Hacking S60 3rd edition firmware - Unlimited permissions for untrusted midlets

By default, Nokia S60 3rd Edition phones install midlets mostly with "oneshot" or "session" permissions, which force user to accept permission everytime a network connection is made or file is opened. If you don't have signing key (which costs $$$), you cannot even modify these permissions, because the phone only allows "ask everytime" option for e.g. file write.

So, here's the hacking alternative - proceed at your own risk. By replacing some strings, we can give equals permissions to untrusted applications with the manufacturer signed applications.

First, update your S60 phone normally using Software Update tool from Nokia. It downloads updates to your harddrive, storing binary images to

C:\Documents and Settings\All Users\Application Data\Nokia\Nokia Service Layer\A\nsl_service_module_00001\www.dsut.online.nokia.com.oti.caresuite\Products\

Directory contents look interesting and for my phone there is about 50 MB rom image there. Simple strings scan on rom image shows contents some fragments of text based java permission file, which by closer look very interesting (at around 0x2310000 in my case) :

Now, all you need to do is to open up your favourite hex editor and write "MaximumMode: Blanket" to permissions you want to allow, and if you feel risky you can change the DefaultMode as well.

Now re-run the software update, force re-runing and phone will be flashed with your new permissions. After installing midlet, you should see more permission options in the application manager (select midlet, click open)...

---

Exploring S60 with AllFiles

Symbian Signed says they won't accept any file explorer tools with AllFiles capabilities. As a result of firmware modification, they really don't need to do that, we can self-sign those!

Here's couple of screenshots of Y-Browser running with AllFiles capability:

By default, Y-Browser comes with standard set of capabilities, so we need to add AllFiles capability to the set.

You'll need the fabulous sisinfo tool to unpack the sisx, elftran (from sdk) to modify executable headers and of course makesis and signsis to create new sisx.

Extract .sisx contents:

Finally, run makesis, signsis - you know the drill for selfsigning. For makesis you need .pkg file, you I made a simplified version for you - [URL="http://symbaali.info/files/ybrowser.pkg"][B]ybrowser.pkg[/URL]

Source: symbaali.info