AV-Portal 3.23.3 (4dfb8a34932102951b25870966c61d06d6b97156)

Dissecting modern (3G/4G) cellular modems

Video in TIB AV-Portal: Dissecting modern (3G/4G) cellular modems

Formal Metadata

Dissecting modern (3G/4G) cellular modems
Title of Series
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Let's have a detailed look at some modern 3G/4G cellular modems and see what we can find out about their internals using undocumented debug interfaces and software or hardware based hacking techniques.
Keywords Security

Related Material

The following resource is accompanying material for the video
Video is cited by the following resource
Presentation of a group Cellular automaton Plastikkarte Computer worm Modem Modem Product (business)
Area Open set Line (geometry) Computer Mereology Power (physics) Expected value Latent heat Mechanism design Software Computer hardware Computer hardware Core dump Computer worm Smartphone Endliche Modelltheorie Freeware Sinc function Modem Modem Firmware
Group action Code State of matter Multiplication sign Set (mathematics) Survival analysis Real-time operating system Function (mathematics) Open set Tracing (software) Fraction (mathematics) Component-based software engineering Different (Kate Ryan album) Computer configuration Single-precision floating-point format Core dump Cuboid Endliche Modelltheorie Physical system Drag (physics) Software developer Gradient Moment (mathematics) Bit Computer Flow separation Type theory Message passing Process (computing) Quantum Right angle Engineering physics Speicheradresse Modem Spacetime Thomas Bayes Point (geometry) Classical physics Implementation Game controller Computer file Divisor Dependent and independent variables Cellular automaton Microcontroller Event horizon Product (business) Goodness of fit Internetworking String (computer science) Computer hardware Computer worm Communications protocol Form factor (electronics) Message passing Modem Default (computer science) Dynamical system Dependent and independent variables Information Artificial neural network Cellular automaton Weight Interface (computing) Expression Cartesian coordinate system Limit (category theory) Frame problem Software Computer hardware Communications protocol Computer worm
Point (geometry) Android (robot) Serial port Link (knot theory) Information View (database) Source code Binary code Open source Code Bit Mathematical analysis Line (geometry) Latent heat String (computer science) File system Video game console Computing platform Stability theory Physical system Modem Firmware
Addition Expression Projective plane Mathematical analysis Open set Process (computing) Motherboard Computer hardware Hybrid computer Website Right angle Endliche Modelltheorie Whiteboard Task (computing) Modem
Point (geometry) Personal identification number Projective plane Voltmeter Bit Revision control Latent heat Touch typing Configuration space Energy level Video game console Endliche Modelltheorie Whiteboard Traffic reporting Address space Modem
Email Web crawler Building Differential (mechanical device) Correspondence (mathematics) Source code Client (computing) Kernel (computing) Logic Electronic visual display Endliche Modelltheorie God Physical system Graphics tablet Open source Bit Term (mathematics) Computer Complete metric space Repository (publishing) Order (biology) Website Right angle Modul <Datentyp> Curve fitting Point (geometry) Module (mathematics) Service (economics) Open source Computer file Password Branch (computer science) Distance Product (business) Revision control Goodness of fit Energy level Video game console Computer worm Modem Serial port Dependent and independent variables Matching (graph theory) Slide rule Information Projective plane Physical law Civil engineering Client (computing) Line (geometry) System call Intrusion detection system Basis <Mathematik> Personal digital assistant Formal grammar Table (information)
Scripting language Email Open source Inheritance (object-oriented programming) Computer file Multiplication sign Source code Open source Content (media) Food energy System call Sign (mathematics) Bit rate Videoconferencing Cuboid Software framework Endliche Modelltheorie Extension (kinesiology) Physical system Window
Point (geometry) Android (robot) Computer program Texture mapping Patch (Unix) View (database) Mereology Number Root Internetworking Kernel (computing) Computer hardware Gastropod shell Computer worm Video game console Endliche Modelltheorie Booting Wireless LAN Modem Physical system Scripting language Rule of inference Interface (computing) Electronic mailing list Bit Line (geometry) Process (computing) Fluid statics Software Computer hardware Website Gastropod shell Video game console Freeware Routing Physical system Modem Arc (geometry)
Android (robot) Computer-generated imagery Source code Bridging (networking) Android (robot) Cuboid Computer worm Bit Physical system
Demon Android (robot) Group action Context awareness Greatest element Thread (computing) Serial port Multiplication sign 40 (number) Source code Sheaf (mathematics) Function (mathematics) Mereology Wiki Mechanism design Semiconductor memory Different (Kate Ryan album) Kernel (computing) Shared memory Core dump Square number Flag Cuboid Endliche Modelltheorie Physical system God Block (periodic table) Software developer Shared memory Staff (military) Bit Control flow Computer Connected space Message passing Digital rights management Process (computing) Internetworking Telecommunication System programming Configuration space Right angle Peripheral Remote procedure call Quicksort Physical system Modem Spacetime Row (database) Asynchronous Transfer Mode Laptop Point (geometry) Functional (mathematics) Observational study Open source Line (geometry) Device driver Limit (category theory) Coprocessor Number Latent heat Read-only memory Bridging (networking) Internetworking Queue (abstract data type) Energy level Computer worm Utility software Modem Graph (mathematics) Information Graph (mathematics) Android (robot) Interactive television Planning Line (geometry) Limit (category theory) Cartesian coordinate system System call Inclusion map Software Personal digital assistant Diagram Communications protocol Operating system
Computer program Socket-Schnittstelle Service (economics) Wrapper (data mining) Mathematical analysis Mereology Blog Different (Kate Ryan album) Network socket Endliche Modelltheorie Office suite Traffic reporting Modem Drag (physics) Slide rule Uniqueness quantification Computer program Mathematical analysis Client (computing) Cartesian coordinate system Liquid Einbettung <Mathematik> Software framework Software testing Modem Spacetime
Demon Complex (psychology) Computer program Scripting language Thread (computing) Multiplication sign Direction (geometry) Source code Function (mathematics) Parameter (computer programming) Open set Mereology Tracing (software) Cumulant Sign (mathematics) Different (Kate Ryan album) Process (computing) Endliche Modelltheorie Physical system Scripting language Texture mapping Arm Mapping Sampling (statistics) Bit Computer Connected space Digital rights management Message passing Process (computing) Auditory masking Telecommunication Interrupt <Informatik> output Self-organization Pattern language Right angle Cycle (graph theory) Freeware Arithmetic progression Physical system Reading (process) Writing Modem Spacetime Firmware Laptop Mobile app Wrapper (data mining) Computer file Observational study Real number Letterpress printing Virtual machine Mathematical analysis Coprocessor Rule of inference Revision control Causality Bridging (networking) String (computer science) Operator (mathematics) Gastropod shell Ideal (ethics) Representation (politics) Computer worm Spacetime Selectivity (electronic) Software testing Data structure Message passing Booting Traffic reporting Compilation album Modem Task (computing) Condensation Matching (graph theory) Key (cryptography) Interface (computing) Computer program Skewness System call Software Personal digital assistant String (computer science) ECos Gastropod shell Communications protocol Library (computing)
Demon Context awareness Code Gradient Multiplication sign Disk read-and-write head Mereology Electronic signature Proper map Mechanism design Sign (mathematics) Component-based software engineering Bit rate Different (Kate Ryan album) Algebra Information security Position operator Physical system Email Mapping File format Data recovery Binary code Bit Electronic signature Connected space Digital rights management Digital photography Drill commands Order (biology) System programming Normal (geometry) Right angle Summierbarkeit Modem Firmware Point (geometry) Computer file Patch (Unix) Data recovery Online help Rule of inference Product (business) Revision control Session Initiation Protocol Latent heat Term (mathematics) String (computer science) Software Program slicing Computer worm Booting Metropolitan area network Form (programming) Modem Patch (Unix) Projective plane Content (media) Extreme programming Cartesian coordinate system Word Pointer (computer programming) String (computer science) Formal verification Key (cryptography) Table (information) Family
Point (geometry) Computer program Stylus (computing) Link (knot theory) Open source Divisor INTEGRAL Multiplication sign Flash memory Source code Open set Number Wiki Medical imaging Mechanism design Term (mathematics) Natural number Internetworking Software Computer hardware Authorization Ideal (ethics) Computer worm Endliche Modelltheorie Extension (kinesiology) Information security Computing platform Addition Standard deviation Information Forcing (mathematics) Digitizing Projective plane Code Bit Line (geometry) Computer Concordance (publishing) Wiki Process (computing) Software Personal digital assistant Key (cryptography) Whiteboard Information security Freeware Modem Reverse engineering
Moment (mathematics) Adaptive behavior Computer hardware Coprocessor Event horizon Modem
Arithmetic mean Serial port Video game console Routing
Point (geometry) Personal digital assistant Source code Order (biology) Combinational logic Video game Endliche Modelltheorie
Wiki Mobile app Arithmetic mean Digital rights management Process (computing) State of matter Auditory masking Flash memory Queue (abstract data type)
Sequel Surface Archaeological field survey Instance (computer science) Power (physics) Product (business) 2 (number) Digital rights management Process (computing) Software Software framework Right angle Figurate number Family Metropolitan area network
Module (mathematics) Semiconductor memory Forcing (mathematics) Formal verification POKE Cellular automaton Musical ensemble Partition (number theory) Modem Electronic signature
Link (knot theory) Observational study Hypermedia Slide rule Software Network topology Internetworking Computer worm Graph coloring Modem Modem
Hypermedia Median Cartesian closed category
you the hour day so the next are told that sector modern.
before the cellular modem says this is by harold delta and. data and i was totally mispronounce sorry but the idea. we store in the previous presentations on smart cities that there's a lot of iowa t. need to communicate.
i'm and while visit be immoral and and other products calls most likely they're going to fall back on what is really their try to improve and and those are the three g. four g. modems. i don't really need to introduce our speakers today they're well known for years and years as he hears here at the congress so i'm going to pass it right over to them and have a great talk.
if you live. so they were going to talk about selling a modems just a differentiated it's not above base band or basement expectation it's really about a just and monte last riggio four g. model our talk is going to be structured in a couple faces first of all our motivation on why are we looking into.
where are we coming from the second part will lead to the history what have we done before in terms of modems. looking at how we we pick the modems were actually looked at than something that we actually didn't expect when looking at it. also are looking at the firm were upgrade mechanism if there's one how it works what has been done and we will finish with our recommendations and wishes. first of all were implementing jeers and specifications for more than a decade now. it started was humble beginnings of sending eighty commands to more dams on more by line and devices to actually working on a free software smartphone and open moko and then working and open be a sea and also com to implement and radio area network software and core network software and has been eight years. since the forged presented about power than modern smart phone hardware looks like it's seventy years since we.
worked in austin combi be to run on based on software on our commercial grade hardware and professionally we have worked was empty and devices and have built and tim the voices or cells using two g. modems and from this point we which started to explore how which kind of.
the device would be used in modern embedded devices or and two m. or higher two devices the states for our implementation off three g. and fortune network software to if you send messages over the air and you don't get a response it's always difficult like to do in coated correctly was a. the sand so we looked into having a device that allows us to to get logging to see if the message arrived four strokes in our even a able to extract the traces from it and was also important fast and got us into a small comment openly is see is to build tools to allow others to understand how. sela technology works so while t.c.p. ip might be well known to many of us how the eyepiece actually transmitted back to the core net and brought it to the internet is not said clear and we want to make it more visible and having technology and tools helps force. for brief moment a picture yourself trying to build sir classic and to any device you might pick a modem because it's already certified an easy to use but you need to run some application called on it and the traditional a peak an approach would be together microcontroller or a bigger problem. assessor and connect these two devices using use be your cereal but it means that you need to have a big a p.c. be more power consumption so it would be nice if you can run application software on the modem itself already and one have seen driving factors for this to reduce the p.c.b. space to have a lot. power consumption safe on the bill of materials have been fewer components and tax and we found something it's called open eighty it's done by sarah violence and mostly lost his right to see software which isn't compiled with g.c.c. and uploaded to the modem and you can start running. it will be loaded into the real time operating system that runs as a normal process their snow i'm you know privilege separation so if your application creches the entire modem will crash. to east the bargain survival assess like a nice tools to get output and send eighty commands and locking the bargain but the problem with this approach is that if you build an application and make its stable you know so much about his open eighty stuff that you're mostly locked into this is a p i saw the or architecture and software is. following what and open eighty application will look like amazon your spend years developing an application and suddenly there's no possible for g.e. so you're locked in and even your two g. modems will be discontinued. so it's it's a nice pass from to get started but it's kind of the dead and. and this brings us to like our modern requirements of what does a good modem look like. and one is we still want to be able to run our own code in it and not like some tyson scraped are some limited jogger but like all or real see application with access to the device that no artificial control group don't want to be locked in by a single modem wonder so it's might be ok to use a specific chipsets. but we don't want to be forced to follow whatever the modem supplier wants us to do and four for the blocking purposes we wanted to be able to get locked messages to see what see more them is doing see if it's string of waste of the back out to be able to control it. and for three g. and for the development we want to be able to see his radio messages and you might know what to call its called more has been written by but to be yes and no is allows you to get tracing information from infineon bay spend but has some limitations so we want something like school one but four g. pair s. edge. u m t s n l t. the. modem market or generals easy seller market is kind of dominated by by qualcomm and its kind of set by itself but also means that. um. you pick a motor most likely drones are more space than a quantum chipset and qualcomm is very close to what we want from a modem because they expose something called c d r protocol and it's also used in many different qualcomm products from the be aged years and took them to. the cells the first time i personally heard about of was at the twenty eight c. street but talk from your that looked into the base them qualcomm's that and star protocol the framing is very simple it's like classic h t l c with sir starts and and marker was a comment bit some payload and the czech some. and it's used for events like if a few modem switching a network to get an event you can and able logging and send you get a lot of textual output but also for commons and response sore you can send the commons to retire memory address and to get likes value from this memory address back and the. it's really their thousands of different messages that can be sent or received and in terms of free softer implementations like see more than a minute show or g.s. employees are only use a fraction of these available messages but it means like says this type protocol something you want to have direct access to because it allows you to see what's more them. doing and brings us to the point of selecting a device that is exposing the uk and in the past the option i can stick might have been a very good as the device to use speaker says exposing diet on use be out of the box but it's kind of all that's using old qualcomm software its limited to two g.. and three g. so we look into something more modern and one of the devices we found is from or shine is more to manufacture called crack tell its he you see twenty it exposes direc. out of the boxes even documented in their heart for interface said it's a diagnostic interface but sadly doesn't support l.t.e. so if you look at our modern device that makes sense to not go for two genes radio only but also have an option to go for four g. which bring for us to the e.c. twenty it looks. like see you see twenty what has l.t. he saw that sounded quite nice. for building a product that can be his shoulders to your b.c.p. but for development purposes they also offered in a mini p.c.i. express form factors you can just plug it into one of your devices that might already have many p.c. i express so we pick the e.c. twenty s. like a model we want to look at its and. once we started to look at us like secret com and the and nine six fifteen ships sets which surprisingly is also used in the i phone find them but beyond that there's not a lot of documentation of what it has which brings us to the unexpected surprise so up after i got the modem. i used to eighty command interface just to play with it to see if my application could do what it once and was hanging like after day and i got involved with the supply of some of them and they gave me a firmware update which was the same file and i unpacked it and our.
the finance looked awfully like like a line system which is why would my more than ever line system and its but maybe i'm just mistaking it as and their flesh to and looks like the flesh to of android was fast foods but like or maybe it's coincidences or worse of it was just country.
into to use it but actually other people have already seen that likes the end the and nine six to ninety six fifteen runs lineups on a bit like it's the contrary six by mickey a shot cotto of so apparently it runs linux on your modem and the question is why why wouldn't even run line. seacrest qualcomm's known to have put or ip stepped into the modem ip said sit why was i stopped doing it and it didn't really make sense so we started to look at it and also the other was no information at line is actually runs on this device on. which means no written off or so i use the our minds j.p.l. tools to on taxis the flesh file system really look like line access and i started to look at some of the binary said are not standard but these are quite tell a quiet calm specific and you see funny. things that look like a tea commands but like eighty plus lancs documents comment what would you do and and at this point we started to explore both technically so what is this platform really looking like but also from a legal point of view like can we please get the source code could you please put a written offer in it. and at this point to hand over to forge a few he saw as a lucky coincidence i have been doing some p.r. for spent in the past so all twelve.
ok but first he started to look at the hardware and i'm well if you doing hard for any way a professionally am and you have all the tools and and the process and your partner's for assembly and so on its on why not just a couple of course to help you with the task at hand so many of the many p.c.i. express.
models that you can find fossella modems they have additional signals on undocumented opinions of the many p.c.i. express connector like to see him on your even new arts and so on. and well of course if you just put the modem in a regular p.c. main board or an embedded device at those signals stayed they don't terminate anywhere there's just not used on the slot site and sold rewires to or the picture from any p.c. i expressed board is not very convenient so i created the what we call and break out board. and you can see a picture of that is an open hybrid project schematics and everything design firms have been published so you have this the connector on the right hand side which exposes all these extra signals am so you can actually easy access the various on undocumented signals so the easy twenty sold them on your documents there are at the back.
you are pins which are not the normal you are pins and which you speak eighty commons but is additional you are but it seems like not all models have been able so we bought models from three different suppliers they all have different from a version is and different. their configurations and some of them have enable some not but those that had enabled have added one point eight false but how can i say. in their wisdom the designers decided not to expose the one point eight volts also trail on any of the other pieces of the modem so you have external just the of three were three point six wells we went through old and so on benoit one point it all and since in previous projects whenever i needed to attach to you are one and an embedded devised i build and. another level shifter for specific golden child he had built for two point eight two point five two point three walls before i decide to kill its to a board that is the most evolved as you are so you can actually selective all touch of you are with the smaller rotaries which and connect to or was the reports of various devices and that's what's years also another often.
a project at arsenal and young and then yet actual cereal for and you get in as long and drawn to end their interesting lee if you were a look at the year from rapid fire that hoggart just mentioned it contains of course an easy possibly be a fire and there is a only address passion if you do a little bit of fast would quickly use. the only linux one two three is the real facet of the rice have sought by now we were two hundred fifty percent sure that there is no all that there isn't isn't the device.
and yet this by the way how the full set up looks like you can see i saw this modest no three been handed to get access to the e.u. art on this model.
the display of we could start to explore further so ok brings us to the top it off world where can we find the source called the model didn't show up with everything offered and ship with a licence takes that didn't include source god it didn't even mention that linux rather keep your license after was used soul.
digging around efficient supply of it that the manufacturer didn't have the added release anything i didn't provide any such information we are looking a bit around because i mean it's likely that the devices to the same and we found that actually a crawl com is publishing a complete open embedded build system for building or linux for those more than trip said. it's so this includes the open invited me to l.a. as the crown and the blog. various other bits and pieces and it's almost completely undocumented i visited some good referee was and you can peek are on them but there's not really. the documentation on to use it and i'm well if you look at their entry level website of this open source project from a crock on which is it called aura well dressed as like literally hundreds of branches in tags and you don't really know what to use for what and this able to says one example a version that you can build and then somebody you think years ago posted well i tried your. actions but while it doesn't compile and facing some issues and of course nobody ever response because well you know is why would he ever respond but anyway it's its public and on their website you can find it and you can can start building so we started building that have cost us we also ran into the issues that didn't build but anyway when the end we we managed to build some of the. call me my we were talking to the manufacture of the more them and asking them for the complete increase funding source code and what they send us to complete and corresponding source code to the from rapid tool that you're on your host p.c. which we didn't ask for and it was not the allies as the still receives design schools located nice the future. a. it's good at that point we could understand how they found out that product works a to watch the modem. and then while you ask again for the completed corresponding so i scored all if we never been by the all the titles and grammar issues are not introduce basle we never been a legal dispute and we always make sure to understand the intellectual property rights ahead of using technology line to a third party well clearly they did not in the last case and this and just as nice little letter. that isn't except from it it's like all the always respect the importance of intellectual property rights and laws and we actively engaged with that no one is essential intellectual property right owners apparently the copyright owners of linux and other fees up for are not essential. and so on in order to comply with the right side and you ask again and you ask again so you see very sick we always ask the same question is like all the appreciate the efforts this was a lawyer and often it for id table project did miss the fact that it's multiple tables and with singular but anyway. then your client me doesn't have the rights to empower copyright all ok that's new to me and and they claimed that i had transferred my copyright to the freezer for foundation which i never did and and which nobody i think your distance highly unusual if you work and in its kind of call to do so so i did not have copyright. ok anywhere and qualcomm all air sorry for my mistake quick to i always respect intellectual property rights of course. uk saw still also score then we asked again and ask again world and thank you for your return explanations start of our we will provide attire ball and then got the always willing to achieve ti vo compliance for and so on as one and then another month or so passes and then i finally well we do some legal and four. when we design warning notices and so on and then how are you not perfect and we cannot constructed for direct said which i never requested and with just one is a source courts and and then well you get some source called and it doesn't build and and say at all there is a head if i'm missing and by coincidence that they had a fire that i. year old had hosted design intention i mean how many had a few you know at the tables there is a match for the differentiate the service is sick or pointed you see people using the i pad and that has had a fire was like eight lines of of your boy left. related emissions and this was missing and is no we don't have this file and qualcomm also doesn't have this fight and talk on never provided this files are as i mean it's in the public repositories the call can also an encore and the kind of doesn't build without those files and then by the way we will not discuss compiling issues by human anymore.
ok then some more time i get more and more than you get in the video had a fire as an individual e-mails and you put those said the fires in your car saw street.
and then you see that at the scripts in the crown of missing executable bits but certain see fire suddenly have executable bits and and then another had a file is missing and so on and so on but by now we have received various ask for todd was they interesting the content not only the geological call but also other called with like used. these type of i've actually tab licences were they wouldn't have to release it which is good and it is intentionally and i'm i think it's it's a very nice sign of them that they don't release only what they have to buy the release more for the easy twenty it's still not for a license comply and there is no busy box or scored included for example another busy books would ever have done energy parent for some in the past. and and while but that's not my primary concern and may i think it's its it's getting there is work of and you can use the source code that they release interesting leaders are them and motor manufacturers like zero s. which are also building more dams on such qualcomm systems. and they release not only the source called but extensive documentation xo this is a small an excerpt from a screenshot rate actually all they describe how to build it is often embedded to describe how to use fastball to install the firm on the model and so on and so on. however there are as good as they are new open source i did try to lure customers into a proprietary framework like they did with open eighty in the past and that well again would result in vendor larkin's on its not read the recommended as a smart will have tools to go ahead that were and with that going to hand back to aga before. returning later for a true.
we're going to be very briefly look at the heart where it's a quiet calm and the and ships that i've already mentioned also in i phones and it turns ald maybe new future car on at least right now it's of modems from cartel and sorrow sarah violence but sadly from a free software point of your like it.
frontline arcs talks to the hardware but there's absolutely no documentation about the heart or in the internet like even on other websites not nothing curse and brings us to the hunter overview so we know there's a bomb process and side probably hexagons are. that somehow. nothing so that's very frustrating to have spent many years on on free software to see lineups winning even getting into the modem devices but no harder documentation being available for even if you have to and not even a program here is nothing on that it's look. the software part and explores the fifth system from a softer point of view. porsche's shown how together serial console on it but not every modem has enabled and we didn't look at what it takes to enable it and also soldiering is not that nice so after exploring the easy route follows the amplitude process them so resort runs an android the book rich so if you have. used android so eighty be shall should give your shell and nicely we have already seen the eighty plus cubans comments to execute something on the device and reform found the scripts as reconfiguring the android use be gadgets to actually puts eighty be in it as well so that's tried to execute the eighty come out. and on and then suddenly the syrians on your host line of stone work anymore curse as easy ways that you see a q.c. several column on the list written and its matching advice based on the number of interfaces and if you add its eighty beater as you suddenly don't have for interfaces but fife in the faces than your drive. i cannot identify the device or we had to first tech a bit and before she has made more clean patch to actually get a but after this small experience we have eighty be shell on its it works on any model. and a t.v. shows root of course women thought you don't need to devise it's like you get that would show immediately so there's no lock down as well its roots there's no as the landmarks and just a very nice and open atlantic system on to build towards its its it's a bit ought that it has a book loaders it.
seems to be proprietary then has the android would load or and android lancs congo. the under the book which was mentioned but surprisingly it's not using the rest of the android system but it has a new lipsey was busy box use the land system fife in it so it's a very classic open embedded built and its actively developed and and maintained by qualcomm but some make so many releases are actually don't know which one to pick its. it's about a visit from here and then you start to look of it at the latest on that is released and luckily and interestingly and to my pleasant surprise that that's not binary only chronological so everything in the crown is released in source code nevertheless across it's a lot of source code us all if you look at little bit at the.
the number of lines and defrost up between the closest mainline aversion and other candidates used in those models the end up with one point five to one point nine million lines of if i mean this is not actually called lines is counting all the lines of a development including the context but still he gives you an idea about in this size of the differences and compared to main line and of course. you expect on those grounds that is you know all the c.p.u. specific staff and lots of driver cold and so on and so on but then if you look at it in more detail and as a disclaimer i haven't looked at qualcomm android enough granites the during the past ten years old and want to see eight years not six years whatever long time and and. no there's a lot of called in their side i didn't expect all the different things that i found in there and never on should memory of a group based logging infrastructure and share memories not shared memory with the modern process it's only shared in indiana system your friend in the process of communication logging process that if you see is not to into process communication that you would know it into a processor. communication and you have something which i have completely flabbergasted means called remotes been locks north been lark you you basically you you you have usually do it next to the mechanisms only one thread on it one c.p.u. can enter a critical part of the cold. on your mouth the process or linux system but then here you can actually also block of the modern processor i'm actually going on the other side from entering an articulate section what could possibly go wrong if you hold and if you keep the real an operating system in busy waiting but ok it and yet any look at the source god and i've. actually says i haven't looked at clock on current also asked for quite some time i was expecting well this has been all these limits android phones that have called on trips that's and lots of plans is often source we have plenty of people must analyze it and are certainly some documentation is a high level of you but all these individual subsystems how to glued together on how this works and i could just. look this documentation a look at that occupation but interesting leaders and exist so i had to start to write that documentation and it's not a lot of information are wiki and some of the interesting parts that you find is saying there is the shared memory device which is the core of all the interaction between different c.p.u. course years into a process of communications you have remote now. network you have a pam was also a bamboo bam is the past sexes manager in and we have i.p.a. and this is not your favorite beverage but the internet packet accelerator. in and day there's some diagnostics forwarding and so on and if you look at these subsystems i i draw a graph you know if you normally in our air that is i drive picture and them is to to symbolise the what's happening in this is a mordant saul if you look at this picture you will see basically the day he lied. or square at the top is the the application process the bottom small part is the modern processor about which we don't know much of course but on the outside utility of source code we can see what's happening so you have to share memory device and you have channels implemented by the shed memory device an individual different subsystem binding to those channels as to four. eighty commons which matched to the air serial function gadget of of the u.s.b. get record in the next so basically and the important part is to see that. the u.s. be used the queue don't speak to the more them actually to the modern prices are based in brazil but you speak use be to the limits gadget inside the linux army corps on those devices and and that limits are or four watts or handles differ in their faces are on a u.s.b. configuration in different ways and if the small box. symbolizing the use of space and you can see how the different pascoe it's quite interesting if you look at the syrian forty have a serial point for g.p.'s and you have a serious for four at the commons and you think well ok these are both cereal for devices they must be handled quite similarly but no and the g.p.s. fire is actually handled and here over here it goes into use. the space it's bridge that goes into a virtual cereal for here again and it goes into this year again just various the eighty come and go straight here inside the crown and end up in use the space so i don't know why but it's the quiet sophisticated to sing and if you look at the diagnostics of system which is particularly of interest to us and now you can see. the i didn't draw graphs anymore i just wrote a little bit of study and if we have at the modem these be on the left hand side we have the then we have to learn as crown where we have a shared memory device on this diet forwarding model in the colonel binds on that we have a connection to the diagnostic function gadget off the e.u. is big. a driver and that this goes to your whole so if you talk to diet protocol to the modem it actually goes this way through linux through shared memory device in the mode and use be but what's even more interesting is that there is a diagnostics character device on linux called the f.b.i. act which will for example to queue marks the other processes they basically are attached. to this the diagnostics device and all the logging that you find in those the most users face processes they don't use his locker don't use an android looking for work but they lock through the call come diagnostics of system and you get the log messages of those processes through this kind of device over to the function devise over to use been to the host so if you manage to figure out which. the logging and flags and son to enable you get the larger output of those limits use the land process is over direct very core com like a not so surprising but still a sort of unusual in linux well if you look at the networking the q.e. my which controls your basically the modem which network you attach tool whether you activate. p.d.p. context you're curious for amateurs and so on you might have used to cure mice year i or other tools on our new linux their laptop to talk to such more homes and in this specific case of those linux based crocker modems well you can have the most india's few years ago through shared memory device. talks to the i.m.f. device used the gadget use pujols than any of your most p.c. summer on the right hand side over there so this is basically the past few q my takes but then you have also q my in the user land on the mall in itself which is what's presented here and they have what's called a queue mark steel the human eye multiplex a demon.
which an office a unique stoneman sockets to various different giant programs so basically all these use of space programs by using this unique storm and socket they can talk united the modem as well and all of them can basically year are configured status reports and so on all the different parts of different services on the model which is interesting. this across something that we want to have the coming from our initial motivation you want to run on applications in there and you want to talk to this q marxian and talk you in mind there so we created a couple of tools to help that the analysis i'm on the one hand side we use the open imbedded.
all com released to build a matching opie kg and packages for for tools that you need like so bad as trays as a reference on for some exploration. i also have written a couple of see programs for testing basically fire accessing the cure my from called inside the more them and that successful and then we have a couple of the those still linked to the proprietary live reserve that provide in the more them and we have started with some entirely are free of an sos program. and unlike the cumulative wrap rapper which is an l.d.p. real alright library so you can trace this q makes the communication and there is ongoing work for a live to an ideal of transport for the skew marks the. ten would enable you to run a program that's linked against the free software leap year ideal live inside the modem so you can develop it like you're running on laptop but you can run a transparently inside of the more them after cross compilation. there's also a tool which we call smoke you see diag which is basically a host a tool and far painting these the uk based blocks from from the more them so you can run this on your laptop at actually to the more them and then you get all kinds of traces not only the end of face traces but also q my protocol traces which we then again he called using live human eye. so you get extra representation and this ongoing work here to basically and move all of that into why a shock so you get the full the call of that in wire sharp but that's not yet they're so what kind of used his programs to the final get a d.v.d. we know what that as we have an a.t.f. w.d. demon eighty forwarding. the mainland that what does he do it implements those things like an eighty plus kulina x c n d and other eighty comments are basically use the space program on linux can register like a call back within the more them to forward certain eighty commands into the most use of space but you can then implement them so you can basically. implement custom made he commands in users based programs there is all kinds of other software which we haven't really figured out the it's a lot what they do. and one and munster called the qc map connection manager which basically allows you to express wife i x's find with at the back all you need for the title. basically you have to attach. my fight shipped to the s.t.i. or interface of your modern model and then you have a four person to access find a device that has an l.t.e. back car and then the wife i a us like the parameters for example the key and yes idea that shannon's on you can figure all of that through through what eighteen months of course. if you ever wanted to look at software that receives eighty commands and and generates textural conflict fires far w.p.a. supplicant and foremost a few demon and you can look at this called and i prefer not to so we have the corrective bridge which while is very simple device it reads from one device. i was invited to another device and apparently this is a such a complex task that you need to schedule a different process and i think it has three threads or something obscure like that so ok well which brings us to the funny bits and pieces that you find in those modems while the first thing is eighty plus chronic u.s. command we spoke about that you can run and. the traditional commons as rude in read write rule five system in their own. basically you can do anything i mean you can send an arm at the sharp selection and well it's gone it's dead jun so we also have commands to switch to fast food more so you can update the from where you have. especially the command to printed the mask and there you have also all kinds of other yet the commons and when you when you do or strings justice strings car on those executed as it looks like shell scripts in many cases and one of the most funny things i phone in this modern was how many processes and threads does it take to rebuild the system is apparently a very. complex a question. how do you rebuild your system. apparently this was the easiest mess that they could find so there's one process of the riba would die app which registers a direct command with common causes are extremely nine with the diet in for a structure and sponsor thread which executes another executable called q my simple real test with an input five full and then it calls system eckel mortimer's. said in so to have to write more in research into the five fall of the input of the process it has spawned which can cause this to send a cure my message to the modem which will rebuild the basement processor and then of course you clean up you remove the temporary file because this g m p is not a temper first but it's read write files them and then it. goes on to write the string reboot into slashed f.'s lish reported deaf using efrat not using eco this time right to secede program officials grip so and finally they discovered that and used f. right and and then we have a report team in a second process again with two or three threads which reads this reporter. eyes and then actually they publish the source code as though this is that the actual source code and i so you read from this everybody rise then there's a nice common document and what it does a you do a string compare you have the first print f. going for he would you have a second print of initiating reviewed and then you call system on the reviewed executable saw. separately the most simple matter to a huge so if you ever wondered how we would report your neck system this is that the new york difference. yet and we have seen progress that look actual script so this is an actual of course condensed output of strings on the corrected human rights you see like colin says of his fires you see copying files and even semicolon in there you see a call in to deduce the cycle of some samples modulation idea what that does and then the. given graft for for the process and and they kill process is no with the most of your things and even they don't use reader but they do like s. and in part as the output of that rather than use open to return the usual cause you would do to get its defiance. it's quite amusing. yeah which brings us to another topic offer from out this study you can actually missed his examples i have to make a quick interruption here and all these machine to machine organs that typically have an immediate the blinking rhythm of the lady indicates to us whether its registered to the network whether the data connection is open with a searching for an average that's all the. in drinking patterns of the early the howdy implement this is modern while you're on a user's based human that cost system as a whole one to the f.b.i. all which controls the l.e.d. all the time not to blink the lady it's not like the cruel would have infrastructure for l.e.d. drinking patterns and and signs on.
but took a us all you have a demon there's nothing else but basically probably your t.v. i owned by spawning show process is using the system says costs. with that i and overt are huge. now the question is do you expect anything after is a topic a former operator was going to be an empty slight.
and the answer is they know that they have to offer from work rates are over the optimist making it the smallest possible and actually it's something that qualcomm is preparing for modern wonders so it's based on the android from around four point zero zero recovery gets not using android. delphi i have a book that hard work before many of you might be more family was it but it's mostly a sip file it contains still top dates and surprisingly there somehow the hashed to to a child one and then the child one is being signed with or was a private key and see resold is being put into a calm. and off he said file that's probably pretty standard that looked a bit off and it's nice that they prepare probably secure for more upgrades was like many of them to function the so what has cracked tell done to this cold. still use it that's it's quite nice but they have removed actually not really removed but they're not using the arse a coach to verify signature and instead of using the standard android way to to patch the system's a user propriety company and from a company that used to be called threat than. but now is how men and probably soon sums on. and this threat and components is nothing that the correct has written but it's a commercial product and it's used in the quick tell you see twenty mt us well and also another automotive projects we have seen read. updates been used so at this point i started to look into how does his opted for meant look like and instead of presenting a very complex form of the former i have this slice so other people like mess use only get the i think back at percent of something called a tax on all my device management. these can be remotely triggers but is easy up that mechanism used here cannot be remotely triggers easy modem needs to to be asked to start and updates that's already a bit more secure birds on i started to look at the extremes offers specific delta update and was a lot of help from the. the spa actually managed to understand how the updates binary looks like and we have created a small tool to take an existing updates and put it into smaller parts and also be able to create our own defiance. the format itself with as many different pointers and offsets for in in the example you might already see the offsets here and compressed sized so it starts with a common header and then it's after they had or your of else the i'm a compressed the table of contents. or however you want to call it and outside in the head or you have or offset in to see the compressed the version of his table of contents were actually file updates starts and when you start playing of creating your own file you might get the offset wrong and spot as the update binary just precious with you. malformed up to file so it's like not very robust code a very complicated far from out of nothing is cryptography signs so when you use strings on the binary you see the word signature but it also on the reference to see us he said the to check some home. the next time like now we we understand how the update form it works we can create our own update files the question is how do they end up on the device and it's something that is implemented in the eighty four words demons that heralded order for just mentioned an issue. the scrap for some specific strings like w. gets these q.c. map connection man show a photo updated said you already kind of gas houses application works for you to share an eighty command was a your alf operating it in term its rule disable your normal ip connection that you. of might it have wished on your host and opens are the p.p.p. context on the device itself using the qc of connection masher than it was born w. gets to download the file than value system to him to move its to do the right to recreate it will remember what it wants. to do with his file and the drill reboot into the recovery position and system at this point the updates if i will just be applied and the system a reboot once again again without any creature graphically a signature or scheck so if you manage to hijack is easy up to process you can install any binary on the device. all on the remote them or anywhere else on the system as you want so but instead of just seeing how competitors we want to say like what do we expect them to do and i'm handing over their of the get here so i'm rather thing all this is all bad it's on locked in his in secure and so on.
well it it's fun for us of course because that's what he wanted right we wanted to and a modem device very could do basically whatever we want to and we don't have to break a sophisticated security mechanisms that are designed to keep the user or the customer and the owner of the product out so yes there are security issues and security issues must be fixed by that we need.
the security mechanisms that work without locking are the user of the owner of the device of course saw this is our probably call to the manufacturer is if you fix those issues and keep in mind that the openness of the platform is interesting for all kinds of digital abuse cases a year and while you want to. protect against the militias that actors you of course still want to enable the actual owners of the device in the users of those devices to use the flexibility they provide because this is not a lot of it. a. so what's the status of an outlook well and we have just opened to the wiki on the assets on last either all the links on the arsenal com project the nine week before quick turn the clock on any more homes were all the information that i gathered from reading the. the thousands and thousands of lines of source code is in there and we have released a devout tools a presented in this is a parka a negative forces are in source code and the hardware boards are released as often our brand of a little more and that's unfortunate is the ongoing is still a few an ideal of integration which is thought to some extent to the. fact that i've never written anything and skill of before anything inside a program that uses to live like all this infrastructure i'm usually more low level and that an and twelve he hoped to grow this documentation and read kindly invite all of fuel bills interest in a while understanding those platforms better of us all that you don't actually. need to necessarily year you know reverse engineer in december things is just read the source code understand what it doesn't and play a bit with the device and we are planning an open and better package feed so we can actually easily install additional everyone can easily install additional factors on on those more homes and there's plenty of flashes. i think it's like twenty thirty megabytes of free flash terms of you can install quite a number of additional factors in their and. our aim is to have for free software only use the land on this quarter to quarter it's a five seater you so to do away with all those proprietary process is the run he uses face in the libraries and randy year. one source colonel and half are basically to slip you might feel of integration and other bits needed tool run our own standard linux users and called in there. have custom images that we can run on more dams in in four kinds of use cases. ok now before we go for q in a in a minister is an unrelated announcement that we would like to present year and the outcome project has gained support for running your own three d. three point five g. network during the last year natural whereas noticed that unfortunately is suffers a bit of a lack of contributions so we want to motivate people to contribute more. and then we have trust a star and accelerate three point five g. program which provides fifty three three point five g. femtocell say to people who can convince us that they would contribute something reasonable to our project sell the same process already supported by the author of concord so using the femtocell and the arsenal concorde you can run your own three point five g. network. given those away for free so if you're interested in any of that please submit a proposal until the end of january and then you will hopefully receive your free femtocell until the end of february. but how. which brings us to question its yes our skin a time we have a total i have eight micrograms here one two three four five six seven eight i do math.
least up to the microphones to ask your question meanwhile we have from the signals angel we have a question yes the internet wants to know if there will be in quotes next top model that.
i'm not not from us know we're not working on a mobile phone i'm looking at modems that not have mobile phones at the moment.
so microphone to so just to clarify does that mean that the next runs on the i phone five we don't know we don't know everything having to hear from you if you can find it but i think you can run the ship was something else on this cortex processor.
then we don't know. single central europe.
the event wants to know why they are no money peace a expressed slash and two to a u.s.b. you three adapters because they think she is capable of at least three hundred megabit sent us be too could be wanting. and how i'm not really in the business of manufacturing are selling adapters or mean yes we did this of an oddity rise out of a specific need that you would have to ask the hardware manufacturers that i'm sorry i'm could ask the people who are leaving to leave quietly please huge.
microphone to. by the and thirty c. twenty you with the you break old border and the you work as a single get some work. you can contact us but it's not really something that we're have for prepared for but yes it's certainly an option and but that mean we're not here to sell you anything we're here to invite you to help us learn about morgan's things and was the android people shall you actually don't really needs the serial so you can refresh the device using us.
even if you break it can be refreshed and was a t.v. show us your route shelf so that's for works and was eighty q last comment you can actually started looking in on the enemy a console as well so even if a t.v. doesn't work you can get a lock in on it so it's very easy to get started without serial signals and. so.
do you have ever tried to get source code from about manufacturers. i'm.
so we know at this point off i think three different manufacturers that use this the m.b.m. nine six fifteen plus linux combination from quick to we have just described how and when to sierra has published all this already by themselves the in in a very good ways that is no need to ask them it's out there you can just don't know. it is documented and the third one is an old end of life while away a model where we have also asked but the this is still ongoing. now is is interesting needed from a chinese supplier you get the excuse orders christmas coming up for his local cases so many christians in china but ok but i think i'm quite sure if asking generate is all there is chinese the year coming up and but we'll see about that. micron four.
you mentioned the year clock contributes to the i phone five and does this mean what can i. is it likely that does the i phone application process of talks eighty commands to does the clock on chip this is still the i'm state of the art know if not said if we are now i don't think it's happening i mean he also on these modern novels and the eighty come and is therefore a legacy purposes you have.
the queue and i exploited over us be and normally you that you more the manager or your of whatever use a phone or whatever infrastructure toxic you might have those devices. i'm going to go back to the signals angelica now the questionnaires what was the total size of the flash on would have asked on there and how much ram has this thing that i have now i don't remember his flesh so i suppose rambis thirty two and megabytes there is this the surgical mask.
most of them on on this at the successor the easy twenty five has one hundred twenty eight makes of ram but of fresh eyes i also don't remember not to a check out the wiki we have blogs and in all kinds of like the mess got put cents on all on on the wiki so i'm quite sure it's summer in their microphone for.
you said that he tried to check like cattle in instance yeah wouldn't be possible to completely build your own come there and europe locations. yes it's certainly possible but then of course or if you do this survey you'll buy a lot of things with your money that you don't use in the and so on and you support a vendor that tries to lock people into this proprietary framework sell its the yes it's possible that we have.
use a framework i don't things are no you don't have to but i mean they developing this and fire of what you pay for his this framework and that's why their products are more expensive fill. microphone to do have some ballpark figure is about the power consumption in the last apollo question current most of our local and i'm quite sure it's going to be high and i think i guess some comment on that here so when you look at this device use as tries again secure marks the end it's like mostly waking up every. a couple of family seconds. it's not power efficient the sequel it's really really really annoying to see process that run all the time and from the previous light is eco ma'am to two of the surface that's actually said when stalin management so you can trigger an eighty command to have the device leave and of rights act or a man into. to fit into to go to sleep so it can be tuned and was a free software uses face it can probably be better than what is right now. signals angel again.
how accessible is the home based band like memory and like my and stuff. we haven't really investigators indeed have a very also haven't seen a signature verifications on their so i think it's completely open.
so is the dispute from where isn't a separate and three separate the partitions and there's no ours a signature and the end of the disease a petition so it seems that you can modified itself lockdown likes to poke commander that's something we haven't tried. right or looked at it. a microphone one that the modules readily available in the o.j. package rather than the many p.c. out of court like a porn star twenty use these an open heart where have they should be available and again yes i mean that they were temporary not available to the return force men turn back the i think an hour.
they should be available again and what of the color cost of as much as well. i think it's like forty seven in something euro's around that region of maybe but nor was most modern fifty but anyway summer in the region asia.
so one more question from internet and into and wants to know if you can capture our player to network stuff with this.
yes yes you can. so i think that they enter far q. and a session graham please join me in a way into ing the forge and harder on this fantastic talk about things that i really didn't want to know about three g. modems.