A peek inside the N-Gage first access SIS file
Introduction
Quite recently, Nokia invited people to install a beta version of the N-Gage app on their N81:s, to try out the platform. I don't have an N81, so I'm not supposed to be able to try out N-Gage just yet, but someone found out that the "protection" was very much on the surface. So I managed to run it on my old N93, which is one of the supported phones, and my 6120, which is not. To verify my theory on why this worked, I did some digging, using sisinfo.py.
The SIS file distributed by Nokia, first_access_n-gage_v1.00_1262.sisx, contains another SIS file, n-gage.sisx, as well as an executable, NGageInstaller_0x2000A2AE.exe, and its associated resources. When you've installed the first access SIS file, you can start the installer app, which will in turn install n-gage.sisx. I guess the installer app simply checks what device you're using, and if it's not an N81, it'll tell you that "Device is not compatible with N-Gage" (yes, that's a quote from the resource file for the installer app).
So, basically, all you have to do to "hack" the protection and install the N-Gage app on your S60 3rd ed. phone is to extract n-gage.sisx from the installer SIS (using one of several freely available tools) and install it on your phone. You'll get a warning if your phone isn't one of the supported ones (see below), but there's no problem installing and running it.
However, I couldn't run the actual games on the 6120, so there might be an extra check in the games themselves or (more likely) in the N-Gage app. Or maybe it just happens to not work on this device, for some reason.
A closer look
Unpacking first_access_n-gage_v1.00_1262.sisx
If it hadn't been for the fact that my ISP (hello, Comhem!) decided to break my internet connection this weekend, I might not have taken the time to do this, but it also led to some problems (like not being able to use any web resources while digging around). The first one, that almost had me giving up, was sisinfo.py choking on the SIS file. Either the quite old version of the tool that I had installed is broken, or the SIS file is, I don't know, because I'm not very familiar with the SIS file format or Python. Anyway, I managed to add some evasive maneuvers to the tool, and then it would (grudgingly) accept the file.
The following files are contained in it:
| File | Description |
| NGageInstaller_0x2000A2AE.exe | Installer executable |
| NGageInstaller_0x2000A2AE.mif | Icon for same |
| NGageInstaller_0x2000A2AE.r01 | English language resource file |
| NGageInstaller_0x2000A2AE.r02 | More language resources... |
| NGageInstaller_0x2000A2AE.r03 | |
| NGageInstaller_0x2000A2AE.r04 | |
| NGageInstaller_0x2000A2AE.r05 | |
| NGageInstaller_0x2000A2AE.r29 | |
| NGageInstaller_0x2000A2AE.r31 | |
| NGageInstaller_0x2000A2AE_reg.rsc | the usual _reg.rsc file |
| n-gage.sisx | The actual N-Gage app and runtime |
| webkit_table.dat | ??? |
So, nothing strange there, except that last file, which I have no idea what it is. It's very small, and just contains a few UID:s and some other figures.
Examining the contents of n-gage.sisx
n-gage.sisx is 6.3MB, and is loaded with nerd candy.
Supported handsets
The handsets that are set as supported in the SIS file are:
| String | UID |
| N73 | 0x200005fb |
| N81 | 0x20002d83 |
| N93 | 0x20000600 |
| N93i | 0x20000605 |
| N95 | 0x2000060b |
| N95i | 0x20002d84 |
| 32M (N78) | 0x20002d81 |
| 32L (N96) | 0x20002d82 |
All this means is that you'll get a warning about your device being unsupported when you install the SIS file on some other phone, so unless there's some other mechanism in place to prevent you from using other handsets, you should be able to run N-Gage on any S60 3rd ed. device. But, as mentioned above, I haven't been able to run any games on the 6120.
Capabilities of binaries
All the DLL:s and executables have the same set of capabilities:
- PowerMgmt
- MultimediaDD
- ReadDeviceData
- WriteDeviceData
- TrustedUI
- ProtServ
- NetworkControl
- SwEvent
- NetworkServices
- LocalServices
- ReadUserData
- WriteUserData
- Location
- SurroundingsDD
- UserEnvironment
Now, that's a rich set of capabilities, isn't it? And as I said, all the executables have these capabilities set. I shouldn't have to mention the security implications of having more powerful capabilities than you actually need. (No, I don't think all these are necessary in all of the 10 executable files included in the SIS.)
I'm sure anyone who knows anything about the basic concepts of platform security would realize how absurd it is to have all those capabilities set on a recognizer... Basically, it seems they've decided that it'd be too much trouble to determine the smallest possible set of capabilities for each binary and actually get the whole thing to run properly. I don't really know what conclusions to draw from this, but apparently the security culture at Nokia isn't very well developed. Security is one of those things that may not seem important, compared to new features and keeping deadlines, which is why it often gets neglected. It's still a bit surprising that they do this, because it sets a bad example for third party developers. If it's too difficult to assign proper capabilities if you work inside Nokia, how are external developers supposed to cope with it?
Flash UI
When I found a bunch of .swf files, I thought I had discovered why the N-Gage app was so slow in starting, and why the UI felt so unresponsive: the app uses FlashLite for its GUI. Well, it turns out I wasn't quite right. It's only the rightmost tab in the main menu that uses FlashLite, and I guess this is the reason why it takes several seconds and a garbled screen to get to it: the FlashLite runtime has to be launched. There are also XHTML files that launch the FlashLite files, so my guess is webkit is embedded in the N-Gage app, and used to display this single FlashLite screen. I of course have no idea what's up with all this, but maybe we'll get some answers when the final version of the app is released.
I know next to nothing about Flash stuff, but at least the .swf files run in Firefox:
There are 9 .swf files in the package, but the only difference between them is that they're in different languages. When you try to interact with the Flash app in Firefox, you get this warning dialog:
I suppose the ngage protocol is what is used to communicate between the Flash UI and the N-Gage app. So it seems they've spent some resources integrating FlashLite into the app, for some reason. Maybe they're planning to migrate the whole app to a FlashLite UI.
So what is the reason why the N-Gage app takes so long to start, and why is the UI so sluggish? My first guess was that it was a J2ME midlet, but I guess it's just that it needs to load a lot of code at startup, in combination with a less successful attempt to write a cool, animated UI. They'll probably add a splash screen to the final version, which should take care of (at least parts of) the ugly startup.
Main executable
The actual N-Gage executable, that you start from the phone's menu system, is ngiplay0x20003b78.exe. It's only about 30k in size, but there are lots of DLL:s that start with "ngi", so I guess this is where the code is. And no, there are no midlets involved (all the text strings in the app are present in its resource files).
Final words
I could go on listing contents of the SIS file, but if you're interested, you might as well unpack it yourself. There are 10 EXE files and 165 (!) DLL:s in total, as well as other stuff that might be interesting to check out, if you don't have enough things to do in your spare time. I'm hoping that my internet connection will be back to working condition tomorrow, so that I won't have to keep digging through this stuff. 