Trojan on Symbian S60 3rd Edition

We've an interesting mobile case to report…

One of today's samples is a trojan compiled for S60 3rd Edition phones. It's detected as Trojan:SymbOS/Yxe.A.

This is something we don't see very often. There are spy tools and other privacy threats directed at S60 3rd Edition phones, but malware is still mainly an issue on S60 2nd Edition phones.

S60 3rd Edition uses a different binary structure than 2nd Edition, and then all 3rd Edition applications must be signed. What's special about Yxe is that all evidence suggests it uses a valid Symbian Certificate.

With this certificate, the trojan was signed. And being a signed application it gains privileged access.

The source of this trojan is China.

Here you can see the language options, EN and ZH:


Did you also notice the "Sexy View" and "Play Boy"? That should give you a good idea of the Social Engineering that's being utilized.

Our mobile analysts are still working the case. We'll have more for you as it develops.

Subclassing List Box in Symbian OS

This article explains how to subclass a list box in Symbian OS, especially in UIQ. One reason to subclass a list box is to have our own custom list box, for example you can display a double line list box (see Figure 1a). I will focus the discussion in this article on UIQ because Series 60 has already various types of list box, for instance CAknDoubleStyleListBox, CAknSingleHeadingStyleListBox, etc. In most cases, you can use one of these classes.However, in a few cases, you might need to subclass list box in Series 60 as well.

I will start this article with the architecture of list box in Symbian and then go through how to subclass a list box. At the end of this article, I will give a simple example of custom list box and how to use it (with the complete source code).

Before reading this article, I have a small comment. If you just want to port a Series 60 application that uses CAknXXXListBox to UIQ, there is a faster way. You might consider a tool called S2U, which is able to port Series 60 user interface to UIQ (see Further Reading section at the end of this article).


Architecture of List Box in Symbian

I won't discuss the architecture of Symbian list box in more detail (read one of the references at the end of this article if you want to know more about it). Like any other components in Symbian, the list box uses MVC (Model-View-Controller) model. Figure 2 shows the MVC model of the list box in Symbian.



As you can see here, the "controller" in this MVC model is CEikListBox. This is the class that you have to create to display a list box, although usually you will use one of its derived classes, for instance CEikTextListBox, CEikColumnListBox and CEikSnakingListBox.

The "model" of the list box, i.e. MListBoxModel, stores the data of your items. Basically it allows you to get and set the items of the list box. Since MLlistBoxModel is an interface, we have to create a model using one of its derived classes, for instance CTextListBoxModel.

The "view", i.e. CListBoxView, handles all the user interface stuff and displays the list box on the screen. Like the controller and the model, there are some derived classes of CListBoxView, for example CTextListBoxView.

From the controller class, CEikListBox, you can get the model using CEikListBox::Model() and get the view using CEikListBox::View(). This why you don't need to save the instance of the model and view in your application, you need to save the instance of the controller only.


Download

Click the icon below to download the example of custom list box and how to use it.

MyListBox.zip (18 KB)

Interpreting Signing Error Messages in S60 3rd Edition

If you have been reading discussions at Forum Nokia Developer Discussion Board recently, you may notice there are many questions about signing in S60 3rd Edition. It seems the new security feature in Symbian 9 has led to frustration for some developers. I would like to share what kind of error messages I have seen when installing signed/unsigned application in S60 3rd Edition phones. There is a hint that explains what may cause a particular message.I may not be able to cover all error messages because I may not have seen all of them. Read also a nice blog posting from S60 team, Signing applications for S60 3rd Edition.Message: Certificate error Contact the application supplier.

Hint: You may have tried installing unsigned application. Note that signing is mandatory S60 3rd Edition. You can use self-signed certificate or developer certificate from Symbian Signed to sign your application.Message: Unable to install. Constrained by the certificate.

Message: Required application access not granted.

Hint: This message pops up when you attempt to install developer certificate in the unsupported device. The developer certificate from Symbian Signed can only be used in a limited number of devices. Remember that you have to send your IMEIs to Symbian Signed when requesting certificate. You cannot use the certificate in other devices that is not in your IMEIs list.