[GH-ISSUE #3612] [Feature] Symbian OS application reverse engineering: SIS/SISX package extraction, E32Image binary analysis, and Symbian C++ idiom recovery #1342

New issue

Open

opened 2026-10-16 21:04:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:29 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3612

Summary

Symbian OS (spanning EPOC, Series 60 / S60 v1-v5, UIQ, Series 80, and Symbian^3 / Anna / Belle) powers a vast historical ecosystem of mobile software, utilities, games, and enterprise tools. While official online services and vendor signing portals have ceased operations, the Symbian platform remains actively analyzed in retro-computing, digital preservation, embedded systems research, and mobile software forensics.

Currently, REA has no support for Symbian application containers, binary formats, or OS-specific C++ conventions. This feature introduces dedicated static reverse engineering capabilities for Symbian OS applications: unpacking .sis and .sisx package archives, parsing and loading E32Image executables/DLLs in Ghidra and Rizin, and reconstructing Symbian-specific architectural idioms (Cleanup Stack, Active Objects, Descriptors, and Capability security manifests).

Technical Capabilities

1. Package Unpacking & Manifest Analysis (.sis and .sisx)

Legacy SIS (Symbian v6–v8.x): Parse EPOC SIS archive headers, file records, language tables, and target drive mappings (!:\system\apps\).
SISX / SIS9 (Symbian OS v9+):
- Parse the PKCS#7 signed SISX container, extracting embedded certificates, signatures, and trust chains.
- Extract package metadata: Package UID, Vendor Name, Target Device / S60 SDK compatibility ranges, and localized install manifests.
- Extract target file trees (e.g. !:\sys\bin\*.exe, !:\resource\apps\*.rsc, !:\private\<SID>\).
- Map Capability Manifests: parse declared capabilities (e.g. NetworkServices, LocalServices, ReadUserData, WriteUserData, UserEnvironment, DiskAdmin, AllFiles, TCB) required by the application.

2. E32Image Executable & DLL Analysis (EPOC32)

E32 Header & Metadata Parsing:
- Extract UID1 (binary type: EXE, DLL), UID2 (interface/category), and UID3 (application identifier).
- Extract Secure ID (SID), Vendor ID (VID), and runtime capability bitmasks.
- Identify target CPU architecture: ARM (ARMv5TE, ARMv6) and x86 emulator builds (WINS/WINSCW).
Decompression: Support native decompression of Byte-Pair Compressed (BPC / inflate) E32 images to produce raw code and data sections.
Import / Export Resolution:
- Symbian links by ordinal rather than function name. Implement ordinal-to-symbol mapping tables for core Symbian OS shared libraries (euser.dll, apparc.dll, cone.dll, eikcore.dll, avkon.dll, bafl.dll, efsrv.dll).
- Resolve import address tables (IAT) and virtual function table (vtable) layouts.
Headless Provider Integration: Automatically load unpacked E32 binaries into Ghidra and Rizin with accurate base addresses, section relocations, and system library ordinal annotations.

3. Symbian C++ Idiom & Pattern Recovery

CBase & Object Lifecycles: Identify classes inheriting from CBase (heap-allocated, zero-initialized on creation, virtual destructors).
Cleanup Stack & Leaving Semantics: Recognize CleanupStack::PushL(), CleanupStack::PopAndDestroy(), and identify Leave points (User::LeaveIfError(), User::Leave()) to reconstruct exception control flow graphs.
Active Objects (Asynchronous Event Loop): Identify classes derived from CActive, mapping TRequestStatus asynchronous service providers, SetActive(), RunL() event handlers, and DoCancel() compensation logic.
Descriptors & String Buffers: Recognize and decode Symbian string descriptor types (TDesC8/TDesC16, TPtrC, HBufC, TBuf) into readable string literals.

4. Resource & Graphical Asset Extraction

Compiled Resource Files (.rsc): Parse binary resource files (.rsc, .r01, .r02, etc.) containing UI dialogs, menu bars, strings, and localized application text.
Image Containers (.mif and .mbm): Extract multi-bitmap (.mbm) and multi-image vector/SVG (.mif) icons and graphics.
Application Information Files (.aif): Parse legacy AIF containers to extract app captions and icon bitmaps.

Acceptance Criteria

Introduce analyze_symbian_application in REA CLI and MCP contracts, accepting .sis, .sisx, .app, and .exe inputs.
Accurately unpack file entries and report declared capabilities from S60 v3/v5 .sisx packages.
Decompress and parse BPC-compressed E32Image binaries into valid ELF/raw sections with resolved core ordinals in Ghidra/Rizin.
Reconstruct Active Object event loops and identify CActive::RunL callbacks in structured evidence.
Provide unit and regression tests with synthetic/open-source Symbian test fixtures.

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3612 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Symbian OS (spanning EPOC, Series 60 / S60 v1-v5, UIQ, Series 80, and Symbian^3 / Anna / Belle) powers a vast historical ecosystem of mobile software, utilities, games, and enterprise tools. While official online services and vendor signing portals have ceased operations, the Symbian platform remains actively analyzed in retro-computing, digital preservation, embedded systems research, and mobile software forensics. Currently, REA has no support for Symbian application containers, binary formats, or OS-specific C++ conventions. This feature introduces dedicated static reverse engineering capabilities for Symbian OS applications: unpacking `.sis` and `.sisx` package archives, parsing and loading E32Image executables/DLLs in Ghidra and Rizin, and reconstructing Symbian-specific architectural idioms (Cleanup Stack, Active Objects, Descriptors, and Capability security manifests). --- ## Technical Capabilities ### 1. Package Unpacking & Manifest Analysis (.sis and .sisx) - **Legacy SIS (Symbian v6–v8.x):** Parse EPOC SIS archive headers, file records, language tables, and target drive mappings (`!:\system\apps\`). - **SISX / SIS9 (Symbian OS v9+):** - Parse the PKCS#7 signed SISX container, extracting embedded certificates, signatures, and trust chains. - Extract package metadata: Package UID, Vendor Name, Target Device / S60 SDK compatibility ranges, and localized install manifests. - Extract target file trees (e.g. `!:\sys\bin\*.exe`, `!:\resource\apps\*.rsc`, `!:\private\<SID>\`). - Map Capability Manifests: parse declared capabilities (e.g. `NetworkServices`, `LocalServices`, `ReadUserData`, `WriteUserData`, `UserEnvironment`, `DiskAdmin`, `AllFiles`, `TCB`) required by the application. ### 2. E32Image Executable & DLL Analysis (EPOC32) - **E32 Header & Metadata Parsing:** - Extract UID1 (binary type: EXE, DLL), UID2 (interface/category), and UID3 (application identifier). - Extract Secure ID (SID), Vendor ID (VID), and runtime capability bitmasks. - Identify target CPU architecture: ARM (ARMv5TE, ARMv6) and x86 emulator builds (WINS/WINSCW). - **Decompression:** Support native decompression of Byte-Pair Compressed (BPC / inflate) E32 images to produce raw code and data sections. - **Import / Export Resolution:** - Symbian links by ordinal rather than function name. Implement ordinal-to-symbol mapping tables for core Symbian OS shared libraries (`euser.dll`, `apparc.dll`, `cone.dll`, `eikcore.dll`, `avkon.dll`, `bafl.dll`, `efsrv.dll`). - Resolve import address tables (IAT) and virtual function table (vtable) layouts. - **Headless Provider Integration:** Automatically load unpacked E32 binaries into Ghidra and Rizin with accurate base addresses, section relocations, and system library ordinal annotations. ### 3. Symbian C++ Idiom & Pattern Recovery - **CBase & Object Lifecycles:** Identify classes inheriting from `CBase` (heap-allocated, zero-initialized on creation, virtual destructors). - **Cleanup Stack & Leaving Semantics:** Recognize `CleanupStack::PushL()`, `CleanupStack::PopAndDestroy()`, and identify `Leave` points (`User::LeaveIfError()`, `User::Leave()`) to reconstruct exception control flow graphs. - **Active Objects (Asynchronous Event Loop):** Identify classes derived from `CActive`, mapping `TRequestStatus` asynchronous service providers, `SetActive()`, `RunL()` event handlers, and `DoCancel()` compensation logic. - **Descriptors & String Buffers:** Recognize and decode Symbian string descriptor types (`TDesC8`/`TDesC16`, `TPtrC`, `HBufC`, `TBuf`) into readable string literals. ### 4. Resource & Graphical Asset Extraction - **Compiled Resource Files (.rsc):** Parse binary resource files (`.rsc`, `.r01`, `.r02`, etc.) containing UI dialogs, menu bars, strings, and localized application text. - **Image Containers (.mif and .mbm):** Extract multi-bitmap (`.mbm`) and multi-image vector/SVG (`.mif`) icons and graphics. - **Application Information Files (.aif):** Parse legacy AIF containers to extract app captions and icon bitmaps. --- ## Acceptance Criteria 1. Introduce `analyze_symbian_application` in REA CLI and MCP contracts, accepting `.sis`, `.sisx`, `.app`, and `.exe` inputs. 2. Accurately unpack file entries and report declared capabilities from S60 v3/v5 `.sisx` packages. 3. Decompress and parse BPC-compressed E32Image binaries into valid ELF/raw sections with resolved core ordinals in Ghidra/Rizin. 4. Reconstruct Active Object event loops and identify `CActive::RunL` callbacks in structured evidence. 5. Provide unit and regression tests with synthetic/open-source Symbian test fixtures.

bsakaguchi referenced this issue

2026-10-17 21:10:33 +00:00

[PR #1342] [CLOSED] feat(ghidra): admit native x86 and x86-64 PE DLLs on Windows #2811

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1342

No description provided.

Rows
Columns