Categories

28C3: Reverse engineering a Qualcomm baseband

Posted on Sunday, January 15th, 2012 in reversed, RF, talks, wireless by the machinegeek

At the recently concluded Chaos Communication Congress 28C3 “behind enemy lines” conference in Berlin, Germany, Guillaume Delugr√© presented this talk on reverse-engineering a Qualcomm baseband.

Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have highlighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints.

For more information from this talk or to download the slides in PDF, visit the 28C3 website.

This entry was posted on Sunday, January 15th, 2012 at 5:06 am and is filed under reversed, RF, talks, wireless. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Recent Comments

  • Drone: So these go for around $330 USD and NO published calibration procedure online or otherwise? Given what's inside - I don't think I'll be considering...
  • Pekka Akselin: This is ridiculous!? :-) We are back at 256(!) byte EPROMs that needed multiple, a handful, of voltages to run! :-(
  • KH: Let's try a back-of-envelope calc balancing energies. From MCP1700 datasheet, there are graphs for a 200mA load step. Estimate the energy shortfall as 12uJ. Say...
  • Daniel: It's been a week and my comment is still awaiting moderation. Apparently the CIA doesn't want their involvement known?
  • KH: Agree, so okay, I guess he must have learned from somewhere. 100nF and 1000uF is so far apart, that was jarring; it's more magic incantation...