8.1 Jailbreak (not typical) - Windows RT Development and Hacking

Salutations folks,
Before you get ready to get your flame on, I'm NOT asking about the STATUS of a RT Windows 8.1 Jailbreak. I'm posting about jailbreaks in general. I'm from a linux/android background. I got an Asus Vivotab RT LTE (AT&T version) for a steal off 1Sale. Before I even looked into doing anything with my tablet, I updated it to 8.1. Then I finally got around to looking into running desktop apps on Windows RT (not knowing how it all worked with RT vs desktop), I ran into the issue of not being able to run them (duh, right?). Then I found out about jailbreaking. So.. do you HAVE to jailbreak to run desktop apps? As I understand it, we currently have to run 8.0 to jailbreak/run desktop apps, yes? Well.. I obtained the Asus recovery files to downgrade my 8.1 to 8.0. On a whim, I updated my 8.1 with the 8.1 big spring update (basicly 8.1.1). I seem to be able to run some of the ported desktop apps without any problem. Am I missing something? How'd my tablet manage that without having run the jailbreak? And jailbreak doesn't work on 8.1 anyways? Before anyone says I'm full of it.. (you can click the thumbnail for full pic)
(windows rt 8.1 with 8.1 spring update installed)
(windows rt 8.1 running desktop 7zip)
(windows rt 8.1 running desktop putty)
(windows rt 8.1 running desktop notepad++)
Can anyone clarify if I'm missing something or I've come across an anomaly or even a blessed relief?
Thanks.

This is sure amazing
1. Can you run *any* unsigned application or only a few work (and the rest throw signature errors?)
2. Check the status of Secure Boot in PowerShell. Run as admin, "Get-SecureBootPolicy", press enter (http://technet.microsoft.com/en-us/library/jj603043.aspx)
3. Could you detail exactly your process? I understand that you did the following:
(On 8.1) Run unsigned desktop app, fail with digital signature error.
(Downgrade) Downgrade to 8.0 -> (On 8.0) Run Jailbreak -> Run Desktop Apps and they work.
(Upgrade) Upgrade to Windows RT 8.1 (via Store?) -> Upgrade to 8.1.1 (Spring Update) via Windows Update -> Run Desktop Apps and they work (partly or all of them?)
4. I'm not sure if it'd be any useful, but perhaps you could look in your EFI system partition (mountvol S: /s) as there has been a previous report of Asus leaving debug tools in VivoTab RTs before (http://forum.xda-developers.com/showthread.php?t=2477285). If you could retrieve a "debug" version of Secure Boot Policy from your EFI partition then it means that Secure Boot has just disabled itself on your tablet. It's highly unlikely, however, since you weren't able to run desktop apps in your original 8.1 install...

jimmielin said:
This is sure amazing
1. Can you run *any* unsigned application or only a few work (and the rest throw signature errors?)
Click to expand...
Click to collapse
I only grabbed the ported Putty, 7zip and Notepad++ desktop apps as those were the only ones that I was needing.. Oh I recently grabbed the FileZilla one too. All ran without any problems and never got any signature errors. Hell.. even my 7zip integrated into the shell and replaced archive icons with 7zip archive icons and opens my archives by default with the desktop app. Were there any particular applications you wanted me to try so that I can see if I can replicate any signature errors?
jimmielin said:
Check the status of Secure Boot in PowerShell. Run as admin, "Get-SecureBootPolicy", press enter (http://technet.microsoft.com/en-us/library/jj603043.aspx)
Click to expand...
Click to collapse
SecureBoot is enabled and it displays a Publisher GUID. Confirm-SecureBootUEFI confirms SecureBoot is enabled too.
jimmielin said:
3. Could you detail exactly your process? I understand that you did the following:
(On 8.1) Run unsigned desktop app, fail with digital signature error.
(Downgrade) Downgrade to 8.0 -> (On 8.0) Run Jailbreak -> Run Desktop Apps and they work.
(Upgrade) Upgrade to Windows RT 8.1 (via Store?) -> Upgrade to 8.1.1 (Spring Update) via Windows Update -> Run Desktop Apps and they work (partly or all of them?)
Click to expand...
Click to collapse
hmm
- Received clean OEM install Vivotab RT LTE with RT 8.0
- Upgrade to Windows RT 8.1 via Store
- (attempted to run some ported desktop apps, received error)
- was going to downgrade back to 8.0 after getting Asus recovery files but instead..
- Upgrade to RT 8.1.1 (Spring Update) via Windows Update
- (attempted to run some ported desktop apps, ran successfully, no errors)
NOTE: Not once had I ever gotten around to downloading or installing the Jailbreak. Is there some way to confirm if I have the jailbreak installed at startup or something?
jimmielin said:
4. I'm not sure if it'd be any useful, but perhaps you could look in your EFI system partition (mountvol S: /s) as there has been a previous report of Asus leaving debug tools in VivoTab RTs before (http://forum.xda-developers.com/showthread.php?t=2477285). If you could retrieve a "debug" version of Secure Boot Policy from your EFI partition then it means that Secure Boot has just disabled itself on your tablet. It's highly unlikely, however, since you weren't able to run desktop apps in your original 8.1 install...
Click to expand...
Click to collapse
I copied a SecureBootDebugPolicy.p7b (dated 02/13/2014 @ 3:19PM) file from there. From what I was reading, I take it that's a good thing? (click thumbnail for full pic)
SecureBootDebugPolicy in the certificate manager tool

what is the icon that next on the left of action center (bottom-right, triangle flag) and at the right side of OneDrive?

hisoft said:
what is the icon that next on the left of action center (bottom-right, triangle flag) and at the right side of OneDrive?
Click to expand...
Click to collapse
USB/SD eject (I have SD card I keep in the slot for extra storage)

thesawolf said:
USB/SD eject (I have SD card I keep in the slot for extra storage)
Click to expand...
Click to collapse
Good job ASUS :good:

If you were able to retrieve a SecureBootDebugPolicy.p7b that is functional, it probably means that there was a Debug policy on your device at some point? (ref. Original Thread on ASUS). I've just looked into my Surface RT and there's a file with that name too, but it cannot be opened (it's simply an empty 0-byte file) and probably you're another lucky one who has a debug policy. (However it can't be explained why Get-SecureBootPolicy shows that you're using a production policy? Does it show the production policy GUID that TechNet says is normal, or something else? Policies don't disable secure boot, Confirm-SecureBootPolicy showing true is perfectly normal even in debug.)
Would it be possible to share this SecureBootDebugPolicy.p7b and then we'd able to see if there is someone else with a VivoTab RT that could test it? I assume it's locked to your device but it's always worth a try.
Could anyone else with experience working with Secure Boot look into this? While it's probably a lucky isolated case, it's nevertheless promising...

Just to double check: does anybody else have a Vivo Tab RT with 8.1u1 they could check this against? It would be amazing / hilarious if the update disabled signature enforcement. The question would then be whether that was Microsoft's idea or Asus's...
Oh, and one other quick test: grab a built-in program (CMD.EXE or Notepad.EXE, for example) and make a copy of it to somewhere you can edit it (like the desktop). Open the file in a hex editor (if needed, copy it off the tablet first) and change something unimportant, like a few characters in a string (not a file path, more like "is not recognized as an internal or external command..." or some such thing) to some other value that has the same number of characters. Save the file and try running it on the tablet again. The idea is that this will be an EXE with an *invalid* signature (as opposed to just being unsigned) and that would be very surprising if it works... but this whole thing is surprising!

GoodDayToDie said:
Just to double check: does anybody else have a Vivo Tab RT with 8.1u1 they could check this against? It would be amazing / hilarious if the update disabled signature enforcement. The question would then be whether that was Microsoft's idea or Asus's...
Click to expand...
Click to collapse
Tried it on a VivoTab RT LTE (AT&T) with u1 -- ran 7z ARM and it failed on signature verification.

I would never run another update on that device. Don't want to patch up the botched update.
Sent from my Z10 using XDA Premium 4 mobile app

I wonder if there's some way to take a full image of your current installation (possibly using a backup utility?) that can be restored onto other peoples' tablets. Even better would be if the relevant bits could be extracted from your image and carried over to other tablets (such as Surface RTs, Surface 2s, Lumia 2520s, etc.) but that may be harder. Still, worth investigating more...

Was it new or used when you got it? And if it was used, is it possible the original owner JB'd it and it stuck through the update?
Sent from my HTC6600LVW using XDA Premium 4 mobile app

GoodDayToDie said:
I wonder if there's some way to take a full image of your current installation (possibly using a backup utility?) that can be restored onto other peoples' tablets. Even better would be if the relevant bits could be extracted from your image and carried over to other tablets (such as Surface RTs, Surface 2s, Lumia 2520s, etc.) but that may be harder. Still, worth investigating more...
Click to expand...
Click to collapse
Should be able to use dism.exe. Not sure if it will capture the online image, but you can definitely use it in recovery mode. Should be able to capture with new-windowsimage too. Going to try it out real quick and report back... I would choke puppies for this image.
---------- Post added at 11:24 AM ---------- Previous post was at 10:35 AM ----------
Okay it you can't capture the online image. You'll need to have a USB drive with enough space to capture the whole thing. Make sure you either suspend bitlocker or make sure you have a copy of the recovery key handy (It's 48 decimal digits).
Boot to the recovery partition (it doesn't matter if it's on the local storage or a USB key - it can even be the same USB key you will copy the disk image to if you have enough free space).
Choose language, troubleshoot, advanced, command prompt (I think - point is, you want a command prompt).
Verify the drive letters are what you expect them to be (internal storage is c, usb disk is d, ramdisk is x).
run: dism /capture-image /ImageFile:d:\winrt81u1.wim /CaptureDir:c:\ /Name:WinRT81U1vivotab
Let it finish. It will take a while. Probably a long time since it's writing to USB 2.0 flash storage. Bet on an hour. You probably want to make sure it's plugged in to power (but you're not writing anything to the local storage, so you won't break anything if it goes dead).
Upload that wim file to skydrive and share it with me!

Sjflowerhorn said:
Was it new or used when you got it? And if it was used, is it possible the original owner JB'd it and it stuck through the update?
Sent from my HTC6600LVW using XDA Premium 4 mobile app
Click to expand...
Click to collapse
That is impossible, the 8.0 jailbreak was performed in memory and it not written to the disk.

Toxickill said:
That is impossible, the 8.0 jailbreak was performed in memory and it not written to the disk.
Click to expand...
Click to collapse
Gotcha, I haven't JB'd mine yet, so I have no idea how it works. Apparently I'm Windows ShmeShmarted and can't make a bootable flash drive that contains the rollback. And coming from android devices where everything sticks except for some very select mods/devices I just figured it might be possible.
Sent from my HTC6600LVW using XDA Premium 4 mobile app

Sjflowerhorn said:
And coming from android devices where everything sticks except for some very select mods/devices I just figured it might be possible.
Click to expand...
Click to collapse
Believe me, that's what all RT owners would WANT to have. Although there's many reasons to jailbreak a device, I personally prefer feeling like I've gained full control of hardware I own. The in-memory jailbreak was good, but it didn't have that satisfying feeling of permanence you often get with an Android rooting / OS replacement.

southbird said:
Believe me, that's what all RT owners would WANT to have. Although there's many reasons to jailbreak a device, I personally prefer feeling like I've gained full control of hardware I own. The in-memory jailbreak was good, but it didn't have that satisfying feeling of permanence you often get with an Android rooting / OS replacement.
Click to expand...
Click to collapse
Until the carrier gets to your device and locks the bootloader (AT&T)

I actually preferred the in-memory jailbreak in many ways. It meant we couldn't modify system files or run unsigned code for a couple minutes after boot, but it also meant we could trivially easily "un-jailbreak" and we could install updates with no fear of them destroying anything. Even the huge 8.1 update, which broke the jailbreak *process*, could be started on a device which was already jailbroken without causing any harm (unlike, say, many iOS jailbreaks).

I agree. I liked that the 8.0 jailbreak wasn't permanent but also exceedingly simple to install at boot. It meant that sending my Surface RT back to my Microsoft under warranty had no problems at all.

Lumen_Melano said:
I agree. I liked that the 8.0 jailbreak wasn't permanent but also exceedingly simple to install at boot. It meant that sending my Surface RT back to my Microsoft under warranty had no problems at all.
Click to expand...
Click to collapse
The in-memory Jailbreak is great when you hard brick your Surface and take it to the Microsoft Store. They just gave me a new one with no problems at all.

Related

[PSA] Disable Automatic Updates (Howto included)

Hi guys!
Microsoft said this to The Verge recently:
The scenario outlined is not a security vulnerability and does not pose a threat to Windows RT users. The mechanism described is not something the average user could, or reasonably would, leverage, as it requires local access to a system, local administration rights and a debugger in order to work. In addition, the Windows Store is the only supported method for customers to install applications for Windows RT. There are mechanisms in place to scan for security threats and help ensure apps from the Store are legitimate and can be acquired and used with confidence.
We applaud the ingenuity of the folks who worked this out and the hard work they did to document it. We’ll not guarantee these approaches will be there in future releases.
Click to expand...
Click to collapse
So fire up regedit, go to
Code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
and set the DWORD AUOptions to 0x00000000.
Only do this if you want to run unsigned apps!
Stay safe!
clrokr
For those who prefer do-it-for-me solutions, with the ability to roll back, have a pair of .REG files. The "Default" one I taken from my Surface before applying this tweak. The "Disabled" one sets the reg value as above.
@clrokr: We gotta get you a RD tag, pronto! You're doing great things.
GoodDayToDie said:
@clrokr: We gotta get you a RD tag, pronto! You're doing great things.
Click to expand...
Click to collapse
Wow, I'm flattered. Also, thanks for the reg files!
GoodDayToDie said:
@clrokr: We gotta get you a RD tag, pronto! You're doing great things.
Click to expand...
Click to collapse
Seconded.
As far as MS's quote goes, I'm not 100% sure they will be setting out to patch it, but it's still a good idea to disable Windows Update anyways. They may be able to store some sort of cert blacklist in the UEFI that will block the executables required for this, even after a reinstall.
whats the difference between uefi,efi and firmware?
I find bootmgfw.efi,winload.efi in bcdedit.and I find surfacertuefi.bin in c:\windows\firmware.and every time I reinstall windows,there is a firmware in windows update.so is there anything flash into the surface hardware from window update?I think the uefi is just a file in the filesystem and its recovered when I reinstall windows from usb.
windowsrtc said:
whats the difference between uefi,efi and firmware?
I find bootmgfw.efi,winload.efi in bcdedit.and I find surfacertuefi.bin in c:\windows\firmware.and every time I reinstall windows,there is a firmware in windows update.so is there anything flash into the surface hardware from window update?I think the uefi is just a file in the filesystem and its recovered when I reinstall windows from usb.
Click to expand...
Click to collapse
No, the firmware (stored on-chip) is what you find in SurfaceRTUEFI.bin. The .EFI files are executables that can be loaded by this firmware if they are signed correctly.
Note: just because automatic updates are disabled doesn't mean you should ignore Windows Update. Quite the opposite, in fact, since this hack makes malicious exploits easier too. Just be very careful which patches you install.
clrokr said:
No, the firmware (stored on-chip) is what you find in SurfaceRTUEFI.bin. The .EFI files are executables that can be loaded by this firmware if they are signed correctly.
Click to expand...
Click to collapse
so uefi is checking efi ,but whats checking uefi?what will happen if we flash a modified uefi?
windowsrtc said:
so uefi is checking efi ,but whats checking uefi?what will happen if we flash a modified uefi?
Click to expand...
Click to collapse
The UEFI is currently the only thing capable of flashing a new UEFI, and it checks the signatures on any new UEFIs it flashes.
The only real way you could do it without relying on a signature check would be to open the tablet and solder onto the NAND directly.
Oh, there might be a JTAG port you could use... but yeah. Short of opening up the device (which the Surface, at least, is definitely not designed to support) there's not supposed to be any way to flash an unsigned firmware.
Also, the signature keys are probably stored in a TPM, so mucking with them isn't a practical option either if the EFI doesn't have a way to do it (which it doesn't).
GoodDayToDie said:
Oh, there might be a JTAG port you could use... but yeah. Short of opening up the device (which the Surface, at least, is definitely not designed to support) there's not supposed to be any way to flash an unsigned firmware.
Also, the signature keys are probably stored in a TPM, so mucking with them isn't a practical option either if the EFI doesn't have a way to do it (which it doesn't).
Click to expand...
Click to collapse
You can reset the TPM from Windows (change the owner password w/o knowing the previous one) and it doesn't break, I don't think they're stored in the TPM.
I have no idea what the TPM is used for.
GoodDayToDie said:
Also, the signature keys are probably stored in a TPM
Click to expand...
Click to collapse
No. There are lots of info on TPM, and it is not used to store CA keys.
A “Debug System” is will initially be identified by the presence of the Microsoft Test Signing CA in the UEFI signature database (“db”). The mechanism to identify debug machines may change, but the exclusion path logic should remain unchanged.
OEMs will need to work with their SOC supplier to provide the tools and process to implement “Debug Systems”.
To enable debug systems the db will need to contain the “Microsoft Testing Root Certificate Authority 2010”
....
Note: If there is a need to run unsigned tools, the system can be configured as a “Debug System” during manufacturing but there must be a step in the production process that removes the Microsoft Test CA. Production machines must not ship with the Microsoft Test CA in the db .
Click to expand...
Click to collapse
The last line explains the behavior I've seen on a just-bought VivoTab - I've seen lines about running unsigned files in CodeIntegrity eventlog. Seems that the device was provisioned with the unsigned tools, one of which deleted the certificate from uefi DB.
By the way, it should be theoretically possible to recover those tools on a just-bought device, if you would not go through the initial setup process but immediately press shift+f10 to run CMD and run a deleted-file recovery tool from there, or make a sector-by clone of disk C: to an SD card for later analysis. But, sadly, currently there are no such tools, and even if they are - they need to be signed by ms
Im using genuine Windows 8 Pro, and I dont see any benefits of this. But hey, I installed the "free" one on my friends computer. So this would be pretty handy for them, in case microsoft release an unfriendly patch
clrokr said:
So fire up regedit, go to
Code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
and set the DWORD AUOptions to 0x00000000.
Only do this if you want to run unsigned apps!
[/QUOTE]
I navigated to this position in regedit and the key was already setted to 0x00000000
Might that be caused by the jailbreak tool published by netham45?
Click to expand...
Click to collapse
GoodDayToDie said:
Oh, there might be a JTAG port you could use
Click to expand...
Click to collapse
Even if you could find the JTAG it would be useless, Tegra processors lock out JTAG access when set to ODMPRODUCTION.
save_jeff said:
I navigated to this position in regedit and the key was already setted to 0x00000000
Might that be caused by the jailbreak tool published by netham45?
Click to expand...
Click to collapse
My tool does not set any settings of the sort.
netham45 said:
My tool does not set any settings of the sort.
Click to expand...
Click to collapse
Thx ;]
I would like to have this in the jailkreak tool as an optional funktion.
Maybe you could consider that :]
Just wondering why the registry hack is needed when you can simply disable the service? Seems like a more straightforward approach to me
bfosterjr said:
Just wondering why the registry hack is needed when you can simply disable the service? Seems like a more straightforward approach to me
Click to expand...
Click to collapse
Does not the service start again after restart of the system?
save_jeff said:
Does not the service start again after restart of the system?
Click to expand...
Click to collapse
You can permanently disable it.

Running Windows Phone 8 applications On Windows 8 RT

Hi,
I started experimenting with this idea. I have WP8 files extracted from a firmware file. I copied these files to my surface RT. I was able to run some WP8 applications out of the box. however, applications that require UIXmobile.dll (WP GUI) failed to run. Now both WP8 and W8 share the NT core. so some libraries would just work. now the main WP8 library UIXmobile.dll doesn't work out of the box. as it uses a different function to create the gui for its applications.
I was thinking of something similar to what has been done by "mamaich", to implement a library that will replace the WP8 call wtith the standard W8 call (for example: use createProcess instead of createApplication) and pass the common calls to the already implemented APIs.
sadly , It's a very difficult task for me to do. I'll be spending time on it but i can't promise of any fast results.
I'd like to thank the authors of these threads for their wonderful work:
1. Running x86 apps on WinRT devices (by mamaich)
http://forum.xda-developers.com/showthread.php?t=2095934
2. RT Jailbreak Tool (By netham45 )
http://forum.xda-developers.com/showthread.php?t=2092158
3. Desktop apps ported to Windows RT (by GoodDayToDie)
http://forum.xda-developers.com/showthread.php?t=2092348
4. (FFU) ImgMount Tool v.1.0.15 (by AnDim)
http://forum.xda-developers.com/showthread.php?t=2066903
Which apps worked without tinkering?
Oh, very cool idea. It would probably only work for actual WP8 apps at first (not WP7.x apps, as those would require either a Silverlight or XNA runtime), but the idea has merit for sure. It was speculated for a long time that running WP8 apps on Win8/Windows RT would be possible, as both are written against the WinRT API, but that never happened. If we can make it happen ourselves, though... that would be awesome.
Of course, ideally we'd want to be able to access the store, since there aren't a lot of WP8 app packages floating around where we could use them. That's probably a very tricky problem in and of itself, although you could try extracting the store EXE and seeing what is required to make it work...
I think windows phone(os) is just a min gui shell for windows rt.so its possible to run the shell in windows rt.and maybe a windows phone can run windows rt.
windowsrtc said:
I think windows phone(os) is just a min gui shell for windows rt.
Click to expand...
Click to collapse
Not exactly. It's the same shell (well, the next rev) that was running on top of wince for WP7.
Is it an alternate shell (like Explorer), or a totally separate graphics subsystem?
Boomchaos said:
Which apps worked without tinkering?
Click to expand...
Click to collapse
there is a program called telwp.exe that was able to reach a certain point. I attached a screen shot of 3 different apps. 2 apps showed something before crashing (telwp, nokia_security). and the third app crashed with an error message. other wp apps usually crash silently leaving an error message about a faulty CoreUi.dll in the evenlog .

WinDBG cannot debug desktop program?

If I don't run the jailbreak, I cannot attach or create desktop process using WinDBG.
However under jailbreak everything works fine. I'd like to know why this happen.
Reserved
I believe they tried to prevent using the debugger on desktop apps for 8.1. Not sure how thorough it is; most of the time it's not really relevant as it's pretty easy to bypass.
GoodDayToDie said:
I believe they tried to prevent using the debugger on desktop apps for 8.1. Not sure how thorough it is; most of the time it's not really relevant as it's pretty easy to bypass.
Click to expand...
Click to collapse
I just updated to 8.1 to see how that works out with a old version of WinDBG. It doesn't work either. It seems being related to jailbreak. Curious how that will affect WinDBG.
Its a good question
A year or two back when we were first looking at RT 8.0, the fact that the debugger couldn't start or attached to desktop programs was a big headache
We were having to used the visual studio remote debugger
Then someone discovered that cdb -pv or -pvr would attach, and the opportunities opened up
Presumably normal attaching somehow falls foul of the locked down nature of the system
although strange it cant start existing signed exe's like notepad
or do a normal attach to them
so implies some other check is going on
In RT8.1 its even further tightened down
no admin level VS remote debugger
debugger package (and debug kit policy) cant even -pvr to a process
CORRECTION: yes you still can-pvr to a process
but cant access csrss as it is now protected
xsoliman3 said:
Its a good question
A year or two back when we were first looking at RT 8.0, the fact that the debugger couldn't start or attached to desktop programs was a big headache
We were having to used the visual studio remote debugger
Then someone discovered that cdb -pv or -pvr would attach, and the opportunities opened up
Presumably normal attaching somehow falls foul of the locked down nature of the system
although strange it cant start existing signed exe's like notepad
or do a normal attach to them
so implies some other check is going on
In RT8.1 its even further tightened down
no admin level VS remote debugger
debugger package (and debug kit policy) cant even -pvr to a process
CORRECTION: yes you still can-pvr to a process
but cant access csrss as it is now protected
Click to expand...
Click to collapse
You also can't write to the memory on a process if you attach to it.

[SP4] Windows 8.1 custom ROM for Surface Pro 4

For those of you missing Windows 8.1, congratulations, you just found the solution.
Download
OneDrive http://1drv.ms/1SGHo5e
MEGA https://mega.nz/#F!ks8gjaZT!oQx3xt9ET0nXe8JbKDvtsA
Features
1.Windows is fully updated as of February 2016.
2.Surface February update included (solves most speaker popping issue)
3.Based on Surface Pro 3 image. Full stock-like Surface branding (desktop background, out-of-box experience).
4.Windows activates with the embedded product key. Fully legit. I cannot guarantee if yours couldn’t activate though.
5.Bloat free with about 3 GB saving: (Microsoft devices are shipped bloat-free? Think again.) | Only 6 metro apps included (Camera, IE, OneDrive, PC Settings, Photos, Store). The rest can be downloaded from Store | Trial Office removed | Speech data removed.
6.Languages included: English, French, Spanish. Since it is Windows 8 Pro, you can download any other language later.
7.Fully working refresh and reset functionality.
8.WinRE from vanilla Windows, touchscreen driver included.
9.Pagefile takes less space: 400 MB. It can grow to up to 8 GB, a reboot brings it back to 400 MB.
10.Various Windows tweaks | File Indexing paused on battery | Verbose messages, you get more information in boots and shutdowns | No startup programs delay | non-certified DLNA devices are supported | Custom resolution script added (open C: drive, its there. Just double click.) | "Get Windows 10" system tray icon disabled.
11.Some drivers from S3, SP3, SP4, and other OEM devices (kudos to them for releasing their Skylake devices with Windows 8.1 drivers).
12.Latest Intel iGPU driver (version 4380 Beta).
NOT working
1.Windows Hello. As expected, Windows 8.1 does not support Windows Hello.
2.The buttons are mapped differently | Power --> Volume Down | Volume Up --> Power | Volume Down --> Start
3.Surface app | You cant adjust pen sensitivity | You can't configure the pen top button action through the app. You can still customize it manually with AHK.
FAQ
Q: Camera app crashes / BSOD
A: You need to disable the IR camera. You can do that either via the BIOS or Device Manager.
Q: The pen button doesn't work after the first setup
A: You may need to re-pair the pen. Go to PC Settings > Bluetooth and remove the Surface Pen. Create a new pairing by pressing the pen top button for 7 seconds, it will show up on the Surface, and just pair it.
Q: How did you get the embedded Windows 10 product key to work with Windows 8.1?
A: Actually I have no idea. It just worked.
Q: Are the "not working" issues going to be fixed?
A: For the buttons, its up to Microsoft to release a Windows 8.1 compatible driver, and we have no other source as Microsoft has modified Intel's driver. If you know how to remap the buttons (either via editing the driver, Registry, or AHK), please share it with us and I will include it in the next version. For the Surface app, I believe it is simply because the Windows 8 version of Surface app was not updated for the Surface Pro 4 (and will never be), so don’t expect that one.
Q: Why did you go with the beta driver for the graphics?
A: The latest release version, 4352 and 4364, are practically unusable. I experienced blank screen in video playback and some random BSOD. No choice really.
Q: When Intel has released the new driver, do I need to wait for the next version of the ROM?
A: No, you can just download and install it yourself without waiting for me to upload an updated ROM. The new version should pop up here, download the ZIP version for Windows 8.1, and install it using the "Have Disk…" method. Step-by-step guide http://www.windowscentral.com/how-install-intel-beta-graphics-drivers-surface
Q: How do I remap the pen buttons manually?
A: Go browse /r/Surface in Reddit, they have comprehensive guides on how to use AHK with the Surface Pen.
Q: Do I need to wait for your next ROM to get Windows updated?
A: No, you can just update normally via Windows Update
Q: You idiotic luddites should just upgrade to Windows 10 rather than shoehorning Windows 8 to the cutting-edge device that clearly does not deserve the old, ****ty Windows 8. Also, I am a Windows 10 fanboy.
A: Before you get angry and all that, I actually *do* want to upgrade to Windows 10. I mean, how cool is that to login with your face? However, it is hampered by quite a lot ergonomic usability issues, bugs, and the general quirkiness of Tablet Mode. As of today, Tablet Mode is nowhere near final. Not even the Task View has proper animation in Tablet Mode, it already tells how half-assed the Tablet Mode is.
How to install
BACKUP BACKUP BACKUP!!! This will format the entire disk. No data will be preserved! Its also advised to remove the microSD card during the process.
0. Get a keyboard and USB hub if you don’t have the Type Cover.
1. Download and extract the package
2. Set up the ISO image on a CD or USB stick. If you use Rufus, set it on "MBR for UEFI computer" (only for the USB stick, the Surface will be set up as GPT)
3. Boot it on the Surface
4. Enter cd /d D:\scripts
5. Enter diskpart /s part.txt
6. Enter apply D:\Images\install.wim D:\Images\winre.wim
7. You can repeat the step #6 just to be sure
8. Reboot, unplug the USB stick.
Signed up on xda just to express my gratitude for this great tutorial and release. Everything worked a charm with full touchscreen support and I am so glad to finally have Windows 8.1 on my Surface Pro 4! No more forced windows updates sucking up my bandwidth, more free space on my hard disk, and the only gaming app that I use for my ps2 games (PCSX2), finally runs at 60fps (can you imagine on windows 10 the emulator would drop between 40-50 fps)!!! Thanks again for making my day!
ptrkhh, did you by any chance figure out how to configure the power and volume buttons???
For now I'm using volume up button to turn the tablet on and off and the power button to turn the volume down.
Fan-damn-tastic!!!
Like the other person above, I made an account just to express my EXTREME gratitude for the amazing work that was done.
I just got myself a surface book for dirt cheap, fantastic device, horrible OS. I'm not one to shy away from randomly screwing with things, so on my research for windows 8 installs for the Book, I found this absolute GEM of a post.
Downloaded the image, and threw it on my Surface Book and here's what happened:
a) installed flawlessly
b) activated instantly
c) everything that works on the Pro, works on the book. The keyboard and mouse work too!!!
d) The BIG one... the DETACH...... IT WORKS!!! Hold the detach button like normal, and, granted it seems to take a second or so longer than it did on Win10, but it releases JUST fine.
e) the dual batteries. I didn't test it for long, but Win8 seems to drain the base battery and leave the tablet battery alone.
f) the power /vol buttons do the same thing as the pro4, but i really don't care. Actually, the Book doesn't have a windows button on the tablet, so the vol down button doing that is actually a HUGE plus for me. Screw the volume controls!
g) i have not figured out the nvidia drivers yet, but i also haven't tried too hard yet. So that's a negative so far.
h) Front camera does weird infared things. It will be disabled.
I would imagine even if i get the dual gpu to work, if i start a program with the nvidia, and disconnect the screen, it will probably go all fubar and need a hard restart. The latch seems to run independently from the rest, and without software watching it, it WILL do what you tell it to, period. (my assumption, haven't tried it yet)
Battery life has not been tested much yet.
Device manager shows 2 unknown devices. I'm assuming one is the GFX card, the other one, probably the detatch button. If that's not it i have no idea. Really don't care though.
Updates pick up on new driver versions just fine. (again, so far)
I have the i5 version w/dual gfx. I have no idea what will and won't happen with the i7, the i7 with nvidia, or the newest performance base with the better nvidia gfx. I doubt much will be different, but much as I did, proceed at your own risk!
I hope this was useful, and if it was, let everyone know it works!!!!
If anyone wants, I can post an update after I finish setting it up, and had some real-life usage of it. If not, my feelings will not be hurt!
Awesome!
Works almost perfect on my Surface Pro 4.
But somehow it cannot auto rotate and the touch keyboard is not popping up (even in metro apps).
Does anybody know how to fix that?
Edit: you have to reboot and remove the keyboard before windows boots to get it working.
The OneDrive link is dead, can you get a new link? Mega isn't working for me
Would this work on a surface 3?
Surface pro 4 BSOD
Hi, I have the i5 version surface pro 4 and when i use the image above or a fresh copy of windows 8.1 pro it finishes installing then blue screens with internal power error. Any ideas as to get past this.
Cheers
I have the same problem.
When it finishes installing, I get a blue screen saying there is a problem with the BCD. I tried booting with a Windows 10 ISO to use the startup repair tool to fix it, but it says it can't. I've tried it 3 or 4 times; it did work once, but I wanted to try a different Windows, so I wiped it. Now I can't get it to work again. I did all the diskpart stuff, and the apply, all seemed to work until final boot = bsod. The apply.cmd is supposed to do the configuring, I think. Anybody else had this problem?
Surface Pro 4 factory restore
Hi" have you tried going to the Microsoft site and downloading the factory image. Just take the ISO and make into USB bootable. It will install everything and recreate all partions. Hope this helps.
Does anyone know If this will work on Surface pro 6????
I ran into an issue with my Surface pro 6 that gives me the BSOD every time I connect my type cover!!! I tried everything! I ran all the diagnostics and went through almost every safe steps and was able to fix the corrupted files. I even did all the driver diagnostics!!! It is very frustrating because I even did a factory reset and I'm still having the same issue... I'm hoping to be able to safely downgrade to Windows 8.1 to see if it fixes the issue, then upgrading to Windows 10 again. That's the last thing I can think of.
Does it work on SP4 2017???
I have the same problem.
When I tried to install this ROM on my Surface pro 4 2017, it gives me the BSOD.
Commands do not work, it says right no the first: "The system cannot find the path specified"
i also have the same problem on my surface pro 6
How to install a version of 8.1 on SP4-SP6
If you get that INTERNAL_POWER_ERROR, you most likely have a Kaby Lake processer which only supports Windows 10. The only version of 8.1 that works on a Kaby Lake Surface Pro 4+ is Windows Server 2012 R2.
asking for drivers
ptrkhh said:
For those of you missing Windows 8.1, congratulations, you just found the solution.
Features
1.Windows is fully updated as of February 2016.
2.Surface February update included (solves most speaker popping issue)
3.Based on Surface Pro 3 image. Full stock-like Surface branding (desktop background, out-of-box experience).
4.Windows activates with the embedded product key. Fully legit. I cannot guarantee if yours couldn’t activate though.
5.Bloat free with about 3 GB saving: (Microsoft devices are shipped bloat-free? Think again.) | Only 6 metro apps included (Camera, IE, OneDrive, PC Settings, Photos, Store). The rest can be downloaded from Store | Trial Office removed | Speech data removed.
6.Languages included: English, French, Spanish. Since it is Windows 8 Pro, you can download any other language later.
7.Fully working refresh and reset functionality.
8.WinRE from vanilla Windows, touchscreen driver included.
9.Pagefile takes less space: 400 MB. It can grow to up to 8 GB, a reboot brings it back to 400 MB.
10.Various Windows tweaks | File Indexing paused on battery | Verbose messages, you get more information in boots and shutdowns | No startup programs delay | non-certified DLNA devices are supported | Custom resolution script added (open C: drive, its there. Just double click.) | "Get Windows 10" system tray icon disabled.
11.Some drivers from S3, SP3, SP4, and other OEM devices (kudos to them for releasing their Skylake devices with Windows 8.1 drivers).
12.Latest Intel iGPU driver (version 4380 Beta).
NOT working
1.Windows Hello. As expected, Windows 8.1 does not support Windows Hello.
2.The buttons are mapped differently | Power --> Volume Down | Volume Up --> Power | Volume Down --> Start
3.Surface app | You cant adjust pen sensitivity | You can't configure the pen top button action through the app. You can still customize it manually with AHK.
FAQ
Q: Camera app crashes / BSOD
A: You need to disable the IR camera. You can do that either via the BIOS or Device Manager.
Q: The pen button doesn't work after the first setup
A: You may need to re-pair the pen. Go to PC Settings > Bluetooth and remove the Surface Pen. Create a new pairing by pressing the pen top button for 7 seconds, it will show up on the Surface, and just pair it.
Q: How did you get the embedded Windows 10 product key to work with Windows 8.1?
A: Actually I have no idea. It just worked.
Q: Are the "not working" issues going to be fixed?
A: For the buttons, its up to Microsoft to release a Windows 8.1 compatible driver, and we have no other source as Microsoft has modified Intel's driver. If you know how to remap the buttons (either via editing the driver, Registry, or AHK), please share it with us and I will include it in the next version. For the Surface app, I believe it is simply because the Windows 8 version of Surface app was not updated for the Surface Pro 4 (and will never be), so don’t expect that one.
Q: Why did you go with the beta driver for the graphics?
A: The latest release version, 4352 and 4364, are practically unusable. I experienced blank screen in video playback and some random BSOD. No choice really.
Q: When Intel has released the new driver, do I need to wait for the next version of the ROM?
A: No, you can just download and install it yourself without waiting for me to upload an updated ROM. The new version should pop up here, download the ZIP version for Windows 8.1, and install it using the "Have Disk…" method. Step-by-step guide
Q: How do I remap the pen buttons manually?
A: Go browse /r/Surface in Reddit, they have comprehensive guides on how to use AHK with the Surface Pen.
Q: Do I need to wait for your next ROM to get Windows updated?
A: No, you can just update normally via Windows Update
Q: You idiotic luddites should just upgrade to Windows 10 rather than shoehorning Windows 8 to the cutting-edge device that clearly does not deserve the old, ****ty Windows 8. Also, I am a Windows 10 fanboy.
A: Before you get angry and all that, I actually *do* want to upgrade to Windows 10. I mean, how cool is that to login with your face? However, it is hampered by quite a lot ergonomic usability issues, bugs, and the general quirkiness of Tablet Mode. As of today, Tablet Mode is nowhere near final. Not even the Task View has proper animation in Tablet Mode, it already tells how half-assed the Tablet Mode is.
How to install
BACKUP BACKUP BACKUP!!! This will format the entire disk. No data will be preserved! Its also advised to remove the microSD card during the process.
0. Get a keyboard and USB hub if you don’t have the Type Cover.
1. Download and extract the package
2. Set up the ISO image on a CD or USB stick. If you use Rufus, set it on "MBR for UEFI computer" (only for the USB stick, the Surface will be set up as GPT)
3. Boot it on the Surface
4. Enter cd /d D:\scripts
5. Enter diskpart /s part.txt
6. Enter apply D:\Images\install.wim D:\Images\winre.wim
7. You can repeat the step #6 just to be sure
8. Reboot, unplug the USB stick.
Click to expand...
Click to collapse
Dear ptrkhh,
Thank you very much. Without your excellent work, people can still not use SP4 installing Windows 8.1 or even Server 2012(based on Windows 8.1 framwork and also working with Windows 8.1drivers). Because there are many versions of both Windows 8.1 or even Server 2012, I was tring to collect the drivers that SP4 can work.It is hard to find touchscreen driver from vanilla Windows, and there so many drivers to test from S3,SP3,OEM. Could you please share the Surface Pro 4 drivers for Windows 8.1 separately, or give us a guide to lead to download each drivers. Hope you have a nice day
repo006 said:
Dear ptrkhh,
Thank you very much. Without your excellent work, people can still not use SP4 installing Windows 8.1 or even Server 2012(based on Windows 8.1 framwork and also working with Windows 8.1drivers). Because there are many versions of both Windows 8.1 or even Server 2012, I was tring to collect the drivers that SP4 can work.It is hard to find touchscreen driver from vanilla Windows, and there so many drivers to test from S3,SP3,OEM. Could you please share the Surface Pro 4 drivers for Windows 8.1 separately, or give us a guide to lead to download each drivers. Hope you have a nice day
Click to expand...
Click to collapse
Hi, thank you, it means a lot to me. Unfortunately I no longer have the device nor copies of the driver. Quite surprisingly many drivers are actually available online, you may want to consider using the software called "Snappy Driver Installer" (SDI), it is able to find drivers suitable for your device. The ones I formulated myself are under the folder "bastard drivers.rar", which is not many if I remember correctly.
For the touchscreen functionality in particular, it needs the graphics driver. Once you have the graphics driver installed, touchscreen should work instantly.
How much free ram is there after a fresh install?
I have ram shortage issues in Win10 with my 4GB Pro4. I'm not a fan of Win10 either but I sure wish I could just disable crap and free up the ram instead of downgrading.
Does the front webcam and mic work ok? I use mine frequently. Thanks!

Bosch Emulator On Jailbroken Windows 8.1 RT?

I've jailbroken my Surface 2 running Windows 8.1 RT and have started downloading and using apps, it's so much better, although I did think they'd install but they just run like portable apps, is that how it's supposed to be?
But that aside, my main query is what's the easiest way to achieve a full operating system on Windows RT? I've downloaded Bosch emulator because it's still being developed whereas QEmu isn't. I installed Bosch on my Surface and downloaded the Linux disk image from http://bochs.sourceforge.net/diskimages.html
Now from here how do I make the emulator run it? I've gone to the start menu, edited the 'Disk & Boot' option to enable ATA Channel 0, checked 'Enable this device' on First HD/CD on channel 0' and browsed to the downloaded .img file to input into the 'Path or physical device name'.
Then once I click Start I get a Panic popup with the message: couldn't open ROM image file'(null)/B....
Anybody else experienced this and have a way around it? I would have thought seeing as I downloaded the file from their website it would be fine.
If no-one has experienced this or has a fix, is there an easier way to emulate a full system?
Thank you
Jailbreak Windows RT on Surface? How?
Like this
banjax said:
Jailbreak Windows RT on Surface? How?
Click to expand...
Click to collapse
http://forum.xda-developers.com/win...ent/windows-8-1-rt-jailbreak-exploit-t3226835

Categories

Resources