Windows Phone 7 破解安裝限制

Windows Phone 7為了保護使用者與配合實現軟體市集(Market Place)DRM數位版權保護機制,因此手機上都會限制你自己部屬程式,儘管手機是你的,儘管你今天是開發者,它的好處是可以讓微軟控管開發人員與保護手機的安全有點類似iPhone的保護。

可部屬程式到手機的費用比較

手機 費用
Windows Phone7 每年99美金
Android 免費
iPhone 每年99美金

當然上面的價錢是綁到Market上面,有的是會從你軟體的收入再跟你拆帳,有的是每年要重新授權,各有優缺點就看你想要在哪裡開發了,但Windows Phone7因為我還沒過期,所以我不確定是否時間到了還可以繼續自行部屬程式,但就架構來說應該是可以繼續使用。

好了因為開發人員要開發實機測試所以要解除手機鎖定,盜版的人要自己安裝下載的XAP或破解的XAP所以也要解除手機鎖定,所以共同目標就是Jailbreak, JB幫WP7越獄,這也是我們這篇要講的。

破解原理

Windows Phone Developer Registration官方解鎖程式

我們要從哪裡下手呢?在安裝Windows Phone Developer Tool/SDK後,在開始功能表可以找到Windows Phone Developer Tools中的Windows Phone Developer Registration也就是在路徑「C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v7.0\Tools\Phone Registration\PhoneReg.exe」,這個程式就是官方的註冊完後,我們要透過這支程式連上伺服器做驗證,然後他會把自行部屬XAP鎖定解除。因此駭客研究了這支程式,可以透過.NET反編譯工具(.NET Reflector),我們可以看到它處理有關解碼程式的定義部分

internal UnlockCommand(string authToken, bool isInt)
{
List<byte> list = new List<byte>();
ASCIIEncoding encoding = new ASCIIEncoding();
ushort num = (ushort) (((authToken.Length + 3) + 2) + 3);
list.AddRange(new byte[] { 0x10, 3 });
list.AddRange(BitConverter.GetBytes(num));
list.Add(1);
list.AddRange(BitConverter.GetBytes((ushort) authToken.Length));
list.AddRange(encoding.GetBytes(authToken));
list.Add(2);
list.AddRange(BitConverter.GetBytes((ushort) 2));
ushort num2 = isInt ? ((ushort) 0) : ((ushort) 1);
list.AddRange(BitConverter.GetBytes(num2));
this.commandData = list.ToArray();
}

而手機註冊程式會與伺服器(developerservices.windowsphone.com)溝通取得,解碼的封包

<ResponseOfRegisteredDeviceStatus xmlns="Microsoft.WindowsMobile.Service.Marketplace" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<ResponseCode>0x00000000</ResponseCode>
<ResponseMessage i:nil="true"/>
<Entity xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.WindowsMobile.Service.Marketplace.BLLDevPortal.Entities">
<a:DaysLeft>365</a:DaysLeft>
<a:AppsAllowed>10</a:AppsAllowed> //這裡是部屬程式的數目, 因此可以把這裡調高便可增加部屬的數量
</Entity>

而目前市面上破解工具大部分就是透過偽裝developerservices.windowsphone.com代替伺服器送出解碼封包

實際操作

工具ChevronWP7-NoSideloadLimit(請自己到網路搜尋,本網站不提供,所有破解動作由網友自行負責,本站僅作原理討論)

破解程式

破解注意程序

  1. 安裝Windows Phone 7 SDK,以免同步處理發生問題
  2. 修改註冊檔
    執行C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v7.0\Tools\Phone Registration下的PhoneRegAdd.reg內容如下,或是複製以下內容存成PhoneRegAdd.reg
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsPhone\ProxyPorts]
    “DeviceReg”=dword:000069C5

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\Environment\INT]
    “RemoteFile”=”http://clientconfig.passport-int.net/PPCRLconfig.srf”

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Environment\INT]
    “RemoteFile”=”http://clientconfig.passport-int.net/PPCRLconfig.srf”

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\Environment\Production]
    “RemoteFile”=”http://clientconfig.passport.net/PPCRLconfig.srf”

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Environment\Production]
    “RemoteFile”=”http://clientconfig.passport.net/PPCRLconfig.srf”

  3. 手機必須使用ZUNE與電腦已同步, 不能是Guest
  4. 確定桌面解鎖,否則出現your phone is locked with a PIN
  5. 執行ChevronWP7程序解鎖,出現relock表示解鎖成功

如果失敗請檢查以下事項

失敗畫面

  1. 請勿使用代理伺服器
  2. 解除程式偽裝 developerservices.windowsphone.com,用代理伺服器會造成封包往那邊留或失效
  3. C:\Windows\System32\drivers\etc\Hosts 是否可讀
    程式會寫你的IP developerservices.windowsphone.com
    藉此偽裝成 developerservices.windowsphone.com
  4. 在手機中設置飛安模式
    確保手機不會與 developerservices.windowsphone.com溝通才可以跟偽裝的伺服器驗證
  5. 用管理者權限開啟,開啟平台兼容性XP SP3
  6. 手機端時間和PC端時間要一致

預防破解失效

在與Zune同步的時候請確定是在破解過的機器,也就是Host檔中有寫「你的IP developerservices.windowsphone.com」這樣才不會在連回去正確的伺服器作檢查,這會使你的破解失效,也會讓你在破解後安裝的程式遭刪除,所以如果出「XXX Program has been revoked by Microsoft .Please unstall it.」就回來檢查吧。

結論

破解雖然可以帶來更多的彈性,卻會對系統造成更多的弱點,如果你不是開發者建議還是用一般方法來使用Windows Phone 7並等官方出WP7資源管理器再來作其他控制,而開發人員可以透過這種方式來省錢,但軟體要上架時還是要另外付費,順帶一提現在微軟在推廣開發WP7註冊開發人員還可以享有上架5隻程式免費。

23 comments

  1. Добрый день товарищи[url=http://dostavka.kh.ua/]![/url] Наша контора занимается свыше 10 лет доставкой и перевозкой различных грузов в городе Харькове.

  2. Hey there I am so happy I found your site,
    I really found you by mistake, while I was browsing on Bing
    for something else, Nonetheless I am here now and would just like
    to say thank you for a incredible post and a all round thrilling blog (I also
    love the theme/design), I don’t have time to go through it all at the minute
    but I have bookmarked it and also added in your RSS feeds,
    so when I have time I will be back to read a great deal
    more, Please do keep up the excellent jo.

  3. Hey, I think your blog might be having browser compatibility issues.
    When I look at your blog site in Opera, it looks fine but when opening in Internet Explorer, it has some overlapping.
    I just wanted to give you a quick heads up! Other then that, amazing blog!

  4. I’m curious to find out what blog system you have been working with?

    I’m having some minor security problems with my latest
    website and I would like to find something more safeguarded.
    Do you have any solutions?

  5. You really make it seem so easy with your presentation but I find this matter to be actually something which I think I would
    never understand. It seems too complicated and very broad for me.
    I am looking forward for your next post, I will try to get the
    hang of it!

發表迴響

你的電子郵件位址並不會被公開。

*