147 réponses à ce sujet

[garabed02]

Salut VIKING37

Merci beaucoups pour ta réponse. J'avai déja vu ces topics, mais j'avai peur de laisser mon IMEI. Je vien d'envoyer mes informations à http://s60.vgooo.com:801/ . Je suis en attente de leur réponse. Je laisserai des nouvelles si c'est Ok.

Encore merci

[sraidj]

[Edité par VIKING37 : Citation inutile supprimée. Merci de ne pas citer le message qui vous précède directement[/CI]]

opda est plus interressant et en plus ils ont été plus rapide que vgooo

Modifié par VIKING37, 29 Jan 2009 - 15:40.

[kevded]

testées avec succès uniquement sur ces firmwares :

New Hack Method For Unhackable Firmware Tested on n958gb v31, E51 v300.34.56, Nokia E71 v200.21.118, Nokia N82 v31.0.016, Nokia N95 v31.0.017 and Nokia N96.

parait que sa été testé sur ces téléphones la

TESTED ON N95 / 8GB / N82 LATEST FIRMWARE / ****N96 / 5800 Express Music 50% ONLY.*****
U have to use old method of 20years certificate and "Resource / swicertstore / dat / 00000001. method for ****N96 / 5800 Express Music**** and use sis sign and sign the software and then install it on N96 / 5800.

TESTED ON
N95 / 8GB
N95
5800
82
85 N85???
79
5320

ici

a une certaines étape
c) Copy inside E:Hacksysbin installserver.exe related to her own Phone faudrait avoir installserver.exe pour FP2 la non?

hummmm faut renomé le fichié en installserver.exe


bon je test sur mon N85
[Edité par VIKING37 : Messages combinés[/MC]]
salut!

j'ai pas reussi.

Modifié par VIKING37, 29 Jan 2009 - 17:32.

[guibs49]

bonjour a tous,

quelqu'un du forum a t il deja reussi sur un n95 ?

Merci

[sil20]

bon bah tout ça me fait penser à la nana qui t'allume et tourne du cul au loin... et que tu nique jamais !!!!


a quand le retour à la V 30 !!!!

[kevded]

j'ai reussi a instalé le fichié "MapDrive-3_EMU_Y_By_DeltaFoX.SISX" ainsi que le fichié "MapDrive-3_EMU_H_By_DeltaFoX.SISX"
Bonne nouvelle non? sa ma crée un disque virtuel ave dedans sys/bin/instalserver sallait mon tell est hacké!!!
mais maintenant quand je veux démaré une instalation il me dit fichié corrompu donc j'ai suprimé le installserver mais le disk virtuel est toujours la
Enfaite le problème c'est que installserver n'est pas encor pret pour FP2


8. If you succeed then you should have one more drive that only contain :sys\bin\installserver.exe.
THIS MEAN YOU HAVE HACK YOUR PHONE.

c'est exactement ce que j'ai donc mon phone est hacké non?

je comprend:
Enfaite le dernié fichié j'ai pas reussi a l'instalé c'est le fichié modo.sis qui va permetre de copier le install server dans C cet-a-dire la mémoire du mobile.
mais avant d'installé se fichié faut ke le tell soit déja hacké donc grace a:
MapDrive-3_EMU_H_By_DeltaFoX.SISX
MapDrive-3_EMU_Y_By_DeltaFoX.SISX
qui vont crée des disk virtuel pour mettre en place "sys/bin" et a partir de ce moment le tell est déja hacké.
c'est donc ce que j'ai reussi a faire mes avec des fichié spéciale qui se trouve ici "Firmware_vs_cert_conflict.rar" ;
ces deux fichié ont été modifié avec les certificat des devellopeur d'OPDA ,mais il reste tout de même a les signé.
M'enfin c'est se que j'ai compris..
j'ai sauté beaucoup d'étape comme cel si:
"a. With JBAK TASKMAN
Add MAP DRIVE 3 EMU to the Auto Start by selecting the JBAK TASKMAN from phone menu find
MapDrive -> Option -> Program Rule -> Auto Start."

et puis j'ose pas instalé
MapDrive-3_EMU_Y_By_DeltaFoX.SISX
de peur qu'il ne me fasse comme l'autre fichié "impossible d'installé quoi que se soit car le phone di ke le fichié est corrompu" (vous inquiété pas j'ai réglé le problème en suprimant le fichié instalserver.exe" je peut a nouveau instalé des apps sur mon N85 )

En Bref j'attend quelque chose de concrès pour nos cher FP2

allé je vais me couché j'en est *****é dit

Modifié par kevded, 31 Jan 2009 - 04:51.

[WillyTheBest]

Il est possible que tu n'aies tout simplement pas la bonne version de installserver.exe ! ce genre de message arrive quand on se trompe de fichier genre FP1 au lieu de FP2 !

[philou92]

merci kevded pour ton retour sur la hack du N85 , j'avoue que je n'ai pas tout compris dans ton explication enfin c'est peut etre moi qui ne capte bien , il se peut que le fichier "installserveur.exe" ne soit pas encore compatible pour les FP2 Symbian 9.3 (N85 , N96 , ect....)

[WillyTheBest]

Voici ce que j'ai trouvé pour les fichiers installserver.exe : http://www.megaupload.com/?d=RAKTVDHZ

[kevded]

mais justement installserver n'es pas encor dispo pour les fp2!!!
même dans l'archive que tu ma doné,il y a bien pour les 9.2 mais pas pour les 9.3

Modifié par kevded, 31 Jan 2009 - 11:19.

[sraidj]

il semblerais que le installserver.exe du 9.2 soit le même que le 9.3 ça reste à voir, je crois que ça n'a rien à voir avec le FP2 car le hack marche sur mon n82 v31 qui est passé en FP2 depuis les v30 si je me trompe pas

[WillyTheBest]

Pour les 9.3 j'ai trouvé autre chose sur un autre Forum ! je me permets de le poster ici on sait jamais ça peut aider ! :

GREAT NEWS FOR ALL s60v3 device users ... this is not my project it was all done by FCA00000 from sf and former modo in smo forum ... he deviced a way for users to access all the files on ur s60v3 phones like : n80 n73 etc.. including the sys folder and the private folder ... here it is in his own words ...


"""Good news: I managed to hack my Nokia-N80 using a software-only solution, and remove all permissions limitation.
I was able to browse c:\sys and private directories.
Now I need someone else to try.
So, if you have a Nokia with S60v3 , a connecting USB cable, and some time, please reply.
If you have CodeWarrior and MetroTRK up and running, much better.
Thanks


=========================================

Goodbye S60 Platform Security! Hack to override permissions?



As I have already said numerous times, there is no perfect protection, there are no perfect solutions and it is only a question of time when the 3rd Edition security will be hacked.

Actually it has been broken already by the firmware patching but it is the extremely dangerous procedure and also Nokia have fixed it by encoding that part of firmware with the latest updates.

I guess that everything about the "new" Symbian's platform security is very well known and already discussed numerous times here on SF, especially over at our forum section, so I’ll not repeat it again. This obnoxious concept was introduced by Nokia few years ago with its first S60 3 rd edition phone (N80) and it is based on the idea that nobody gets access to those data ca... ..

Read more: S60 3rd Ed platform security has been kacked - full story

Sincerely yours,
Teo"""

ps:this hack will only work for pre fp1 phones like [the n80 and the n73] and confirmed to be working only on n95 and 5700 and (n95-8gb by mr.papadocta) AND (the n82 by mr.nightshift).. still no news on other fp1 or fp2
pps: bigsmile.gif there are some issues on running this hack on vista so use xp for a sure result




here is what u need .. also a quote from mr.FCA00000 at SF forums ... i just wanted to share this great news with all ipmart users ...


First of all: you can get the needed files from

http://fca00000.goog...perms_s60v3.rar (i attached them here)

1) Current state:

In S60v3, Symbian implemented a security mechanism: applications need to be signed in order to access some services.
A developper can self-sign his own applications, but the most critical services need a powerful certificate, which not everyone can afford.
For example, you can not make a file browser able to access c:\sys . This is not very important, but some people feels that they should be able
to do anything they want.

2) The theory:

When a program is signed and you install it, its privileges are stored in a internal folder. When the program is executed and
tries to access a service, the privileges are checked. If they don't match, the service can not be executed, and gives an error.
In the PC emulator for Symbian, it is possible to overrride this, so that missing privileges give a warning, not an error.
This is controlled through a file called EPOC.INI that includes a line like
PlatSecEnforcement OFF
In the phone, this is not modifiable directly.
The routine controlling this is called
DProcess:: DoHasCapability(TCapability , char const)

In my Nokia N80, this is at F80478BC and says
....
F8047968 BL log_missing_capabilities (F80458D8)
....

Look at F80458D8:
....
F8045930 LDR R0, =pSuperPage
F8045934 LDR R0, [R0]
F8045938 LDR R0, [R0,#0x148]
F804593C TST R0, #2
F8045940 BEQ loc_F804597C
F8045944 ADR R1, aError
F8045948 MOV R0, R1
....


Basically, this looks at the data at [pSuperPage+0x148] and checks bit 2.
If it is set, any missing capability will give an error.
If not, it will log the problem, but the check will succeed.

So, all you need to do is to change this value.

In my mobile, pSuperPage has value 0x60000000, so the data is stored at 0x60000148

3) the hack:

The programming enviroment Carbide.c++ v1.2 includes a file called s60_3_0_app_trk_2_7.sisx
It also comes with CodeWarrior Pro for Symbian, although it is version S60_App_TRK_2_5.sisx
This file is a On-Device-Debugger, used to run programs inside the phone, and see the flow and data in the PC.
In my experience, CodeWarrior is easier to use for debugging.
It allows to look at the program registers, phone memory, processes, and change the data.
At memory address 0x60000148 the value stored is 0x0000001E , which means that
PlatSecEnforcement is ON
So, change it from 0x0000001E to 0x00000010 and you get all the permissions !

4) The tools:

You need a Nokia phone using Symbian 9 .
You also need some way to connect it to a PC, for example USB or bluetooth. Infrared is not valid.
Next step is the MetroTRK.
If you have CodeWarrior, it is the preferred solution. If not, I made a Python program to emulate it.
If you have IDA-disassembler a a ROM dump, then you can investigate in case it doesn't work.

5) The phone:

I have tested with Nokia-N80. I suppose it works with any phone using S60v3.
The changes I make are only in memory. This means that when the phone is switched-off, the hack dissapears.
You need to run it again after a restart. I know this is a limitation, but a permanent solution will come later.
On he other hand, this is good: there is (almost) no risk on permanently breaking your phone.
Of course, do it under your own risk. I take no responsability

6) The connection:

I use a USB cable labelled CA-42 which is a simple data cable; no fancy stuff.
Connect the phone to the PC.
The phone asks the mode you want to use: 'PC Suite'
My operating system is Windows-XP and my PC detects automatically the driver, installing
something called 'Nokia N80 USB modem'.
If not, drivers are available in many places, for example
http://www.nodevice....2/get37496.html
If you have PC-Suite, you probably have the driver already. But remember that you need to disable in the PC: stop the program.
At this point, you probably have a new serial port:
Control Panel->System->Hardware->Device Manager->Ports
should show
'Nokia N80 USB (COM6)'
It might happen that you have both COM6 and COM7 . You will need to try both.

7) The MetroTRK:

This is a debugger that installs in the phone. It has powerfull permissions and a strong certificate, which allows to read/write memory.
Transfer the file s60_3_0_app_trk_2_7.sisx into your mobile, and install it.
You should see a new application called 'TRK'.
Run it.
By default it tries to use BlueTooth, so it might give an error because no available ports.
Options->Settings->Connection=USB
Options->Settings->Port=1
Options->Settings->Baud Rate=115200
Options->Connect should tell:
Welcome to TRK for Symbian OS
Status: Connected
PDD: NONE
LDD: EUSBC
CSY: ECACM
Port Number: 1
Baud rate: 115200

This is the most difficult step.
If you get
'Failed to open port.Error Code: -21'
this means that your PC is not talking to the mobile. This is the case when the driver is not installed.

7.1) You need another program called HelloCarbide . It is a simple example. Install it in c:
You also need to transfer HelloCarbide.exe directly under c:\HelloCarbide.exe using any FileBrowser, ex: SExplorer

The hacker:
If you have CodeWarrior, go to 8.2 . If not, go to 8.1
8.1) I made a program called hack_perms_s60v3.py
It is written in pyhton, so you need Python25 from www.python.org
It uses the serial port, so you also need pyserial (http://sourceforge.n...ojects/pyserial)
and probably pywin32 (http://sourceforge.n...rojects/pywin32)
Download the binaries and execute them. As simple as that.

My program uses COM6 at line
ser = serial.Serial(5)
If you have another port, change this number. example: COM9= ser 8(so just see what ur com port # is and -1 is ur ser #) [see reply number 26 for tuto]

Run my program by typing
hack_perms_s60v3.py

It logs a lot of information. In case of problems, investigate. I _might_ try to help.

If you get
serial.serialutil.SerialException: could not open port: ... The system cannot find the file specified.
this means that the port doesn' exist.

If you get
serial.serialutil.SerialException: could not open port: ... The process cannot access the file because it is being used by another process.
this means that there is another program using the port. Most probably you are trying COM7 instead of COM6.

If it hangs after
sendFrame=00
sendFrame=FF
sendFrame=7E
this means that MetroTRK is not running in the mobile.

If everything goes OK, it takes 40 seconds and the last line are:
Close
End+Exit

Look at the trace: you should see 2 lines like:
Read Memory 60000148=1E 00 00 00
candidate!!!

This is good. It means that it found the correct address and patched it.

8.2) If you have CodeWarrior and know how to use it, it is better.
Load any program you have (HelloWorld.mmp is perfect) and start a mobile debugging session:
The target should be GCCE UDEB .
In its settings->Remote Debugging->Connection = Symbian Metro TRK
Same window->Edit Connection->Connection Type=Serial ; Port = COM6
Same window->Remote dowload path = c:\
settings->Remote Download-> Remove any file here
Remember that, because of security, applications can't be downloaded into c:\sys\bin , so they
need to be installed before. I do this manually.
See:
http://www.mobilenme...ent/view/41/26/
http://mikie.iki.fi/...33#comment-6299
http://www.newlc.com/topic-5398
http://discussion.fo...ead.php?t=72632
http://discussion.fo...ead.php?t=80807

Now, start debugging the program.
You should see the 'Metro TRK Communication Log' with lots of information.
Break the program.
Select the stack.
Menu->Data->View Memory . Ignore the error
Display 0x60000000
Look at 0x60000148. Probably has value 0x1E
Double-click, and type 0x10. Hit enter.
Run program.
Close Thread window. Resume.

9) Advanced: 9not for all users.. only hardcore people)

If you have IDA-disassembler and a ROM dump, you can see the actual code.
This is a heavy task, but the main file is ekern.exe
You can get a full Dump using this Symbian code:
RFs fileSession;
fileSession.Connect();

RFile file;
file.Replace(fileSession, _L("e:\\F8000000.bin"), EFileWrite);

TBuf8<0x200> buf;

TUint8 *p =(TUint8*)0xF8000000; // (TUint8*)0xF8000000;
TUint8 *pEnd = (TUint8*)0xFA000000; // (TUint8*)0xFA000000;
TUint8 iVal = 0;
for(;p < pEnd;p++)
{
iVal = *p;
buf.Append(iVal);

if(buf.Length() == buf.MaxLength())
{
file.Write(buf);
buf.Zero();
}
}

file.Close();
fileSession.Close();
And then extract files using ROMTools from Syminternals. If you can't get it, I can provide it.
To use IDA, get the Symbian SDK, and process through ROMTools . Name the routines and study the disassembled code.

10) Test:

Start any application which needs pivileges. I tried SExplorer and TrueExplorer, and I was able to
browse c:\sys , although:
10.1) SExplorer can not access Z:\sys

10.2) TrueExplorer can not find files under c:\sys\bin



It works in my Nokia-80, and I expect to work also in other models.

Did it work for you? Please post results."""

for fp1 devices(n95 etc .. u can try the fp1 attachment see if it works see reply #46 on page 2 for more details)
n82 users try the alternative trk instead....

Voilou

Un peu acrobatique comme méthode tout de même !

Modifié par WillyTheBest, 31 Jan 2009 - 15:16.

[Drastik]

car le hack marche sur mon n82 v31 qui est passé en FP2 depuis les v30 si je me trompe pas

Non c'est impossible, l'OS de ton N82 est et restera toujours le S60 3rd FP1, tu n'as fait que le mettre à jour par l'upgrade du firmware de celui-ci


Pour l'installserver.exe FP2, il semblerait qu'il n'existe pas encore d'après beaucoup de membres qui l'attendent aussi sur divers forums, tout comme l'accéléromètre pour le N96...


Il y aurait aussi un patch qui s'appelle "Open4All" pour certains firmwares récalcitrants... , mais désolé je n'ai pas de liste à poster... déjà que les précédentes n'ont pas l'air très fidèles à la réalité

[belzebuth*nicolas]

bonjour je n'arrive a pas a signe la première application si quelqu'un peu ke faire pour moi voila mon IMEI [Edité par VIKING37 : IMEI modéré]merci beaucoup

Modifié par VIKING37, 31 Jan 2009 - 19:28.

[youn]

enfinnnnnn réussi il fallait juste que je fasse un hard reset recommencé les étapes a zero et le tour est joué enfin un E71 hacké coolllll pouvoir m amusée enfin

[the-murderer]

impossible d'installer MapDrives v1.00 DiskAdmin Unsigned.sis étant signé quelqu'un aurais une solution?

[mancantgite]

slt,

deja si jai bien compri cette methode sert a installer des logiciels hacké c bien çà?

c bon c testé avec le n85?

[nightyman]

Salam tout le monde !

Je tenais à partager avec vous la méthode que j'ai suivi pour hacker mon Nokia

Pour le hack, j'ai mis mon N82 à jour avec la v31 (wé je sais, je suis un peu fou mais je voulais voir si cette méthode marchait avec la v31)

Bref, en ce qui concerne la méthode ( j'ai suivi les étapes suivantes ) :

TUTORIAL
-------------------------------------------------------------------

Hi Guys, I have not created this guide, I've just added a few more lines to it so that N00b's like me and of course the hardcore macho's out there find it easier to hack their phones.

All credit goes to FCA00000 ; Yura-smart; LeftUp; Deltafox.
You GUYS ROCK!!

Prerequisites:

* An unhackable phone
* Some brains:-)

OK....here we go:

Note: It doesnt matter if you install the applications it in the phone memory or the memory card. ( I did it on the memory card)!!

1. Sign and install MapDrives v1.00 DiskAdmin Unsigned.sis (have to sign it first : http://s60.vgooo.com:801/ to sign the application )
Dont have to run it. Just leave it installed.

2. Install powerboot_s60_3_0_v_2_0_0
This is for making MapDrives V1.00 to AutoStart.
a) run the application
Then select Options->Add Installed App...
Scroll and locate C:\sys\bin\MapDrives and select it.
c) Now Again select options->Enable PowerBoot
d) Exit the application

3. Copy MapDrives.txt from "Hack The Unhackables!!" folder to E:\
It might ask for Overwrite permission. Click Ok to overwrite.

4. Copy your installserver.exe from "Hack The Unhackables!!" folder to E:\Hack\sys\bin\installserver.exe
Note1: You Have to create the directories e:\Hack\sys\bin
Note2: There are two installserver files...installserver9.1 and installserver9.2 If you are not sure whether your phone is symbian 9.1 or Symbian9.2 google it and find out. It will take you only a minute . I have an N82 V31.0.0.16 which is OS9.2

5. Restart your phone.

6. Delete MapDrives and install MapDrive_Y [for N82, N95, N95-8GB, E71 {all phones with Y: drive, else, choose MapDrive_H if you have H:}] and then start the app. In my N82 it didnt open. The screen just blinked and returned to the menu again. Dont worry if something like that happens. It's all going well. :-)

7. Install Modo. (This is a kind of filemanager which has unlimited read/write permission to all folders including c:\sys\bin :-) WOW!! )
Now using Modo copy 'your' installserver.exe to Y:\sys\bin\ (create directories if needed. I guess you need to.)
Note: One funny thing that I noticed is that now you can see a ***** lot of drives like A:/ B:/ ...U:/ V:/..X:/ etc etc. Dont worry.
Its only temporary.


8. Restart phone. You'll be happy to see that all those drives have now dissapeared.

9. NOW THE LAST STEP!!
Copy installserver to C:\sys\bin\ using MODO and then remove the sys folder from Y:\ or H:\ drive (whichever you are having) and restart the phone.

10. Have fun!

Havnt tried installing hellocarbide or BINPDA Sec Platform hack after this dont know whether it works. But MODO definitely does.
After the phone restart you can remove the E\Hack\sys\bin also. It doesnt matter anymore.

Voila ! j'ai suivi cette méthode à la lettre et je n'ai eu aucun problème
J'espère que j'ai pu rassurer certaines personnes

EDIT : Ah oui désolé le lien des fichiers nécessaires : http://dl.free.fr/mItjUN1zn

Mes salutations

Modifié par nightyman, 31 Jan 2009 - 22:35.

[WillyTheBest]

Merci beaucoup pour le partage !

[the-murderer]

Les certificats dedans ne marchent pas!