CE Runtime Foundation v4.1 pre-alpha

A universal Windows CE emulator: a virtual ARM hardware platform that boots real CE and Windows Mobile ROMs on modern Windows.

Warning

Early stage. There are some bugs and boards are just MVP implementations. Some boards lack proper clocks, timings, caches, etc. - take into account. Today this is rather proof-of-concept. Contributions are welcome!

Tip

Stock touch input is misbehaving in some devices/requires some additional effort. If your clicks do not register, try holding the left button and wiggling the cursor a bit.

Usage

The easiest way to run CERF is launcher.exe — a GUI app shipped next to cerf.exe that downloads publicly available ROM bundles and boots them. Pick a device from the list, tweak launch options (resolution, logging, network) if you want, click Launch CERF.

For direct invocation without the launcher:

Command	Action
cerf.exe	Boot default device (cerfos)
cerf.exe --device=devemu_ce6	Boot specific device
cerf.exe --log=ALL	Enable every log channel
cerf.exe --flush-outputs	Force-flush logs (avoid truncation on crash, extremely slow)

Logs are written to cerf.log next to the executable. On a fatal crash, every other thread's register state and a top-of-stack snapshot is dumped to cerf.crash.log next to it. Run cerf.exe --help for the full CLI.

Note

cerf.log is quiet by default — only critical CERF / CAUTION lines are written. Pass --log=ALL (or a channel list, e.g. --log=BOOT,JIT,MMU) to turn channels on.

Guest Additions

Warning

Experimental and unstable. Guest Additions are opt-in (--guest-additions), off by default. Expect per-device rendering glitches and reduced stability — some guest OSes behave better than others.

Guest Additions mechanism injects pre-built ARM driver, replacing the matching ROM's video driver. The library is fully OS version-agnostic and orchestrates entire set of features along with regular video driver responsibilities.

Pass --guest-additions (or tick the matching launcher option) to enable them.

Features

• 32bpp custom screen resolution (boot CE3 into 4K!)
• Host-accelerated blitting - the driver routes blits to host which performs the full set of graphical operations in native code
• Dynamic screen resolution (CE 4+)
• Shared storage with host
• Task manager in a host window
• Mouse pointer driver:
  • required to avoid stock touch limitations on custom resolutions
  • guest OS cursor shape translated directly into host graphics
  • scroll wheel support on newer CE

Warning

Touch breaks at non-native resolution. The board's touch peripheral still uses the device's original input driver, which expects the original screen dimensions. With guest additions enabled, the main default input is the regular mouse cursor emulator that every (maybe) OS supports. In case if you need to go back to original touch interface, use the runtime switcher in Actions menu or in status bar. However it might be really corrupted on custom resolutions. E.g. iPaq H3600 devices seem to allow you to run calibration app only through stock stylus - the single app ignores the mouse pointer input.

Supported boards

SoC	Board / OS	Features
Intel XScale PXA255 ARMv5TE	Falcon 4220 Windows CE .NET
	NEC MobilePro 900 Handheld PC 2000 Windows CE .NET	—
Intel SA-1110 StrongARM	HP Jornada 720 Handheld PC 2000
	iPAQ H3100/H3600/H3700 Pocket PC 2000 Pocket PC 2002
	Siemens SIMpad SL4 Handheld PC 2000 Windows CE .NET
Intel SA-1100 StrongARM	HP Jornada 820 Handheld PC 3 (CE 2.11)
Microsoft ODO (???) ARM720T (1996 NDA board)	ODO/Poseidon Windows CE 2.11 Windows CE 3
TI OMAP 3530 Cortex-A8	OMAP 3530 EVM Windows CE 7
Freescale i.MX31L ARM1136	Zune 30 Windows CE 5
Samsung S3C2410 ARM920T	Device Emulator Windows CE 6 Windows Mobile 5 Windows Mobile 6 WM 2003 SE Windows CE 5

How CERF runs ROM images? (NK.BIN, etc.)

Each device under devices/<name>/ contains a Windows CE ROM image (*.nb0 or *.bin) and each device declares an optional cerf.json describing itself and (optionally) overriding board / network / rom defaults:

{
  "meta": {
    "device_name": "Microsoft Device Emulator (Windows Mobile 5 Pocket PC)",
    "board_name": "Device Emulator",
    "soc_family": "Samsung S3C2410 (ARM920T)",
    "os": { "name": "Windows Mobile", "ver_major": 5, "ver_minor": 0 },
    "device_year": 2005
  },
  "board": {
    "configurable_screen_width": 800,
    "configurable_screen_height": 600
  },
  "rom": {
    "primary": "NK.bin",
    "extensions": "EXT.bin",
    "recovery": "Recovery.bin"
  }
}

meta is informational (device identification for the launcher / status displays). board is only honoured by BSPs with a configurable screen resolution (today only Device Emulator boards). rom is only needed when a device ships more than one partition; single-ROM devices auto-detect the *.nb0 / *.bin.

See device_config.h for the full schema.

To determine what is the board, CERF looks inside of ROM and performs heuristic search by module names or binary blobs. CERF also replaces entire bootloader, therefore e.g. Zune 30 can boot OS without HDD (tho OS actually will hang without HDD), but in reality it seems that the bootloader spins the HDD and boots NK.BIN from HDD. Our synthed Zune 30 HDD lacks NK.BIN entirely.

Claude Development Environment

CERF ships a Claude Code-based development environment for working on the emulator — including bringing up brand-new boards from their ROMs. Launch it from the repo root with:

run_claude.cmd

It runs Claude Code with a custom system prompt that injects the entire project documentation (CLAUDE.md plus every agent_docs/ reference page) into every agent, so each session starts fully briefed on the project's rules, architecture, and subsystems — no "please read the docs first" needed.

The environment provides the /start-board-implementation skill: drop your ROM into bundled/devices/ (or just point the agent at it) and run the skill. The agent identifies the board and SoC straight from the ROM, checks what CERF already supports, estimates the effort, and — on your go-ahead — starts the bring-up with a cross-session tracking document. So you can literally drop in your ROM and start the procedure of bringing it up.

Warning

The dev environment runs Claude in skip-permissions mode — it can execute anything on your machine without prompting. It also force-kills its own Claude instance, and any clangd.exe, that leaks memory past a threshold. The first launch shows a one-time explanation; press Enter to acknowledge it.

Building

Requires Visual Studio 2026 with the C++ desktop development workload.

Note

First build on a fresh machine takes 1+ hour. vcpkg compiles dependencies from source before CERF starts linking. This happens once per machine — subsequent builds reuse the cached vcpkg_installed/ tree and finish in a few minutes. Do not interrupt the first build.

Initialise source/dependency submodules:

git submodule update --init --recursive

Build via the helper script:

powershell -ExecutionPolicy Bypass -File build.ps1

Or invoke msbuild directly:

msbuild cerf.sln /p:Configuration=Release /p:Platform=Win32

Third-party / Credits

• QEMU
• The Linux kernel
• nlohmann-json
• libslirp
• JIT studied/inspired by Microsoft's Device Emulator (Shared Source Academic License, 2006)

Known Issues

See launcher's boards details database for per-board issues.

Changelog

CERF Version	Changes
v4.1 (NOT RELEASED YET)	HP Jornada 820 support Siemens SIMpad SL4 support Added HP Palmtop VGA (F1252A) card Guest additions: IMGFS injection fixes (e.g. WM >= 6) PC Cards: Serial modem emulator and serial forwader DDraw path inside Guest Additions (now Zune and friends render, I hope)
v4.0	NE2000 is now hot pluggable in all boards that support PCMCIA Compact Flash too with configurator/generator iPaq 1st gen now has extensions sleeve emulated (for PCMCIA support) iPaq H3100: monochrome screen inversion fixed Soft/hard reset your device in Actions menu (might be broken for some SoCs) + corresponding SoC/peripheral updates Guest additions: task manager on host - see process list, switch to processes, kill and run right from HOST window NE2000 internet delivery hangs are fixed Jornada720/SA1110/JIT updates to make it boot Linux-based OS Launcher: optional packages feature Guest additions: Complete overhaul of XIP injection (Now you can boot Jornada 720 in 4K. Also suddenly Zune 30 is in the game too) Various UI/general fixes, improvements
v3.21	iPaq H3100 support iPaq H3100,H3600 PPC2002 sound fixes Jornada 720 support JIT/MMU improvements
Previous versions — see the full changelog.

What happened to CERF v1?

Note

CERF v1 reimplemented CE userspace + kernel in host C++ - coredll exports thunked, rehosted on Win32. It hit a hard ceiling: per-process host resources (GDI handles, atom tables, kernel handles) couldn't hold an entire guest OS. v1 was overengineering hell that literally grew exponentially. v2 is a completely different project. v1's source lives at cerf-v1-obsolete.

AI-generated code

Caution

DO NOT USE CERF CODEBASE AS REFERENCE FOR SoCs, BOARDS, PERIPHERALS - AI WRITTEN CODE CAN'T BE TRUSTED!

100% generated by Claude via Claude Code — no human-written code. Not production-grade.

Downloads

Download WIP build (4.1) from artifacs or go to latest release