5

Background

Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page:

MRE (MAUI Runtime Environment) is a phone application development platform similar to JVM and Brew. On the MRE platform, you can realize solutions for smart featuer phones on feature phones. Meanwhile, MediaTek also provides devlopers and end suppliers with highly efficient development tools (MRE SDK) and compilation environment for applications, allowing developers to develop applications more quickly and effectively.

MRE's executable file has the extension vxp (I don't know that it stands for).

The problem is, MRE SDK isn't supported anymore (people have claim here that it's a market failure on S30+ platform), and the website, including the SDK, documentation, forum, disscussion and other things were totally deleted from the Internet (Wayback Machine archived some of the pages but not all).

I myself got a Nokia 220 and a Nokia 225, both are S30+ platform and run MRE VXP (I tried with J2ME jar file and it cannot run, says can't open this file type)

Luckily, using this man's copy of MRE SDK 3.0, and using ARM RVDS, I was able to compile a simple 'Hello World' application for MRE (you can download it here).

Problems

I copy the vxp file to my SD card, plug it in the phone, then open the vxp file. The application refused to run, says can't open this app at the moment. I tried other resolution in the SDK, other SDK version (they have SDK 1.0, 2.0 and 3.0), using different compiler (GCC), and it still doesn't run.

Check my vxp file with file, it outputs Default.vxp: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /usr/lib/ld.so.1, not stripped, but I don't know how to make it statically linked, even passing -static option to GCC doesn't work. (Maybe the problem is here)

Other vxp apps

I found there are some vxp store online (most are *.xtgem.com, I don't know why), for example http://shifat100.xtgem.com. I tried downloading some vxp files, put it onto my SD card and run it. Some apps work, while some don't. Some apps work for Nokia 220 but not work on Nokia 225, for example the Advengers VXP works on Nokia 220 but not on Nokia 225 (Nokia 225 has bigger screen, so I think app resolution is the problem)

Anyway, MRE SDK has an Auto adaptable option for screen resolution.

mre

The Opera Mini VXP works on both of my phones.

I noticed that most of the VXP for Nokia are made by Gameloft - a game company.

File format

I tried opening the Asphalt VXP and that Opera Mini VXP on HxD editor and to my surprise, they are in different formats: vxp

On the left is the Opera Mini VXP, which is in ELF format, on the right is the Asphalt VXP (developed by Gameloft) in unknown format, but the x at the beginning tells me it might be compressed by zlib.

Tried with file: Asphalt 6 Full Version.vxp: zlib compressed data Tried with 7z l: ERROR: Asphalt 6 Full Version.vxp : Can not open the file as archive

Using strings shows some interesting result

Using binwalk:

python -m binwalk -B "Asphalt 6 Full Version.vxp"

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zlib compressed data, best compression
123284        0x1E194         Zlib compressed data, best compression
278441        0x43FA9         GIF image data, version "89a", 45 x 45
281257        0x44AA9         GIF image data, version "89a", 45 x 45

After extracting the files, I got 2 icon files, which seems correct for that game

icon files

and 2 files extracted from 2 Zlib compressed data, using file on 2 files output the file type data. Using python -m binwalk -B -A for the first file at offset 0 shows many ARM instructions (which seems to be reasonable since the phone was based on Mediatek ARM chip).

I tried loaded it into IDA, but since I don't know the start address, it's really hard to get where the entry point is.

Using strings also shows interesting things. Things start with vm_ like

vm_app_log
vm_cell_open
vm_cell_close
vm_cell_get_cur_cell_info
vm_cell_get_nbr_cell_info
vm_cell_get_nbr_num

are some standart MRE API calls while things like

Unknown signal
Invalid Operation
Divide By Zero
Overflow
Underflow
Inexact Result
: Heap memory corrupted
Abnormal termination
Arithmetic exception: 
Illegal instruction
Interrupt received
Illegal address
Termination request
Stack overflow
Redirect: can't open: 
Out of heap memory
User-defined signal 1
User-defined signal 2
Pure virtual fn called
C++ library exception

seems to be runtime error messages.

Using strings on the file at 1E194 suggests that this might be a resource file, but note that strings in that file are also existed in the original VXP file without extracting (is binwalk wrong?)

Back to Opera Mini VXP, this is an ELF file, shows by file: OperaMini4.4.V32206.vxp: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, stripped.

Try loading it into IDA, it seems unreasonable since the main function goes nowhere. I also not sure what is supervisor call

ida

If I patch any path of the file, for example change a character in a resource string (but still remains the same size as the original), it will output can't open this app at the moment.

I have read here that the applications which runs on Nokia S30+ will need to be signed. If that's true, that will explain why patching doesn't work.

Can you figure out informations about the MRE VXP format, how to get it signed, and how to run self developed MRE app on Nokia phones? Thanks!

Notes

I am also trying reversing the phone's firmware to find out how vxp file loaded and executed. After doing some Google Search I found some example firmware source code for the MAUI platform (you can think of it like an OS), like this repo, but I cannot find out how it load vxp files.

If anyone is also interested in reversing this firmware, tell me and I will open a new post :)

7
  • 1
    Here is my question of StackOverflow about this topic
    – raspiduino
    Jun 10 at 2:49
  • 2
    Nice! This is how a good question looks like - just has the right information to follow through!
    – sudhackar
    Jun 19 at 13:14
  • 1
    But no one answer it :)) Thanks for taking a look at this question anyway
    – raspiduino
    Jun 19 at 13:57
  • 2
    Its a pretty niche area. Its only been 11 days and 26 views. I'll start a bounty to get more visibility on this.
    – sudhackar
    Jun 20 at 7:23
  • Ok I'm reversing the Phone's firmware to see how the vxp loaded and executed :))
    – raspiduino
    Jun 21 at 8:15

1 Answer 1

0

First I want to say thanks to people at 4pda forum. See their thread here.

Can you figure out informations about the MRE VXP format

Well I haven't found yet, need further research

how to get it signed

Short answer:

Step 1: Get your SIM 1's IMSI number (NOT IMEI, they are DIFFERENT!)

You can do this in multiple ways, but the easiest way is to plug the SIM 1 in to an Android phone and read. I personally use ADB to read IMSI (worked on Android 6+ without root):

adb shell service call iphonesubinfo 7

Step 2: Go to https://vxpatch.luxferre.top/ and input the IMSI number you got in step 1. Then select your VXP file, click 'Patch' and you should be able to download a patched version.

or

You can enter the IMSI number in the project setting, but REMEMBER TO ADD 9 BEFORE THE IMSI NUMBER

imsi

Step 3: Move the patched version into a SD card and plug it in your phone Step 4: Find the vxp file and click open, your app should run now!

Long answer: Some apps doesn't require specify the IMSI, they just work on any devices. That's because they use another way of signing, using RSA key.

If you are interested, read here. The text is in Russian, so use Google Translate if you want to.

I have tested with ADS 1.2 compiler (I cracked myself, if you want it then tell me) and GCC (Smaller size + work very well) and Nokia 225, will continue to test further!

The apps in S30+ platform are written in C (and optionally C++), so you can port many apps to S30+

Again, a great thanks to people at 4pda forum!

An image of the app running after signing:

image of the app

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.