Background
Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page:
MRE (MAUI Runtime Environment) is a phone application development platform similar to JVM and Brew. On the MRE platform, you can realize solutions for smart featuer phones on feature phones. Meanwhile, MediaTek also provides devlopers and end suppliers with highly efficient development tools (MRE SDK) and compilation environment for applications, allowing developers to develop applications more quickly and effectively.
MRE's executable file has the extension vxp (I don't know that it stands for).
The problem is, MRE SDK isn't supported anymore (people have claim here that it's a market failure on S30+ platform), and the website, including the SDK, documentation, forum, disscussion and other things were totally deleted from the Internet (Wayback Machine archived some of the pages but not all).
I myself got a Nokia 220 and a Nokia 225, both are S30+ platform and run MRE VXP (I tried with J2ME jar file and it cannot run, says can't open this file type)
Luckily, using this man's copy of MRE SDK 3.0, and using ARM RVDS, I was able to compile a simple 'Hello World' application for MRE (you can download it here).
Problems
I copy the vxp file to my SD card, plug it in the phone, then open the vxp file. The application refused to run, says can't open this app at the moment. I tried other resolution in the SDK, other SDK version (they have SDK 1.0, 2.0 and 3.0), using different compiler (GCC), and it still doesn't run.
Check my vxp file with file, it outputs Default.vxp: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /usr/lib/ld.so.1, not stripped, but I don't know how to make it statically linked, even passing -static option to GCC doesn't work. (Maybe the problem is here)
Other vxp apps
I found there are some vxp store online (most are *.xtgem.com, I don't know why), for example http://shifat100.xtgem.com. I tried downloading some vxp files, put it onto my SD card and run it. Some apps work, while some don't. Some apps work for Nokia 220 but not work on Nokia 225, for example the Advengers VXP works on Nokia 220 but not on Nokia 225 (Nokia 225 has bigger screen, so I think app resolution is the problem)
Anyway, MRE SDK has an Auto adaptable option for screen resolution.
The Opera Mini VXP works on both of my phones.
I noticed that most of the VXP for Nokia are made by Gameloft - a game company.
File format
I tried opening the Asphalt VXP and that Opera Mini VXP on HxD editor and to my surprise, they are in different formats:
On the left is the Opera Mini VXP, which is in ELF format, on the right is the Asphalt VXP (developed by Gameloft) in unknown format, but the x at the beginning tells me it might be compressed by zlib.
Tried with file: Asphalt 6 Full Version.vxp: zlib compressed data
Tried with 7z l: ERROR: Asphalt 6 Full Version.vxp : Can not open the file as archive
Using strings shows some interesting result
Using binwalk:
python -m binwalk -B "Asphalt 6 Full Version.vxp"
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Zlib compressed data, best compression
123284 0x1E194 Zlib compressed data, best compression
278441 0x43FA9 GIF image data, version "89a", 45 x 45
281257 0x44AA9 GIF image data, version "89a", 45 x 45
After extracting the files, I got 2 icon files, which seems correct for that game
and 2 files extracted from 2 Zlib compressed data, using file on 2 files output the file type data. Using python -m binwalk -B -A for the first file at offset 0 shows many ARM instructions (which seems to be reasonable since the phone was based on Mediatek ARM chip).
I tried loaded it into IDA, but since I don't know the start address, it's really hard to get where the entry point is.
Using strings also shows interesting things. Things start with vm_ like
vm_app_log
vm_cell_open
vm_cell_close
vm_cell_get_cur_cell_info
vm_cell_get_nbr_cell_info
vm_cell_get_nbr_num
are some standart MRE API calls while things like
Unknown signal
Invalid Operation
Divide By Zero
Overflow
Underflow
Inexact Result
: Heap memory corrupted
Abnormal termination
Arithmetic exception:
Illegal instruction
Interrupt received
Illegal address
Termination request
Stack overflow
Redirect: can't open:
Out of heap memory
User-defined signal 1
User-defined signal 2
Pure virtual fn called
C++ library exception
seems to be runtime error messages.
Using strings on the file at 1E194 suggests that this might be a resource file, but note that strings in that file are also existed in the original VXP file without extracting (is binwalk wrong?)
Back to Opera Mini VXP, this is an ELF file, shows by file: OperaMini4.4.V32206.vxp: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, stripped.
Try loading it into IDA, it seems unreasonable since the main function goes nowhere. I also not sure what is supervisor call
If I patch any path of the file, for example change a character in a resource string (but still remains the same size as the original), it will output can't open this app at the moment.
I have read here that the applications which runs on Nokia S30+ will need to be signed. If that's true, that will explain why patching doesn't work.
Can you figure out informations about the MRE VXP format, how to get it signed, and how to run self developed MRE app on Nokia phones? Thanks!
Notes
I am also trying reversing the phone's firmware to find out how vxp file loaded and executed. After doing some Google Search I found some example firmware source code for the MAUI platform (you can think of it like an OS), like this repo, but I cannot find out how it load vxp files.
If anyone is also interested in reversing this firmware, tell me and I will open a new post :)
