Not all FFU Loaders are created equal

Hidden and useful functionality present in the flashing application of Windows Phone test images

This article is about a niche subject, Windows Phones for a start, but also functionality present only in some prototype windows phone devices. You have been warned.

Turns out FFU Loader does still have secrets to this day. For those who do not know, FFU Loader is the name of a boot application part of the Windows Phone operating system designed to allow users and ISVs/IHVs to reflash windows phone devices with new software/firmware builds, built as FFU files.

It looks like this on your device:

The official tool that connects to this boot efi application using USB is called ffutool.exe, and it provides a few commands, among which, the ability to flash a specified ffu to a connected device, set boot modes (a feature supported only from TH2 builds of Windows phone and onwards), and enter mass storage (only supported on test devices).

One may think that the official tool would support every command and functionality ffu loader offers, and thus would think that ffu loader only allows writing ffu files, rebooting, or enterring mass storage for the few test devices where thats supported. But that's not the case.

I discovered extra commands while reversing this protocol for my own automation needs. Those commands are only present in the code of ffu loader efis part of test windows phone image variants. And I never realized in the past ffu loader was different between TEST windows phone variants and PRODUCTION windows phone variants. For those who do not know windows phone has many image variants, the normal one being PRODUCTION, used on all retail devices, and others designed for selfhost, testing, or lab purposes.

...And some of these commands are even useful!

Among which: the ability to freely read any part of the device storage, the ability to freely write to any part of the device storage, boot any arbitrary wim file. Many useful features for people like me who are either developping on test devices or backing up devices, restoring, etc... This is especially useful when you consider that not all Windows phone devices are Nokia devices and thus do not have Nokia's excellent flashing efi application that features a lot of useful debug functionality for developers.

I implemented a working PoC to dump the storage of any prototype/test Windows Phone while in FFU loader, you can find it here

Turns out FFU loader is not as useless as I thought... The more I know; I assume this was not discovered for the past 14 years either, at least, I never heard of this.