MRE (MAUI Runtime Environment) is a phone application development platform similar to JVM and Brew. On the MRE platform, you can realize solutions for smart featuer phones on feature phones. Meanwhile, MediaTek also provides devlopers and end suppliers with highly efficient development tools (MRE SDK) and compilation environment for applications, allowing developers to develop applications more quickly and effectively.
MRE's executable file has the extension
vxp (I don't know that it stands for).
The problem is, MRE SDK isn't supported anymore (people have claim here that it's a market failure on S30+ platform), and the website, including the SDK, documentation, forum, disscussion and other things were totally deleted from the Internet (Wayback Machine archived some of the pages but not all).
I myself got a Nokia 220 and a Nokia 225, both are S30+ platform and run MRE VXP (I tried with J2ME jar file and it cannot run, says
can't open this file type)
I copy the
vxp file to my SD card, plug it in the phone, then open the vxp file. The application refused to run, says
can't open this app at the moment. I tried other resolution in the SDK, other SDK version (they have SDK 1.0, 2.0 and 3.0), using different compiler (GCC), and it still doesn't run.
Check my vxp file with
file, it outputs
Default.vxp: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /usr/lib/ld.so.1, not stripped, but I don't know how to make it statically linked, even passing
-static option to GCC doesn't work. (Maybe the problem is here)
I found there are some
vxp store online (most are
*.xtgem.com, I don't know why), for example http://shifat100.xtgem.com. I tried downloading some vxp files, put it onto my SD card and run it. Some apps work, while some don't. Some apps work for Nokia 220 but not work on Nokia 225, for example the Advengers VXP works on Nokia 220 but not on Nokia 225 (Nokia 225 has bigger screen, so I think app resolution is the problem)
Anyway, MRE SDK has an
Auto adaptable option for screen resolution.
The Opera Mini VXP works on both of my phones.
I noticed that most of the VXP for Nokia are made by Gameloft - a game company.
I tried opening the Asphalt VXP and that Opera Mini VXP on HxD editor and to my surprise, they are in different formats:
On the left is the Opera Mini VXP, which is in ELF format, on the right is the Asphalt VXP (developed by Gameloft) in unknown format, but the
x at the beginning tells me it might be compressed by zlib.
Asphalt 6 Full Version.vxp: zlib compressed data
ERROR: Asphalt 6 Full Version.vxp : Can not open the file as archive
strings shows some interesting result
python -m binwalk -B "Asphalt 6 Full Version.vxp" DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 Zlib compressed data, best compression 123284 0x1E194 Zlib compressed data, best compression 278441 0x43FA9 GIF image data, version "89a", 45 x 45 281257 0x44AA9 GIF image data, version "89a", 45 x 45
After extracting the files, I got 2 icon files, which seems correct for that game
and 2 files extracted from 2
Zlib compressed data, using
file on 2 files output the file type
python -m binwalk -B -A for the first file at offset 0 shows many ARM instructions (which seems to be reasonable since the phone was based on Mediatek ARM chip).
I tried loaded it into IDA, but since I don't know the start address, it's really hard to get where the entry point is.
strings also shows interesting things. Things start with
vm_app_log vm_cell_open vm_cell_close vm_cell_get_cur_cell_info vm_cell_get_nbr_cell_info vm_cell_get_nbr_num
are some standart MRE API calls while things like
Unknown signal Invalid Operation Divide By Zero Overflow Underflow Inexact Result : Heap memory corrupted Abnormal termination Arithmetic exception: Illegal instruction Interrupt received Illegal address Termination request Stack overflow Redirect: can't open: Out of heap memory User-defined signal 1 User-defined signal 2 Pure virtual fn called C++ library exception
seems to be runtime error messages.
strings on the file at 1E194 suggests that this might be a resource file, but note that strings in that file are also existed in the original VXP file without extracting (is binwalk wrong?)
Back to Opera Mini VXP, this is an ELF file, shows by
OperaMini4.4.V32206.vxp: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, stripped.
Try loading it into IDA, it seems unreasonable since the main function goes nowhere. I also not sure what is
If I patch any path of the file, for example change a character in a resource string (but still remains the same size as the original), it will output
can't open this app at the moment.
I have read here that the applications which runs on Nokia S30+ will need to be signed. If that's true, that will explain why patching doesn't work.
Can you figure out informations about the MRE VXP format, how to get it signed, and how to run self developed MRE app on Nokia phones? Thanks!
I am also trying reversing the phone's firmware to find out how
vxp file loaded and executed. After doing some Google Search I found some example firmware source code for the MAUI platform (you can think of it like an OS), like this repo, but I cannot find out how it load vxp files.
If anyone is also interested in reversing this firmware, tell me and I will open a new post :)