Diagnostic Tool Investigation - Nokia Lumia 800

Hello Folks,
some time ago I did some examination on the diagnostics tool included with every firmware. I did not make any siginficant progress because most of the things I tried reqiuired certificates and signed libraries. However I want to share my thoughts so maybe someone else is able to do smoething with this tool..
The main "vulnerability" in the diagnostics tool is that it tries to load every DLL that is defined as AssemblyPart. Here is the MainPage Constructor
Code:
public MainPage()
{
base.\u002Ector();
this.InitializeComponent();
this.oddtMenuItems = new List<OddtMenuItem>();
AssemblyPartCollection parts = Deployment.Current.Parts;
RadioTechnology radio = this.GetRadio();
bool flag = this.isLTEnabled();
foreach (AssemblyPart assemblyPart in (PresentationFrameworkCollection<AssemblyPart>) parts)
{
try
{
Assembly assembly = Assembly.Load(assemblyPart.Source.Replace(".dll", string.Empty));
OddtMenuItem oddtMenuItem = (OddtMenuItem) Enumerable.FirstOrDefault<object>((IEnumerable<object>) assembly.GetCustomAttributes(typeof (OddtMenuItem), true));
if (oddtMenuItem != null)
{
if (!assembly.Equals((object) Assembly.GetExecutingAssembly()))
{
if (oddtMenuItem.RadioType != RadioTechnology.NA && (oddtMenuItem.RadioType & radio) == RadioTechnology.NA)
oddtMenuItem.setEnabled(false);
if (oddtMenuItem.Title == "Wireless LAN" || oddtMenuItem.Title == "APN Settings")
{
oddtMenuItem.setEnabled(false);
this.oddtMenuItems.Remove(oddtMenuItem);
}
if (oddtMenuItem.Title == "Life Timer" && !flag)
{
oddtMenuItem.setEnabled(false);
this.oddtMenuItems.Remove(oddtMenuItem);
}
this.oddtMenuItems.Add(oddtMenuItem);
}
}
}
catch (Exception ex)
{
}
}
this.PrioritizeMenuItems();
this.MainListBox.DataContext = (object) this.oddtMenuItems;
if ((bool) Application.Current.Resources[(object) "OddtDisclaimerAccepted"])
{
this.ContentGrid.Visibility = Visibility.Visible;
this.DisclaimerGrid.Visibility = Visibility.Collapsed;
this.get_ApplicationBar().set_IsVisible(true);
}
else
{
this.ContentGrid.Visibility = Visibility.Collapsed;
this.DisclaimerGrid.Visibility = Visibility.Visible;
this.get_ApplicationBar().set_IsVisible(false);
}
}
The AssemblyParts are defined in the WMAppManifest.xaml:
Code:
<Deployment xmlns="http://schemas.microsoft.com/client/2007/deployment" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" EntryPointAssembly="OddtApplication" EntryPointType="OddtApplication.App" RuntimeVersion="4.7.50308.0">
<Deployment.Parts>
<AssemblyPart x:Name="OddtApplication" Source="OddtApplication.dll" />
<AssemblyPart x:Name="About" Source="About.dll" />
<AssemblyPart x:Name="Accelerometer" Source="Accelerometer.dll" />
<AssemblyPart x:Name="Als" Source="Als.dll" />
<AssemblyPart x:Name="APN" Source="APN.dll" />
<AssemblyPart x:Name="AudioLoopback" Source="AudioLoopback.dll" />
<AssemblyPart x:Name="Battery" Source="Battery.dll" />
<AssemblyPart x:Name="Bluetooth" Source="Bluetooth.dll" />
<AssemblyPart x:Name="Camera" Source="Camera.dll" />
<AssemblyPart x:Name="CareBattery" Source="CareBattery.dll" />
<AssemblyPart x:Name="CareTestSequence" Source="CareTestSequence.dll" />
<AssemblyPart x:Name="Dtmf" Source="Dtmf.dll" />
<AssemblyPart x:Name="ExampleLibrary" Source="ExampleLibrary.dll" />
<AssemblyPart x:Name="Gyroscope" Source="Gyroscope.dll" />
<AssemblyPart x:Name="HardwareButtons" Source="HardwareButtons.dll" />
<AssemblyPart x:Name="Headset" Source="Headset.dll" />
<AssemblyPart x:Name="LcdWhite" Source="LcdWhite.dll" />
<AssemblyPart x:Name="LedKeypad" Source="LedKeypad.dll" />
<AssemblyPart x:Name="LifeTimer" Source="LifeTimer.dll" />
<AssemblyPart x:Name="LTEBandLock" Source="LTEBandLock.dll" />
<AssemblyPart x:Name="LTETx" Source="LTETx.dll" />
<AssemblyPart x:Name="Magnetometer" Source="Magnetometer.dll" />
<AssemblyPart x:Name="Memory" Source="Memory.dll" />
<AssemblyPart x:Name="Microsoft.Phone.Controls" Source="Microsoft.Phone.Controls.dll" />
<AssemblyPart x:Name="Microsoft.Phone.Controls.Toolkit" Source="Microsoft.Phone.Controls.Toolkit.dll" />
<AssemblyPart x:Name="MMS" Source="MMS.dll" />
<AssemblyPart x:Name="NonLinearNavigationService" Source="NonLinearNavigationService.dll" />
<AssemblyPart x:Name="OddtAttributes" Source="OddtAttributes.dll" />
<AssemblyPart x:Name="PowerSource" Source="PowerSource.dll" />
<AssemblyPart x:Name="Proximity" Source="Proximity.dll" />
<AssemblyPart x:Name="RadioAccess" Source="RadioAccess.dll" />
<AssemblyPart x:Name="Settings" Source="Settings.dll" />
<AssemblyPart x:Name="Speaker" Source="Speaker.dll" />
<AssemblyPart x:Name="Touch" Source="Touch.dll" />
<AssemblyPart x:Name="Vibra" Source="Vibra.dll" />
<AssemblyPart x:Name="WirelessLAN" Source="WirelessLAN.dll" />
<AssemblyPart x:Name="Microsoft.Phone.Media.Extended" Source="Microsoft.Phone.Media.Extended.dll" />
</Deployment.Parts>
</Deployment>
For an MenuItem to appear in the diagnostics app it has to be flagged with the OddtMenuItem-Attribute (or however you call this).
Code:
[AttributeUsage(AttributeTargets.Assembly)]
public class OddtMenuItem : Attribute
{
private OddtMenuItemStatus status;
private string title;
private string description;
private Uri entryPage;
private int priority;
private RadioTechnology radiotype;
public Brush ForegroundColor
{
get
{
if (this.status == OddtMenuItemStatus.Alpha)
return (Brush) new SolidColorBrush(Colors.Gray);
if ((Color) ((FrameworkElement) new PhoneApplicationPage()).Resources[(object) "PhoneBackgroundColor"] == Color.FromArgb(byte.MaxValue, byte.MaxValue, byte.MaxValue, byte.MaxValue))
return (Brush) new SolidColorBrush(Colors.Black);
else
return (Brush) new SolidColorBrush(Colors.White);
}
}
public bool IsEnabled
{
get
{
return this.status > OddtMenuItemStatus.Alpha;
}
}
public RadioTechnology RadioType
{
get
{
return this.radiotype;
}
}
public Visibility Visibility
{
get
{
return this.status == (OddtMenuItemStatus.Alpha | OddtMenuItemStatus.Beta) ? Visibility.Visible : Visibility.Collapsed;
}
}
public string Title
{
get
{
return this.title;
}
}
public string Description
{
get
{
return this.description;
}
}
public Uri EntryPage
{
get
{
return this.entryPage;
}
}
public int Priority
{
get
{
return this.priority;
}
set
{
this.priority = value;
}
}
public OddtMenuItem(OddtMenuItemStatus status, string title, string description, string location, RadioTechnology radiotype = RadioTechnology.NA)
{
this.status = status;
this.title = status != OddtMenuItemStatus.Beta ? title : string.Format("{{{0}}}", (object) title);
this.description = description;
this.entryPage = new Uri(location, UriKind.Relative);
this.priority = 99999;
this.radiotype = radiotype;
}
public void setEnabled(bool enable)
{
if (enable)
return;
this.status = OddtMenuItemStatus.Alpha;
}
}
I think that we can execute code with high Level privileges as soon as we are able to manipulate the WMAppManifest.xaml and copy a DLL into the App folder. The main Problem is that every Manipulation of the Folder or one of ist files invalidates the signature.
Regards
Chris