Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/722 Thanks!
So the next talk is titled
Dissecting Modern 3G,
4G, Cellular Modems.
This is by Harold
Valetta and Holography Frater.
And that was totally mispronounced.
Sorry about that video
we saw in the previous presentations
on smart cities that there's a lot of Iot
that doesn't need to communicate.
And while there's Zogby and Lauren
and other protocols, most likely
they're going to fall back on what is
really their tried and proven.
And those are the 3G, 4G modems.
I don't really need to introduce
our speakers today. They're well known
for years and years and years here at
the Congress.
So I'm just going to pass it right over
to them and have a great
talk.
So today, we're going to talk about
cellular modems just to differentiate,
it's not about baseband or basement
exploitation, it's really about a
GSM module or 3G or 4G module.
Our talk is going to be structured
in a couple of phases.
First of all, our motivation.
Why are we looking into it?
Where are we coming from?
The second part will lead to the history.
What have we done before in terms of
modems are
looking at how we we picked these
modems. We actually looked at then
some things that we actually didn't
expect when looking at it.
Also then looking at the firmware
upgrade mechanism, if there's one, how it
works, what has been done.
And we will finish with our
recommendations and wish us.
First of all, we're implementing
GSM specifications for more than
a decade now.
It started with humble beginnings of
sending eight commands to modems
on mobile devices
to actually working on a free software
smartphone at Open Molcho and then
working on Open VSC and Osmo.
Com to implement radio
area network software and call network
software.
And has been eight years since Laforet
presented about how our
Zand modern smartphone hardware looks
like.
It's 70 years since we
worked on Osmo Cumbie to run our
own baseband software on our
commercial great hardware.
And professionally,
we have worked with M2M devices
and have built M2M devices ourselves
using 2G modems.
And from this point we
we started to explore how
which kind of device would we use in
modern embedded devices
or M2M or Iot devices
these days for our implementation
of 3G and 4G
network software.
So if you send messages over
the air and you don't get a response,
it's always difficult.
Like did you encoded correctly,
was it? And so we looked into having a
device that allows us to to get
log in to see if the message arrived
or so now we're
even able to extract
traces from it.
And what's also important for us and got
us into Osmo comment open VSC
is to build tools to allow others to
understand how cellular technology
works. So while TCP
IP might be well known to many of us
how the IPS actually transmitted
back to the Kornet and relative to the
Internet is not that clear and we want
to make it more visible and having
technology and tools helps for it.
For a brief moment, picture
yourself trying to beltzer classic
M2M device,
you might pick a modem because it's
already certified and easy to use, but
you need to run some application code on
it. And the traditional applique
approach would be to get a
microcontroller or a bigger
processor and connect these two devices
using USB or Sirio.
But it means that you need to have
a bigger PCV, more power consumption.
So it would be nice if you can run
application software on the modem itself
already. And one of the
driving factors for it is to reduce the
PC space, to have a lower power
consumption, to save on the bill
of materials, have fewer components.
And Daxam, we found something.
It's called open.
It's done by Sciarra Wireless.
And mostly it allows you to write C
software, which is then compiled
with the disk and uploaded to the
modem and you can start running.
It will be loaded into the real
time operating system.
It runs as a normal process.
There's no Muno privilege separation.
So if your application crashes, the
entire modem will crash
to e debugging.
Surveillance has like a nice tools
to get output and send it commands
and logging debugging.
That's the problem with this approach is
that if you build an application and make
it stable, you know so much about US
Open at stuff that you're mostly locked
into this API.
So your architecture and software
is following
what open it application will look
like. And then you've spent years
developing an application and suddenly
there's no path for 4G.
So you're locked in and even your 2G
modems will be discontinued.
So it's it's a nice platform to get
started, but it's kind of a dead end.
And this brings us to like our modern
requirements of what does a good modem
look like.
And one is we still want to be able to
run our own code in it and not like
some Python script or some
limited Java, but like our real
C application with
access to the device and no artificial
control.
We don't want to be locked in by a single
modem vendor. So it might be OK to use
a specific chipset, but we don't
want to be forced to follow whatever as a
modem supplier wants us to do
for for debugging purposes.
We want to be able to
get locked messages to see what's
important misdoing, see
if it's throwing away stuff, debug
output, be able to control it.
And for 3G and 4G development,
we want to be able to see through radio
messages.
And you might know a tool
called X Goldman has been written by
by to be a single.
It allows you to get tracing
information from Infineon baseman's,
but it has some limitations.
So we want something like one buffer
press edge UMTS
and LTE,
the modem
market or generals' easy cellular market
is kind of dominated by by Qualcomm
and it's kind of set by
itself.
But it also means that
if you pick a modem, most likely it runs
or it's based on a Qualcomm chipset.
And Qualcomm is very
close to
what we want from a modem because they
expose something called Sediuk protocol.
And it's also used
in many different Qualcomm products from
age to GSM to femtocell.
The first time I personally heard about
it was ETSI 28 Sastry
by a talk from Guillaume's that looked
into the baseband Qualcomm stack
and the stack protocol's
easy framing. It's very simple.
It's like classic DLC with
the start and an end marker
with the comment, bith some payload
and the checksum.
And it's used for events
like if if your modem is switching a
network, you get an event, you can enable
logging and then you get a lot of
textural output, but also
for comments and response.
So you can send a comment
to read the memory address and to get
some value from this memory address back.
And literally, there are thousands
of different messages that
can be sent or received.
And in terms of free software
implementations, flexi modem or
GSM, pausa, only use a fraction
of these available messages.
But it means like the protocol is
something you want to have direct access
to because it allows you to to see
what's important is doing.
And it brings us to the point of
selecting a device that is exposing
Dayak. And in the past,
the option I can speak might have been a
very good
device to use because it's exposing
diag on USB out of the box.
But it's kind of old.
It's using old Qualcomm software.
It's limited.
2G and 3G, so we look into something
more modern and want to see the devices
we found is from a Chinese modem
manufacturer called Correcto, it's the
U.S. Twenty. It exposes
Dayak out of the box.
It's even documented in their hardware
interface that it's a diagnostic
interface, but sadly,
it doesn't support LTE.
If you look at a modern device, it
makes sense to not go for 2G and 3G
only, but also have an option to go for
4G. Which brings us to
the DC 20.
It looks like the U.S.
20, but it has LTE.
So that sounded quite nice
for building a product that can be
soldered to your VCP, but
for development purposes, they also offer
it in our mini PCI Express form factor
so you can just plug it into one of your
devices that might already have mini PCI
Express. So we picked the
Easy 20 as like a module.
We want to look at it and once we started
to look, it has like Qualcomm
MDMA 965 chipsets,
which surprisingly is also used in the
iPhone five.
But beyond that, there's not a lot of
documentation of what it has.
Which brings us to the unexpected
surprise. So after I got
older, I used that
comment interface just to to play
with it, to see if my application could
do what it wants and was
hanging like after a day.
And I got involved with the
supplier of the modem and they gave me
a few more updates, which was a zip file.
And I unpacked it and
I'll find them looked awfully like
like a Linux system, which is
why my modem have a Linux system in
it, but maybe I'm just mistaking
it. And then they have a flash
tool and it looks like the Flash two of
Android was fast words, but like, OK,
maybe it's coincidences or it was
it was just convenient to use it.
But actually other people have already
seen that, like the MGM 96,
96 runs Linux on it, like
I see Def Con 26 by Mickey shot
off.
So apparently it runs Linux
on your modem.
And the question is why, why would it
even run Linux?
Because Qualcomm is known to have
pudder IP stack into the modem
IP Sorkh SERP.
Why would they stop doing it.
It didn't really make sense.
So we started to to look at
it. And also there is almost no
information that Linux actually runs on
this device.
Um.
Which means no written offer
that I use to our minds, Elseworlds
to untax Ezzy Flesch
filesystem, it really
looks like Linux and
I started to look at some of the binaries
that are not standards, but is
a character Qualcomm specific.
And you see funny strings that look like
80 commands, but like 80 plus
like succulence comment.
What would it do?
And at this point, we started to
explore those technicalities of
what is this platform really looking
like? But also from a legal point of
view, like, can we please get the source
code? Can you please put a written offer
in it? And at this point, I hand
over to Laforet.
Yeah, so.
Yeah, so as a lucky coincidence, I have
been doing some enforcement in
the past so well.
OK, but first, we started
to look a bit at the hardware and, well,
if you're doing hardware anyway
professionally and you have all
the tools and the process and your
partners for assembly and so on and so
on, why not just do a couple of boards to
help you with the task at hand?
So many of the mini PCI Express modules
that you can find for cellular modems,
um, they have additional signals on
undocumented pins of the mini
PCI Express Connector, like VCM
Audio or even others and so on.
And while, of course, if you just put the
modem in a regular PC mainboard
or an embedded device, those signals that
they don't terminate anywhere, they're
just not used on the slots side.
And solidary wires to
the pitch of a mini PCI Express board is
not very convenient.
So I created what we call a
breakout board and you can
see a picture of that is an open hardware
project, schematics and everything.
Design files have been published.
So you have this connector on the right
hand side which exposes all these extra
signals so you can actually
easily access to the various
undocumented signals.
So the easy 20 Soldo
module documents there are
Depak, you are at pins, which are not the
normal. You are pins on which you speak
at commands, but as additional you are.
But it seems like not all modules have it
enabled. So we bought modules from three
different suppliers.
They all have different firmware versions
and different, uh,
configurations.
And some of them have it enables some
not. But those that had it enabled
have it at one point eight volts.
But how can I say,
uh, in their
wisdom, the designers decided not to
expose the one point eight volt voltage
real on any of the other pins of the
modem. So you have external voltages
of three, uh, three point six well, two
point three world and so on, but at one
point eight volt.
And since in previous projects, whenever
I needed to attach to a you are the front
of an embedded device, I built another
level shifter for a specific voltage I
already had built for two point eight two
point five two point three volts before
I decided, OK, let's do a board that is a
multi voltage. You are so you can
actually select the voltage of your you
are with a small, uh, rotary switch
and connect to a
series of parts of various devices.
And that's what's here is also another
open hardware project at Osmo.
Yeah. And then you attach to the serial
port and you get a Linux login prompt.
And interestingly, if you
look at the firmware update file that
Holga just mentioned, it contains,
of course, on parts of the file and
there is only a hash.
And if you do a little bit of password
cracking, you see it's only Linux.
One, two or three is the root password
of the device.
So by now, we were 250 percent
sure that there is no that
there is not a single device,
and yet this, by the way, how the full
setup looks like, you can see I sold it
the small additional three Canada to get
access to the yard
on this module.
And just way we could start
to explore it further.
So, OK, brings us to the topic
of, well, where can we find the source
code? The module didn't show up with a
written offer. It didn't ship with a
license text. It didn't include source
code. It didn't even mention that Linux
or other GPL license software was used.
So while digging around
the official supplier of it, the
manufacturer didn't I didn't release
anything. I didn't provide any such
information. We were looking a bit around
because, I mean, it's likely that other
devices do the same.
And we found that actually Qualcomm
is publishing a complete
open embedded build system
for building Linux for those modem
chipsets.
So this includes the open embedded
metalious, the kernel, the the bootloader
and various other bits and pieces.
And it's almost completely undocumented.
Basically some dreadfuls and you can pick
around them, but there's not really
a documentation how to use it.
And well, if you look at the
entry level website of this open source
project from Qualcomm, which is called
Aurora, well, that's like literally
hundreds of branches and tags and you
don't really know what to use for what.
And they say, well, this is one example,
the version that you can build.
And then somebody think years ago
posted. Well, I tried your instructions,
but, well, it doesn't compile.
I'm facing some issues and of course,
nobody ever responds because.
Well, you know, um,
why would they ever respond?
But anyway, it's it's public.
And on that website, you can find it
and you can start building.
So we started building that.
Of course, this we also ran into the
issues that didn't build.
But anyway, in the end, we we managed to
build some of the code.
And meanwhile, we were talking to the
manufacturer of the modem and
asking them for the complete and
corresponding source code.
And then what they sent is the complete
and corresponding source code to the
firmware update tool that you run on your
PC, which we didn't ask for.
And it was not GPL license.
We still received the source code.
OK, nice.
It's good at that point we could
understand how different the protocol
works towards the modem, um,
and then while you ask again for the
complete and corresponding source code
and say, oh, we never been, by the way,
all the typos and grammar issues
are not introduced by us.
So we never been in a legal dispute.
And we always make sure to understand
intellectual property rights ahead of
using technology belonging to a third
party. Well, clearly, they did not in
the Linux case. And then they sent us
this nice little letter.
This is an excerpt from it.
And it's like all we always
respect the importance of intellectual
property rights and laws.
And we actively engage with known
essentially intellectual property rights
owners. Apparently, the copyright
owners of Linux and other free software
are not essential
and and so on in order to
be compliant with the right. So then you
ask again and you ask again.
So you see why we always ask the same
question. And it's like, oh, we
appreciate the efforts.
This was to the lawyer of the
IP table project.
They missed the fact that it's multiple
tables with Cingular.
But anyway, well, then your
client doesn't have the right
to empower a copyright.
It's like, OK, that's new to me.
And and they
claimed that I had transferred
my copyright to the Free Software
Foundation, which I never did, and which
nobody I think or this is highly unusual
if you work on Linux, kind of cool to do
so.
So I did not have copyright.
OK, anyway. And Caccamo.
Sorry, sorry. My mistake to always
respects intellectual property rights.
Of course.
OK, so still no source code then we ask
again and asking well and thank
you for your detailed explanations that
we will provide iterable and
then always willing to achieve
GPL compliance and so on
and so on. And then another month or so
passes and then
I finally well we do some legal
enforcement, we do some warning notices
and so on.
And then we
are not perfect and we cannot construct a
perfect website, which I never requested.
We just wanted a source code.
And then, well, you get
some source code and it doesn't build
and then say, well, there is ahead to
find missing. And by coincidence, it's a
header file that I wrote.
I don't know that it is unintentional.
I mean, how many times did I write?
And if you know, if tables, there is a
match for the differentiated services
code point for DCP for using the IP
header, and that has a header file, which
is like eight lines of of
boilerplate definitions.
And this was missing.
And there's an oh, we don't have this
file. And Qualcomm also doesn't have this
file. And Qualcomm never provided this
file to us.
I mean, it's in the public repositories
that Qualcomm hosts on
on called Aurora and the colonel doesn't
build without those files.
And then, by the way, we will not discuss
compiling issues by email anymore.
OK, then some more time I
gets more and more.
Then you get individual files and
individual emails and you put those files
in your Colonel Sastry
and then you see that
the scripts in the kernel have missing
executable bits, but certain C files
suddenly have executable bits and
then another file is missing and so on
and so on. But by now we have received
various source code tarballs.
They interestingly contain
not only the GPL LGBT called, but also
other code with like BSD
type or Apache type licenses where they
wouldn't have to release it, which is
good. And they did this intentionally.
And I think it's a very nice
sign of them that they don't release only
what they have to, but they release more
for the easy 20.
It's still not a license compliant.
There is no visible source code included.
For example, not that busy books would
ever have done any GPL enforcement in the
past and.
Well, but that's not
my primary concern.
And I think it's it's
it's getting there and it's work.
I've learned you can use the source code
that they release.
Interestingly, there's other motor
manufacturers like Sierra Wireless,
which are also building more
dams on such a Qualcomm
systems, and
they release not only the source
code, but extensive documentation.
So this is a small excerpt from a
screenshot where you can actually all
they describe how to build it with open
and better to describe how to use
Facebook to install the Fermor on the
module and so on and so on.
However, as good as they are
and the open source side, they try to
lure customers into a proprietary
framework like that that was open in the
past and that well, again, would result
in vendor lock in.
So it's not really
recommended or I think a smart
move to, uh, to go ahead that way.
And with that, I'm going to hand back
to Holga before returning
later.
We're going to very briefly look at the
HeartWare.
It's a Qualcomm MBM ships that I've
already mentioned also in iPhones,
and it turns out maybe in your
future car,
at least right now, it's the modems from
Intel inside of Syria, wireless,
but certainly from a free software point
of view, like it runs Linux.
It talks to the hardware, but there is
absolutely no documentation
of agency hardware in the Internet.
I'd like even on other websites,
not nothing, because
it brings us to the hardware overview so
we know there's a
processor inside, probably hexagons
connected somehow.
Nothing. So that's very frustrating to
have spent many years on free software
to see Linux winning, even getting into
the modem devices, but
no hardware documentation being
available, not even a block diagram.
All right. You have to.
And not even a block diagram here.
So nothing.
Let's look at the software part and
explore this system from a software
point of view.
The photo has shown how to get a serial
console on it, but not every modem has
enabled. And we didn't
look at what it takes to enable
it. And also soldiering is not
that nice. So after exploring
the easy route or the root system,
so we started runs an Android Dybbuk
Bridge. So if you have used Androids
or EDB, Shalal should give you a shell.
And nicely, we have already seen
the 80 plus curious commands to execute
something on the device.
And we found a script that is
reconfiguring the Android USB
gadgets to actually put
a DB in it as well.
So let's try to execute the eight
commands and then
suddenly the cereal's on your host.
Linux don't work anymore because
the easy way is a accused
serial killer modulus written.
It's matching a device based on the
number of interfaces.
And if you added EDB to it,
you suddenly don't have four interfaces
but five interfaces and you're your
driver cannot identify the device.
So we had to first take it a bit
and Lafarge has made a more clean patch
to actually get it.
But after a small experience, we
have EDB shell on it.
It works on any module,
but yeah.
And the shell is the root, of course.
I mean, so you don't even need the
device. It's like you get the router
immediately so there's no lock down as
well.
It's rude. There's no silent auction,
just a very nice and
open Linux system
to build it. It's it's
it's a bit odd that it has a bootloader
as it seems to be proprietary.
Then it has the Android bootloader and
Android Linux kernel,
the Android debug, which we've mentioned.
But surprisingly, it's not using the rest
of the Android system, but it has a new
Lipsey was busy box use system
five in it.
So it's a very classic open embedded
build and it's actively developed
and maintained by Qualcomm.
But they make so many releases you
actually don't know which one to pick.
It's it's a bit of a zoom.
Yeah. And then you start to look a
bit at the Asciano that is released.
And luckily and interestingly, and
to my pleasant surprise, there's
no binary only module.
So everything in the krona is released in
source code.
Nevertheless, of course, it's a lot of
source code. So if you look a little
bit at the number of lines, it shows
up between the closest mainline version
and the kernel that's used in those
modules, you end up with one point five
to one point nine million lines of diff.
I mean, this is not actually code lines.
This is counting all the lines of a diff
output, including the context.
But still, it gives you an idea about the
size of the difference as compared to
Main Line. And of course, you expect on
those kernels that all the CPU
specific stuff and lots of driver code
and so on and so on.
But then if you look at it in more detail
and as a disclaimer, I haven't looked at
Qualcomm, Android, Linux, Kurnitz
during the past 10 years or so and
to say eight years, not six years,
whatever, a long time.
And and I know there's a lot of code
in there, but I didn't expect all
the different things that I found in
there.
I mean, they have their own shared memory
based logging infrastructure.
And shared memory is not shared memory
with the modem processor.
It's only shared in the network system
YAF and in the processor communication
logging process.
IPC is not inter process communication
like you would know its inter processor
communication.
And you have something which is
completely flabbergasted me.
It's called remote spinless.
I mean, you know, spin like you you
basically you, you have a mutual
exclusion mechanisms that only one thread
on it, one c.p.u can enter a critical
part of the code
on your multiprocessor Linux system.
But then here you can actually also
Blocher, the modem processor,
the Exergen on the other side from
entering a particular section.
What could possibly go wrong if you
hold if you keep the realtime
operating system in busy waiting?
But OK.
Um, yeah.
Then you look at the source code and I've
actually since I haven't looked at
Qualcomm Kronosaurus code for quite some
time, I was expecting well this has been
in all these, uh, Linux Android phones
that have Qualcomm chipsets and lots of
printers, open source.
Plenty of people must have analyzed it.
And there's certainly some documentation's
and high level overview.
But all these individual subsystems, how
to glue together how this works.
And I could just look this documentation
or look at that documentation.
But interestingly, it doesn't exist.
So I had to start to write that
documentation.
Um, there's now a lot of information in
our wiki and some of the interesting
parts that you find is in there is
the shared memory device, which is the
core of all the intact.
Between different course, you have
to process the communications, you have
remote network, you have a
has also ABAM to Bam,
it's the access manager
and we have IPA.
This is not your favorite beverage, but
the Internet accelerator
and it some diagnostics
forwarding and so on. And if you look at
these subsystems, I draw
a graph, you know, if you know how rare
that is, I draw a picture and
it symbolizes
what's happening in this modem.
So if you look at this picture, you
will see basically the large
square at the top is the the application
processor. The bottom small part
is the modem processor,
which we don't know much, of course.
But then on the left side, due to the
availability of source code, we can see
what's happening. So you have the shared
memory device and then you have channels
implemented by the shared memory device
and individual different subsystem
binding to those channels as two
for eight commands which attach
to the serial function gadget
of the USB gadget called in Linux.
So basically the important part
is to see that
the USB you speak you don't speak
to the modem actually to the modem
processor, to the basement processor, but
you speak USB to the Linux gadget
inside the Linux arm core
on those devices and then that Linux arm
or forwards or handles
different interfaces on your USB
configuration in different ways.
And you have this small box symbolizing
the userspace and you can see how the
different passcode.
It's quite interesting if you look at the
040 have a serial port for GPS
and you have a serial port for 80
commands and you think, well, OK, these
are both serial four devices.
They must be handled quite similarly.
But no, the GPS
part is actually handled here.
Over here, it goes into userspace.
It's Bridgid, it goes into a virtual
serial port here again and it goes into
the Zerega. Just the commands
go straight here inside the kernel and
never end up in userspace.
So I don't know why, but it's
quite sophisticated to
say.
And if we look at the diagnostic
subsystem, which is particularly of
interest to us, and now you can see I
didn't draw graphs anymore.
I just wrote a little bit of Nottie.
We have the more than
D.V. on the left hand side, we have
the then we have the scroll where we have
the shared memory device on this.
A diag forwarding module in the kernel
binds on that.
We have a connection to the diagnostic
function gadget of the USB gadget
driver and that is goes to your host.
So if you talk to Dayak protocol to the
modem, it actually goes this way through
Linux, through a shared memory device in
the modem DSP.
But what's even more interesting is that
there is a diagnostics character device
on Linux called Def Dayak, which,
well, for example, SecureWorks, the other
processes they basically
attach to this diagnostics
device and all the logging that
you find in those Linux userspace
processes. They don't use this.
They don't use an Android locking
framework, but they lock through the
Qualcomm diagnostic subsystem and
you get the log messages of those
processes through this kind of device
over to the function device, over to you
is being to the host.
So if you manage to figure out which
logging flags and so on to enable
you get the log output of those Linux
user LAN processors over, Diek.
Well, very Qualcomm like not so
surprising, but still, uh, sort of
unusual in the Linux world.
If you look at the networking, the QMI,
which controls your, um, basically
the modem which network you attach
to, whether you activate PDF contacts,
yoku those parameters and so on,
you might have used QMI, SCIRI
or other tools on on your Linux
laptop to talk to such modems.
And in this specific case of those Linux
based, um, Qualcomm modems,
well you again have the modem DSP goes
through the shared memory device,
uh talks to the M-Net device,
the USB gadget you aspire to host, and
then you have your host PC somewhere on
the right hand side over there.
So this is basically the pass UQM it
takes. But then you have also QMI
in the user land on the modem itself,
which is what's presented here, and they
have what's called a Q Maxted, the
QMI Multiplexed Daemon, which
then offers a unique Stollman sockets
to various different client programs.
So basically all these userspace
programs, by using this unique Stollman
socket, they can talk to you and to the
modem as well, and all of them can
basically configure get
status reports and so on, all the
different parts and all the different
services on the modem, which is
interesting. And it's something that we
want to have coming from our initial
motivation. We want to run our own
applications in there and we want to talk
to the schoolmasters and talk
to you. Am I in there?
So we created a couple of tools to help
the analysis.
On the one hand side, we use the open
embedded that Qualcomm
released to build a matching OPG
and the packages for four tools
that you need, like soccer esterase
elsewhere and so on for some exploration.
We also have written a couple of C
programs for testing, basically
for accessing the QMI from code inside
the modem.
That's successful.
Um, and then we have
a couple of those still linked to the
proprietary libraries that are provided
in the modem. And then we have started
with some entirely free
open source programs like the cumulative
wrapper, which is an LTE preloaded right
library. So you can trace this Muxtape
communication and there is
ongoing work for a live QMI G live
transport, uh, for the security,
which then would enable you to run
a program that's linked against the free
software.
You live inside the modem
so you can develop it like you run it on
laptop, but you can run it transparently
inside the modem after cross compilation.
That's also a tool which we call Osmo QC
Diag, which is basically a host,
a tool for obtaining this stock
based logs from from the modem.
So you can run this on your laptop,
attach it to the modem, and then you get
all kinds of Trace's, not only the
interface Trace's, but also QMI Protocol
Trace's, which we then again decode using
live QMI.
So you get a textual representation
that's ongoing work here to basically
move all of that into Wireshark.
So you get the full decode of that in
Wireshark, but that's
not yet there.
So what kind of user based programs do we
find. OK.
We know what that does.
We have an ATF WD deman well
forwarding deman.
Well what does it do?
It implements those things like an 80
plus Q Linux.
CMD.
Um.
And other
comments, so basically use the space
program on Linux, can register like a
callback within the modem to forward
certain eight commands into Linux
UserSpacE, but you can then implement
them so you can basically implement
custom it commands in userspace programs.
There is all kinds of other software
which we haven't really figured out yet,
a lot of what they do.
There's one monster
called the Cookie Map Connection Manager,
which basically allows
you to run Linux based Wi-Fi access point
with LTE backhaul
excuse me, for the TiVo.
So basically you have to attach
a Wi-Fi chip to the audio
interface of your modem module and then
you have a full personal access point
device that has an LTE backhaul
and then the Wi-Fi.
You like the parameters, for example,
the key and the side and the channel and
so on. You configure all of that through
through what it commands.
Of course, if
you ever wanted to look at software
that receives eight commands and then
generates textual config files for
WIPA Supplicant and for host évidemment,
then you can look at this code.
I prefer not to.
So we have
the connector bridge, which is
it's a very simple device.
It reads from one device and it writes it
to another device.
And apparently this is such
a complex task that you need to schedule
a different process.
And I think it has three threads or
something obscure like that.
So, OK, well,
which brings us to the funny bits and
pieces that you find in those modems.
Well, the first thing is 80 plus
calculators come and we spoke
about that. You can run arbitrary
commands as rude in a redivide Rulfo
system in there.
So basically, you can do anything.
I mean, you can send an arm at
Asharaf session and while it's gone,
it's dead, Jim.
So we also have commands
to switch to fast food mode so you can
update the firmware you have
especially at command to print.
And you have also all kinds of other
commands. And when you when you do
a strings, just strings
a call on those executables, it looks
like Allscripts in many cases.
And one of the most funny things I found
in this modem is how many processes and
threads does it take to reboot a system?
It's apparently a very complex question.
How do you reboot your system?
Apparently, this was the easiest method
they could find.
So there's one process to reboot
Dayak app, which registers a dire command
with command codes as IREX 29 with
the DIAG infrastructure, and it spawns
a thread which executes another
executable called QMI Simple, the real
test with an input pfeifle
and then it calls system echo mode
and reset in two to ride mode
and reset into the five four of the input
of the process it just spawned,
and which then causes this to send
a clear message to the modem which
will reboot the basement processor.
And then of course you clean up, you
remove that temporary file because there
is not a temp office, but it's read right
filesystem.
And then it goes on to write
the string reboot into
this reboot def using affright, not
using echo this time.
Right. This is a C program, not a script.
So apparently they discovered
that and used F right.
And then we have a reboot deman a second
process again with two or three threads
which reads this reboot a device, and
then actually they published the source
code. So this is the actual source code.
So you read from this def
reboot a device, then just a nice common
document. And what it does you do a
string compar you have the
first print F going for Riverwood, you
have the second print F initiating reboot
and then you call system on the reviewed
executable. So apparently
the most simple method.
So if you ever were wondering how we
would reboot your Linux system, this is
the new reference.
Yeah, then we have programs that look
like shell scripts, so this is an actual,
of course, condensed output of strings
on the character demon, right?
You see like Echo in Sisyphus files,
you see copying files, even a semicolon
in there. You see echo into the duty
cycle of some some fills with modulation,
an idea of what that does.
And then they even grab for the process
and they kill processes
with the most obscure things.
And they even they don't use Reider, but
they do like less and then parse the
output of that rather than use open
territory. And the usual calls you would
do to get a list of files.
And it's quite amusing.
Yeah, which brings us to the topic
of fun about this.
But you can I actually
miss this example?
Sorry, I have to make a quick
interruption here.
And all these machine to machine modems,
they typically have an led and the
blinking rhythm of the lead indicates to
you whether it's registered to the
network, whether the data connection is
open, whether it's searching for
networks. That's all different blinking
patterns of the.
And how do you implement this on this
modem? Well, you run a userspace daemon
that calls system echo one
to the API, which
controls the LED all the time.
You know, sort of like the it's
not like the kernel would have
infrastructure for blinking patterns
and so on and so on.
But OK, so you have a demon that does
nothing else but basically toggling
your TVI all by exponential
processes using the systems is quite
OK. With that I hand over to.
Now, the question is, do you expect
anything after the topic of firmware
upgrade or is it going to be an empty
slide?
And the answer is they know that
they have to offer firmware upgrades
over the updates, making it as small as
possible.
And actually, it's something that
Qualcomm is preparing for more than
winders. So it's based on the Android
from around four point zero recovery
gates not using Android myself.
I haven't looked at how it worked before.
Many of you might be more familiar with
it, but it's mostly a zip file
and it contains Delta updates.
And surprisingly, they are somehow
hashed to to assure one ends
and the second one is being signed was
there was a private key and the result
is being put into a comment of zip file.
That's probably pretty standard, but
looked a bit odd. And it's nice that they
prepare a properly
secure firmware upgrade.
It was like minimal Delta functionality.
So what has Wachtell done to this code?
So I still use it.
That's that's quite nice.
But they have removed or actually
not really removed that they're not using
the RSA code to verify a signature.
And instead of using the standard Android
way to to patch these systems,
they use a proprietary component from
a company that used to be called Duret
Bend. But now it's Hammen and probably
soon Samsung.
And the Redmond component
is nothing that character
has written. But it's a commercial
product and it's used
in the U.S.
20 module as well.
And also in other automotive projects.
We have seen red band updates
being used. So at this point
I started to look into how does this
update form look like?
And instead of presenting a very complex
form of the format, I
have this slice.
So other people like Messias
only get, I think, blackheads
percent of something called a tax on all
my device management.
This can be remotely triggered,
but this is the update mechanism
used here cannot be remotely triggered.
The modem needs to to be
asked to start an update.
So that's already a bit more secure.
But I
started to look at the hex thumbs of a
specific Delta update.
And with a lot of help from SPA, we
actually managed to understand
how the updates binary looks
like.
And we have created a small tool to take
an existing update and put
it into smaller parts and also be able
to create our own defiles.
The format itself is
has many different pointers and offsets.
So in the example you might already
see the offsets here and confederacies.
So it starts with a common header
and then.
It's after he had over
LGM, a compressed
table of contents or
however you want to call it, and outside
in the header you have an offset into the
decompressed
version of this table of contents were
actually file update starts.
And when
you start playing or creating your own
file, you might get the offset wrong.
And this is the update.
Binary just crashes with a malformed
update file.
So it's like not very robust code,
a very complicated file format, and
nothing is cryptographically signed.
So when you use strings on the binary,
you see the word signature, but it
only refers to a key 32
Shaxson.
The next part, like now we understand
how the update format works,
we can create our own update
files.
The question is how do they end up on the
device?
And it's something that is implemented
in the forward demand that Harold
has mentioned. And if you have a script
for some specific strings
like W. gets this U.S.
map connection and show a photo update,
you already kind of guesthouses
application works.
So you issue it.
Command was a are for updating it.
In turn, it will disable
your normal IP connection that you have
established on your host and opens are
the PDP context on the device
itself using the
customer connection manager, then it will
spawn. Will you get to download the
file?
Will use systems to move it to
the right, the rectory, it will
remember what it wants to do with this
file and it will reboot into the recovery
position and system.
And at this point, the
updates file will just be applied and the
system will reboot once again, again,
without any cryptographically
signature or checks.
So if you manage to hijack
the update process, you can install any
binary on the device or on the
on the modem or anywhere else on
the system as you want.
So but instead of just
seeing how bad it is, we want to say,
like, what do we expect
them to do? And I'm handing over
Trevithick.
Yeah. So rather than saying, oh, this is
all bad, it's all unlocked and is
insecure and so on.
Well it's fun for us of course, because
that's what we wanted.
Right. We wanted a modem device where
we could do basically whatever we want
to. And we don't have to break
sophisticated security mechanisms that
are designed to keep the user or the
customer the owner of the product out.
So, yes, there are security issues
and security issues must be fixed,
but we need security mechanisms that
work without locking out the user or the
owner of the device, of course.
So this is our public
call to the manufacturers.
If you fix those
issues, keep in mind that
the openness of the platform is
interesting for all kinds of legitimate
use cases.
And while you want to
protect against malicious attackers,
you, of course, still want to enable
the actual owners of the device and the
users of those devices to use the
flexibility they provide.
Because there's a lot of a lot of.
Yeah, it's.
Yeah, so what's the status today and
outlook?
Well, we have just,
uh, opened the
wiki on the assets on last slide there,
all the links.
So on the Osmo project, we now have a
wiki for correcto, Qualcomm modems,
where all the information that I gather
from reading the thousands
and thousands of lines of source code is
in there.
We have released that.
I've actually presented in this
talk in a good repository and source
code.
The hardware boards are
released as open adva and available.
And what's unfortunately still ongoing
is the lack of integration, which
is to some extent to the fact that I've
never written anything against Jila
before or anything inside a program that
uses Jilib.
It's like all this infrastructure.
I'm usually more low level than that.
Um, and, uh, well, we hope to
grow this documentation and we kindly
invite all of you with an interest in,
uh, well, understanding those platforms
better to help us out.
You don't actually need to necessarily
reverse engineer and disassemble things.
It's just read the source code,
understand what it does and play a bit
with the device.
Um, we are planning an open
embedded package feed so we can actually
easily install additional everyone can
easily install additional packages on
those modems.
There's plenty of flash.
So I think it's like 20, 30 megabytes of
free flash.
So you can install quite a number of
additional packages in there.
And our aim is to have free software,
only use the land on this Kordic cortex,
a five CPU.
So to do away with all those proprietary
processes that are running userspace in
the libraries and run the,
uh, the the open source kernel
and have basically dyslipidemia
integration and
all other bits needed to
run our own standard Linux
user and code in there, um
and have custom images that we can run on
modems in for all kinds of use cases.
OK, now, before we go for
Q&A, in a minute, there's an unrelated
announcement that we would like to
present here.
The unspoken project has gained support
for running your own thirty three point
five G network during the last year.
Not sure who has noticed that.
Unfortunately, is suffers a bit of
a lack of contributions.
So we want to motivate people to
contribute more.
And we have just started an accelerated
three point five G program, which
provides fifty free three point
five G femtocell to people
who can convince us that they would
contribute something reasonable to our
project. So these femtocell
are already supported by the ultimate
Concord's or using the femtocell and the
Osmo Concorde. You can run your own three
point five G network and we're
giving those away for free.
So if you're interested in any of
that, please submit a proposal
until the end of January and then you
will hopefully receive your free
femtocell until the end of February.
Which brings us to questions,
yes, Q&A
time, we have a total of
eight microphones here,
one, two, three, four, five, six, seven,
eight. I can do math,
please step up to the microphones to ask
your question.
Meanwhile, we have from the signals
angel, we have a question.
Yes. The Internet wants to know if there
will be in quotes next open Moco.
OK, um,
not not
from us.
No, we're not working on a mobile phone.
Um, we're looking at modems now that
mobile phones at the moment.
So microphone two.
So just to clarify, does that mean that
Linux runs on the iPhone five?
We don't know.
We have yet to hear from you if you can
find it. But I think you can run
the trip for something else on this
cortex processor.
Um, but, uh,
we don't know.
Signal's angel.
Yeah.
The Internet wants to know why there are
no mini PC Express
M to to, uh, USB three
adapters because they think
LTE is capable of at least three
megabits and USB two could be a
bottleneck.
Well, um, I'm not really in the business
of manufacturing or selling adapters, so
I mean, yes, we did this open hardware
device out of a specific need, but
you would have to ask the hardware
manufacturers that I'm sorry,
could I ask the people who are leaving to
leave quietly, please?
Microsoft to
buy the entire E20 with the
breakout board and the word as a
single kit somewhere
where you can contact us, but
it's not really something that we
have prepared for.
But, yes, it's certainly an option.
But I mean, we're not here to sell you
anything. We're here to invite you to
help us learn about modems,
things and the Android debug.
You actually don't really need this area
so you can replace the device using
USB, even if you break it can be
refreshed.
And EDB, shall you have your old shell.
So that's Four Forks
and was articulateness and you can
actually start to lock in on the enemy
a console as well.
So even if EDB doesn't work,
you can get a lock in on it.
So it's very easy to to get started
without zero signals.
Angel.
OK,
do you have. Have you tried to get a
source code from other manufacturers?
Um.
Well, we know at this point
of I think, three different manufacturers
that use this MDM nine,
six, 15 plus Linux combination
from correctible, we have just described
how it went. Cierra has published all
this already by themselves in a
very good way. So there's no need to ask
them. It's out there. You can just
download. It is documented.
And the third one is an old end of life
Huawei module, where we have
also asked, but this is still ongoing.
And now it's interesting.
Ledet from a Chinese supplier, you get
the excuse, oh, there is Christmas coming
up for us. Like, OK, so, so many
Christians in China but OK.
But I think I'm quite sure if I ask in
January again guys. Oh there is Chinese
New Year coming up, but
we'll see about that microphone
for.
You mentioned the Qualcomm chip
used in the iPhone five.
Does this mean, well,
is it likely that
the iPhone application process of talks,
it commands to Qualcomm
chip is still stiff
state of the art?
No, it's not state of the art.
And I don't think it's happening.
I mean, you also on these modern
modules, the demand is there for
legacy purposes.
You have the QMI exported over USB
and normally you let your modem manager
or your whatever you use a phone or
whatever infrastructure talks kumite
or those devices.
I'm going to go back to the signals
again.
The question is, what is the
total size of the flash
or whatever's on there and how much
RAM has this thing got?
I don't know. I don't remember.
The flash size was Ramiz, 42
megabytes.
Yeah, that's this 32 megabytes of
RAM on this.
The successor, the Easy 25 has 128
megs of RAM, but a flash size.
I also don't remember right now, but
it check out the wiki.
We have put logs and all kinds of
Dembski outputs and so on, all on the on
the wiki. So I'm quite sure it's
somewhere in there.
Microphone for
you said that you tried to check Lagarto,
Linux, FINSIA.
Wouldn't it be possible to completely
build your own kernel there and your
applications?
Um, yes, it's certainly
possible. But then of course
if you do this, you
buy a lot of things, uh, with your money
that you don't use in the end.
So, uh, and you
support a vendor that tries to, um,
lock people into this proprietary
framework.
So it's, uh, yes,
it's possible. But do you have to use a
framework? I don't think so.
No, you don't have to.
But I mean, they are developing this.
And part of what you pay for is this
framework, and that's why their products
are more expensive.
So microphone
to do you have some ballpark
figure about the power consumption in the
lowest power, quittin current mode?
No, um, I'm quite sure it's
going to be high.
I think I'll get some comment on that.
Yeah. So when are you looking at this
device? You use airstrikes against AQ
marks the end. It's like mostly waking
up every couple of milliseconds.
So it's not power efficiency
code. It's really, really, really
annoying to see processes
that run all the time.
And from the previous slides is a comment
to have systems
that's actually the advanced power
management. So you can trigger an eight
command to have the device sleep and
adviser echo into
into it to go to sleep so it can
be tuned. And was a free software
userspace. It can probably be better than
what it is right now.
Signals Angel again,
how accessible is the
baseband?
Like a memory and like
Imai and stuff.
We haven't really investigated this in
detail, but we also haven't seen any
signature verification and so on there,
so I think it's completely open.
Um.
So he has a DSP firmware,
is in a separate in three separate
partitions, and there's no RSA
signature and it's the end of the
these politicians.
So it seems that you can modify it
if they're locked down like Époque
comment. That's something we haven't
tried or I looked at it.
Microphone one,
the modules readily available in the
LGA package, rather than the
many pieces of board, like if people
wanted to start trying to use these on
open hardware, they should
be available again.
Yes. I mean, they were temporarily not
available due to the enforcement, but
I think now they should be available
again.
And what are the quarter the costs of
those budgets like?
Ah, I think it's like forty
seven something euros
around that region of maybe what I was
most more than 50 about anyway, somewhere
in that region.
OK.
So one more question from the Internet.
Yeah.
And the Internet wants to know if you can
capture Leya to network stuff with this.
Yes, yes, you can.
So I think that's the end of our
Q&A session.
Please join me in
thanking the forage and
hunger on this fantastic talk about
things that I really didn't want to know
about 3G modems.