/index.php
V

Changing OS identification?

Is there a way to change the windows nt into windows 7?
I mean, when you try to install anything that requires a specific OS name, it wont install on Windows 8 because its names Windows NT.
So question is, is there a way to turn Windows NT into Windows 7? like by regedit?
I was having the same problem with Motorola Drivers not being valid and/or Windows8 not being recognized as a valid os? So I had go back and reinstall Windows 7???
Sent from my DROID RAZR using xda premium
use compatability mode, right click the .exe file and click "Troubleshoot Compatability" then click "Troubleshoot" then "This program worked in earlier versions of Windows" then select Windows 7
I had to browse the temporary files folder while the Motorola Driver installer was open so I could pull the files out and run the Installer in Compatibility mode, other than that, it worked fine.
They are all Windows NT, its the version that differs, drivers are dead easy to change, software is harder, if compatibility mode doesn't fix it then you could hope that there are some ini files you can edit but that's unlikely nowadays.
Drivers just need a entry in the INF that says its a supported OS then further down the INF add a new entry pointing that new OS version to the same files as Win 7. With out an example its kind of hard to show you and it can vary between drivers but its easy enough.
whether it works or not is a different matter, a new OS version may have changed things the driver needs so caution is always recommended

[Q] How do I go back to windows7?

I upgraded my asus laptop to windows 8, and the d drive that had a stock backup of windows 7 got wiped somewhow..... so I really want to go back to windows7. I dont have a disc but i do have the windows 7 product key on my laptop... I cant dual boot, i cant connect phones to qpst... my work for school cant be done on windows 8..... I NEED windows 7 back... how can i do this?
A) Given that Win8 is compatible with all software and damn near all drivers that Win7 was (a few legacy driver models, like the ability to use XP video drivers, were deprecated), I doubt you actually can't use Win8 instead.*
B) You need Windows installation media to install Windows. I would hope this would be self-explanatory. It usually comes on a DVD (in a "box", or with your PC) or in a DVD image (giant .ISO file). However, your PC may have a "recovery volume" (a reserved chunk of the hard drive) containing the install image.
* You may need to do one or both of the following to get legacy software to work:
1) Enable the legacy .NET framework versions. Start -> type "features" -> look under Settings -> Turn Windows features on or off -> .NET Framework 3.5.
1.1) If you need .NET 1.1, you'll have to download and install that separately, I think, although at this point that version is like 10 years old.
2) Run programs in Compatibility Mode. For programs designed to run under XP, this includes running them as Admin. Right-click the program (in Windows Explorer; you can get there by right-clicking the tile in Start and selecting Open File Location), go to Properties -> Compatibility. Choose the compatibility option(s) most suitable to your needs.
.net frameworks checked....
Sent from an Apple killing JellyBean
If it's a driver issue you're having, which it most likely is because most driver install tools aren't ready for Win8 yet, you'll need to extract the relevant driver from the executable (or find one extracted online somewhere) and install it using the windows device manager.
If you can't find a solution to the problem, burn the relevant Win7 ISO file to your license key, and reinstall Windows 7 from that until devices become more compatible.
Kyoraki said:
If it's a driver issue you're having, which it most likely is because most driver install tools aren't ready for Win8 yet, you'll need to extract the relevant driver from the executable (or find one extracted online somewhere) and install it using the windows device manager.
If you can't find a solution to the problem, burn the relevant Win7 ISO file to your license key, and reinstall Windows 7 from that until devices become more compatible.
Click to expand...
Click to collapse
Thats the route im going...
Sent from an Apple killing JellyBean
Then im going to try to partition hdd so i can also install an ubuntu iso
Sent from an Apple killing JellyBean
Could be he's. Used to win 7 ,doesn't want to relearn 8 doesnt want to re install drivers and still nothing works, I'm not harping against 8. ,just think its really not. A desktop OS,works great as a phone and a tablet,useless as a desktop
Sent from my SAMSUNG-SGH-I717 using xda app-developers app
I got everything situated... Windows 8 is just better with a touch screen and i miss my windows 7 themes and stuff. Now only way to boot windows is thru bios boot override... Or else grub only lets me boot ubuntu.... A little annoying but tolerable
Sent from an Apple killing JellyBean
You can download one of these upgrade isos from Digital River/Microsoft and then install using your key. Make sure you download the appropriate version Pro, Home, etc, it should say next to your key what it is and chances are your computer can run x64 unless its a netbook.
http://www.mydigitallife.info/official-windows-7-sp1-iso-from-digital-river/
I've used these isos with OEM Windows 7 keys and it activates just fine and is perfectly legal since its your licensed key and the ISOs I linked to are unmodified from Microsoft and require a key to work.
Yep. Got an iso on a disc and installed then had to install all the drivers
Sent from an Apple killing JellyBean

[Partial] Hacking myford touch, were getting closer!!!

Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
UPDATE: 04/19/2015 -
While it is not a software hack, IT IS possible to unlock the navigation only portion of the MFT 8", if you have it without nav.
IF YOU DO THIS, YOUR CAR WARRANTY IS VOID. You've been warned.
It will cost a little money, but not set you back $1000 like nav tv and lockpick are charging. Maybe $100 or so.
Here is what you need to do, if you can't wait for us to unlock the bootloader.....
1 - Get a used APIM only part with the numbers DS7T in it. (aluminum only part with the fins, you DO NOT need the screen)
2 - Get the VIN# of the car it came out of and check the VIN to see if it was enabled with factory NAV. There are internet sites that will check the VIN for you. Must be a unit with NAV enabled.
http://researchmaniacs.com/VIN-Number-Lookup/WindowSticker/Ford.html
3. Install the APIM only to the back of your LCD.
4. The system will reboot and reset.
5. The system will them ask you to insert the NAV sd card, do that. (obviously, you have to buy a nav card from ebay as well, but those are $10)
6. Enjoy factory NAV for about $100
This is the only workaround for now. THE APIM is separate from the sync system and only interfaces with it. So, you will retain all your OEM VIN# locked stuff and it will survive reboots and updates. The nac actually just unlocks on that APIM portion, believe it or not. This method doesn't tie into the file system software, it merely accesses it.
Now.... if someone would be so kind as to just rip the NAND chip from one of those units and post it, so that we can just flash over our existing equipment, we can do this for FREE!!!!!!
Still working on the video bypass.... It would be nice if our Russian friends can start chiming in for that one please.....
DON"T FALL FOR THE EBAY GUY CHARGING $600 to $700 for this. Let's put him out of business.... Your help is needed.
PROPS TO rahrena8690 for the find.
WORKING FILE LINKS - FOR DEVELOPERS ONLY
Delayed Reboot project
https://mega.co.nz/#!m0BEWSrA!qrdgIRYTvccH52794ktdpRfrulI_pSdY3g-iiCyhaFs
awesome work
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
I have been wanting to get into this system since the day I got my truck. All ford has succeeded in doing is piss me off with "updates" that didn't amount to much. I would be happy if they would at least allow applink on the touch systems, as that would at least give us some options to add our own work.
I would love to help, but don't have much experience with "rooting", Windows CE, etc. But looking at what you have so far, I will offer some thoughts that came to mind:
It seems to me that you are working at the bootloader level, not the OS level. I may be way off here, but this could be why cmd won't work, as the OS is not loaded, so a traditional shell is not yet possible.
If you are indeed at the OS level, I wonder since you didn't get any errors when trying to launch cmd, if it was indeed actually running. I know on windows systems, if you manage to launch a process as "system", you typically can't interact with it (security issue). I don't know CE at all, but wonder if PsExec would work if it is launching your exe, but as system...
If it is executing your exe as system, perhaps a script or small app that writes some info about the system to a file on the usb drive would help. IE, have it list the folder structure for example.
I know we are not alone on people wanting to work on this. It looks to me that with Sync 3 dumping MSFT, we may be left in the dust with no further updates, although, this guy has found some signs that it might still get some useful updates:
http://www.reddit.com/r/Ford/comments/2rf2cc/ford_may_announce_updates_to_sync_gen2_myford/
Thanks
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
Thanks Pro. any new updates. Actually i just purchase Lincoln MKZ 2014, although i know it is hardware capable to run navigation since i get latitude and longitude, but unfortunately no navigation from the factory. i just play with My Lincoln Touch and on the sittings there is a tab for installing apps. so can we install and windows CE app?
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
kthejoker20 said:
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
Click to expand...
Click to collapse
i don't think so. we will not get the QNX update. I think it is a different system with different architecture and requirements. but i hope they unlock the FMT or LMT so we can install any windows ce app.
Please don't reply to this thread with comments or requests.
I'd like to keep it clean to only development comments.
Based on what I'm reading around the page 26 mark (bootloaders section of the windows embedded 7 pdf), it sounds like we need to attempt to give the IPL boot arguments to get into update or development mode and from there we could have a chance of pushing our own files. I would think update mode looks for a signature but dev mode might let anything in.
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
kthejoker20 said:
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
Click to expand...
Click to collapse
So you were able to launch a command prompt via the delayed reboot zip? I wonder if it would be possible to hack a sync update and then use this to push it.
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
kthejoker20 said:
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
Click to expand...
Click to collapse
This the latest myford touch update Gen2-V3.7.11
http://www.mediafire.com/?79v3d0d8972sy44
Here is the Delayed Reboot zip
http://outofmytouch.com/assets/delayed_reboot.zip
So some very quick looking tonight and I found EA5T-14D546-ATD contains the master patch. Decompiling some of the shockwave files I have found some interesting code. These would most likely be the files to hack to change factory behavior. Getting them flashed to a vehicle might be a whole other issue though.
Edit: After more browsing I think we need to target a master patch for an older version of Sync. I was looking at the master patch for the most current so there are going to be less files patched. I will have a peek at those later.
For some reason, the coalfire site took down it's information regarding the reverse shell of the infotainment system.
Here is what I am talking about with the command on the delayed reboot file. I have conveniently located the stacked command image and attached it for your viewing pleasure.
If we can patch the files, this is how we push them to the chip. Otherwise, I may have to PHYSICALLY pull the system files through JTAG tap... sigh... not really wanting to do that though...
If we can push them, we would have to unlock the bootloader to bypass the sigs... This is where my brain is staring to hurt....
Obviously, these commands do not apply to what we are doing, as that is QNX. Plus, I don't want any noobs spunking their system with our fashizzle yet...until we test it.
Just a final thought, as a plan B, we could reverse shell with the USB exploit as well... just saying.. might be easier
An integer overflow might work as well, but I have never experiemented on an embedded chip. Stacked command invoking an integer overflow, might give us write access to the system.
Has any thought gone into rewriting one of the dll's included in the latest patch to include some sort of backdoor? It seems it'd be easy (maybe I'm missing something here) to just modify the latest patch's install files to install our new dll.
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
kthejoker20 said:
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
Click to expand...
Click to collapse
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
Click to expand...
Click to collapse
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Looking forward to following the progress of this thread! I hope that you all will discover a new solution to our these outdated systems! Good luck guys, I am rooting for you!
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Click to expand...
Click to collapse
Actually I am pretty sure the MyFord Touch processor is an I.MX51 acccording to a Ford PDF I found. Unfortunately I am new to posting here and it won't let me post links.
I work on the almost identical I.MX53 processor at work doing Linux kernel, u-boot boot loader, and Linux application software, so I might be able to help.
Most of the I.MX processors have built in ROM code that allows booting to a USB or Serial downloaded mode. This allows loading any software you want into any RAM address and then booting from it. Then you run completely out of RAM (like a live CD). Depending on how Ford setup the I.MX51 e-fuse settings, there may be an external pin that could be used to enter this serial downloaded mode. Freescale provides a tool called the MfgTool to load software using the serial download mode. Then you could load Linux, Android, or whatever. The e-fuses also allow you to lock out JTAG, serial downloaded mode, and enable boot time signature checking, but I am not sure if Ford used any of these to lock the system down.
Do we know where the processor is located in the fusion?

nuvision windows tablet tm800w610l

hi i have a nuvision windows tablet tm800w610l,couple days ago when windows updates installing blue error screen come and i think say(ssd error) after that windows not booted say(bcd error),so i downloaded windows frimware from website and put in bootable flash and connect with otg to tablet(via simple hub for flash and keyboard)now i have a problem with installing new windows,i think usb speed is very very slow,it cant boot windows for installing(take 20-30 minuts just on the windows install loading screen)after that black screen and nothing happening,im tested other bootable iso files but speed is very very slow i cant do any thing.im searched net some people think its on bios setting,some think usb hub is problem(before that i have a another windows tablet and installed windows via same hub)
so i dont know where is the problem,in bios there is very very settings i dont know which setting must changed.
thanks.
had to reload mine from scratch worked fine with a OTG hub, keyboard , mouse and flash drive .
Got touch working?
image
where did you get the image from?
the one on the nuvision website is corrupt.
I tried new and old versions of winrar and it has checksum errors
same with the drivers. what the f***. tried googleing filenames etc and get almost no results.
djmdesign said:
where did you get the image from?
the one on the nuvision website is corrupt.
I tried new and old versions of winrar and it has checksum errors
same with the drivers. what the f***. tried googleing filenames etc and get almost no results.
Click to expand...
Click to collapse
Just an FYI, the version that’s currently on the Nuvision website works.
It’s not an iso, at least it doesn’t download as one. I took that file and created an iso and used a usb bootable maker to create the usb drive.
It recognized it upon restarting in advanced mode. The installer is in another language but it got me up and running again.
Just wanted to put this out there.
You can use the NuVision image if you wish (You just extract the RAR to your USB drive and then boot it in your tablet), or you can create installation media using the Windows Media Creation tool (or UUPtoISO if you want to use Insider Preview downloads from another machine).
As long as you use the correct processor architecture, you don't need the NuVision restore package (It's also out of date and no longer supported by Microsoft as it's version 1511, or maybe it was 1603 either way it's unsupported as of now). Some drivers maybe, but a lot of those are available via WU (I've never had to actually install any drivers doing a clean install from a Windows ISO).
This also applies to the NuVision TM800W560L, any 32-bit image will boot and work properly for installing Windows. If you look into installing 64-bit Linux on the W560L though, it's a little more complicated (yes, you can install 64-bit Linux, but not Windows. This is because the Linux kernel can replace UEFI Runtime Services if it needs to, which booting a 64-bit Kernel with a 32-bit version of GRUB causes UEFI to disable access to Runtime Services, which is why Windows cannot run like this and bugchecks with UNSUPPORTED_PROCESSOR.)

Categories

Resources