Comments on symbaali: Goodbye S60 Platform Security, Hello CAPABILITIES!...

dpsingh: No, this firmware modification does not w...

2008-02-14T00:32:00.000-08:00

dpsingh: No, this firmware modification does not work on the N95. The phone looks to be using several checksums and quite probably a signature of some kind. After uploading the firmware the handset promptly dies and needs to be flashed back to life using a box like JAF.

There are a few people working on it, but it's slow going.

i have n95 v 20.0.015, i just opened RM-159_20.0.0...

2008-01-15T12:00:00.000-08:00

i have n95 v 20.0.015, i just opened RM-159_20.0.015_PR.cor with winhex. After searching in offset 0425F860, if i edit "allowunsigned=true"
.................." will it install unsigned apps or not?

Anyone tested this on N95 firmware 20.0.015? It wo...

2007-11-26T15:16:00.000-08:00

Anyone tested this on N95 firmware 20.0.015? It would be interesting to know if they've fixed this wonderful loophole or if we can continue to have DRM-free phones..

Is it possible to edit the swipolicy.ini on the ph...

2007-11-08T18:07:00.000-08:00

Is it possible to edit the swipolicy.ini on the phone after tweaking the firmware and giving the right capabilities to a file system app like fexpolorer?

Thanks 'blankname' - all sorted now. Just as an as...

2007-11-08T16:14:00.000-08:00

Thanks 'blankname' - all sorted now. Just as an aside, "UserCapabilities = All" does not work for me (N80), have to use the long list instead.

"Nobody Special", read my comment on the NSU fixed...

2007-11-08T06:53:00.000-08:00

"Nobody Special", read my comment on the NSU fixed post, I have written a very short tutorial to do it.

to my earlier post, i forgot to give the offset in...

2007-11-06T04:41:00.000-08:00

to my earlier post, i forgot to give the offset in the swipolicy.ini file.
so for E65 offset is 31343976 file size 536 bytes

corrige errata: should be space-padded and not zero.

Doesn't work with the N80 - NSU just downloads the...

2007-11-06T04:01:00.000-08:00

Doesn't work with the N80 - NSU just downloads the files again and overwrites the modified firmware.

How are you people actually doing this?

I'm running NSU through once, browse for the firmware file and hit it with a hex editor to replace UserCababilities with the ones that are suggested, follwoing this I run NSU again, check swipolicy.ini and find that my changes didn't hold.

It worked on E65hier my ini file:AllowUnsigned = t...

2007-11-05T14:16:00.000-08:00

It worked on E65
hier my ini file:

AllowUnsigned = true
MandatePolicies = false
MandateCodeSigningExtension = false
Oid = 1.2.3.4.5.6
Oid = 2.3.4.5.6.7
OcspMandatory = false
OcspEnabled = true
AllowGrantUserCapabilities = true
AllowOrphanedOverwrite = true
UserCapabilities = NetworkServices LocalServices ReadUserData WriteUserData UserEnvironment MultiMediaDD NetworkControl CommDD ReadDeviceData WriteDeviceData
SISCompatibleIfNoTargetDevices = false
AllowRunOnInstallUninstall = true
AllowPackagePropagate = true
DeletePreinstalledFilesOnUninstall = true

"Had a bit of problem modifying swipolicy.ini correctly, got file corrupt error messages from installer. After couple tries got it working."

Me too, i noticed that if I pad the file with 0s at the end, i get the "file corrupt" message if I try to install apps.
so this configuration is exactly 536 bytes.
cheers

I just did it with my N76.Offset is 34566196 for R...

2007-10-31T05:04:00.000-07:00

I just did it with my N76.
Offset is 34566196 for RM135_30.0.015.
Please add conv=notrunc to the dd insert command. Otherwise your resulting firmware image may be (will be?) corrupted.
Not tried to install something so far, but everything went smoothly.

Will be interesting to see if a similar procedure works on my P1i as well...

Confirmed on E61 (3.0633.09.04 20-11-06 rm-89).Add...

2007-10-30T10:34:00.000-07:00

Confirmed on E61 (3.0633.09.04 20-11-06 rm-89).

Added AllFiles capability to Y-browser. Everything works smoothly.

Had a bit of problem modifying swipolicy.ini correctly, got file corrupt error messages from installer. After couple tries got it working.

Ok, I'll try it. Can you say if my modification of...

2007-10-29T10:38:00.000-07:00

Ok, I'll try it. Can you say if my modification of SWIPOLICY.INI is good? (some posts up)
I deleted some capabilities because I haven't enought space. It is possible to delete any other default sentence to set these capabilities too?

Thanks, sorry for my english.

I don't know about ActiveFile, never used that, bu...

2007-10-29T09:08:00.000-07:00

I don't know about ActiveFile, never used that, but I suppose it's from the signed UID range if it also comes as a signed version.

For selfsigning to work, you need to use UIDs from unprotected range, just like Y-Browser does.

I did it on a N80, this was the original fileAllow...

2007-10-29T07:35:00.000-07:00

I did it on a N80, this was the original file

AllowUnsigned = false
MandatePolicies = false
MandateCodeSigningExtension = false
Oid = 1.2.3.4.5.6
Oid = 2.3.4.5.6.7
DRMEnabled = true
DRMIntent = 3
OcspMandatory = false
OcspEnabled = true
AllowGrantUserCapabilities = true
AllowOrphanedOverwrite = true
UserCapabilities = NetworkServices LocalServices ReadUserData WriteUserData UserEnvironment
AllowPackagePropagate = true
SISCompatibleIfNoTargetDevices = false
RunWaitTimeoutSeconds = 600
AllowRunOnInstallUninstall = false
DeletePreinstalledFilesOnUninstall = true

i replaced it with this

AllowUnsigned = false
MandatePolicies = false
MandateCodeSigningExtension = false
Oid = 1.2.3.4.5.6
Oid = 2.3.4.5.6.7
OcspMandatory = false
OcspEnabled = true
AllowGrantUserCapabilities = true
UserCapabilities = AllFiles DiskAdmin NetworkServices LocalServices ReadUserData WriteUserData ReadDeviceData WriteDeviceData PowerMgmt TrustedUI ProtServ SwEvent Location SurroundingsDD
AllowPackagePropagate = true
SISCompatibleIfNoTargetDevices = false
RunWaitTimeoutSeconds = 600
DeletePreinstalledFilesOnUninstall = true

I downloaded Activefile 1.25, the allfiles unsigned version, and I signed it with a cert from makekeys.exe, and it said "application access not allowed". What have I done bad?

Thanks

marco, I'm as surprised as you are."UserCapabiliti...

2007-10-29T01:12:00.000-07:00

marco, I'm as surprised as you are.

"UserCapabilities = All" doesn't work, I guess the installer doesnt know what that "All" means :)

Here's a swipolicy.ini related document:http://www...

2007-10-28T14:17:00.000-07:00

Here's a swipolicy.ini related document:
http://www.symbian.com/developer/techlib/v9.2docs/doc_source/ToolsAndUtilities/Installing-ref/swipolicy.html#Installing%2dref%2eswipolicy%2eini%2dsyntaxsyntax

self-sign means with a self cert!! a cert created ...

2007-10-28T06:50:00.000-07:00

self-sign means with a self cert!! a cert created without any particoular capability....as the one used for sign themes ;)

btw someone following this tutorial now can access in system folders of his n73... :P

http://www.quellicheilcell.it/index.php?s=&showtopic=19040&view=findpost&p=206387

so it works....!!

Ps. i've traslated your post...u are the best ;)
http://www.quellicheilcell.it/index.php?showtopic=19040

Hello, when you say self-sign the sis file, it is ...

2007-10-28T05:48:00.000-07:00

Hello, when you say self-sign the sis file, it is with a devcert of what?

Very good work.

Hello manko, I'm surprised, afaik, the firmware co...

2007-10-28T03:44:00.000-07:00

Hello manko,
I'm surprised, afaik, the firmware content is certified and the device should detect modified firmware.
It would be usefull to know which models will accept the modified firmware.

Anyway, you can simply use
UserCapabilities = All
to include the full capability-set.

This is awesome!Great work, I had the idea myself ...

2007-10-27T20:03:00.000-07:00

This is awesome!

Great work, I had the idea myself to look through the nokia firmware image to enable AllFiles but I had no idea how to actually do it.

Could anyone verify if this works on an N95? There's already been two guys post with bricked phones so I'm not that keen to try it yet. Maybe there is a CRC but only on N-series phones?

Well, as I mentioned it's not totally safe operati...

2007-10-26T12:51:00.000-07:00

Well, as I mentioned it's not totally safe operation. Supposedly some firmwares have extra checks for validity. I'll post more details later on.

So if the result is an expensive flashlight, there needs to be some other modification to the runtime checks as well.

Dead phones can be reflashed in Nokia service points, tell them that the NSU failed :-)

I found a following code in my 'rm43_v2.20.008.cor...

2007-10-24T06:37:00.000-07:00

I found a following code in my 'rm43_v2.20.008.core':

AllowUnsigned = false..MandatePolicies = false..MandateCodeSigningExtension = false..Oid = 1.2.3.4.5.6..Oid = 2.3.4.5.6.7..DRMEnabled = true..DRMIntent = 3..OcspMandatory = false..OcspEnabled = true..AllowGrantUserCapabilities = true..AllowOrphanedOverwrite = true..UserCapabilities = NetworkServices LocalServices ReadUserData WriteUserData UserEnvironment ..AllowPackagePropagate = true..SISCompatibleIfNoTargetDevices = false..RunWaitTimeoutSeconds = 600..AllowRunOnInstallUninstall = false..DeletePreinstalledFilesOnUninstall = true..

and changed it with (Size is the same)

AllowUnsigned = false..MandatePolicies = false..MandateCodeSigningExtension = false..Oid = 1.2.3.4.5.6..Oid = 2.3.4.5.6.7..OcspMandatory = false..OcspEnabled = true..AllowGrantUserCapabilities = true..UserCapabilities = AllFiles DiskAdmin NetworkServices LocalServices ReadUserData WriteUserData ReadDeviceData WriteDeviceData UserEnvironment PowerMgmt MultimediaDD TrustedUI ProtServ NetworkControl SwEvent Location SurroundingsDD CommDD..SISCompatibleIfNoTargetDevices = false..DeletePreinstalledFilesOnUninstall = true.. ..

During the flashing with NSU there was a sound of plugging out/in the USB device, and flashing stopped.
NSU said to check the connection, and finally, the N91 is dead.
What I did wrong?
PS: Trying to flash my dead phone :(