"Operator, can you hear me?" A Faithful Line into the UNISOC Baseband

• URL: http://arxiv.org/abs/2608.07143v3
• Date: Tue, 11 Aug 2026 17:51:01 GMT
• Title: "Operator, can you hear me?" A Faithful Line into the UNISOC Baseband
• Abstract summary: Baseband processors are reachable over the radio at all times.<n>Existing re-hosting work approximates the execution environment.<n>We instead model each surrounding component, co-processors, SIM, application processor, from what a real device does.<n>We call this method Unislop and demonstrate it on the UNISOC UDX710, a platform in an estimated 10-15% of cellular modems.
• Score: 21.992769252644205
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Baseband processors are reachable over the radio at all times. Their most security-relevant logic runs deep inside protocol state machines: the control-plane handlers that gate registration, authentication, and session setup. Analyzing that logic systematically requires introspecting the firmware as it runs, which makes re-hosting the baseband necessary. Existing re-hosting work approximates the execution environment and under-approximates the SoC complexity of the baseband processor together with its surrounding components, bringing this state practically out of reach. We instead model each surrounding component, co-processors, SIM, application processor, from what a real device does, and step them in lockstep with the baseband on one shared clock. That makes faithfulness checkable at component interfaces, rather than assumed. We call this method Unislop and demonstrate it on the UNISOC UDX710, a platform in an estimated 10-15% of cellular modems and in automotive systems, not systematically analyzed before. Starting from a Quectel RM500U-CNV module, we gain code execution, defeat its firmware-integrity check, instrument the baseband, and recover its peripheral environment from the running device. The resulting re-host reaches the same control-plane states as the real device, establishes a full PDU session, and carries real IP traffic on both ingress and egress. The recovered components are shared across UNISOC's baseband lineup, so with additional reverse-engineering effort the same design extends to further targets.

Related papers

• Analog-DB: An Agent-First Analog Integrated Circuit Database, From Blocks to Systems [0.0]
  We present analog-db, an open-source, versioned database built on a shareable design representation.<n>A domain-specific language captures each design as a process-neutral topology, reusable testbenches, and a machine-readable schema.<n>The database holds 68 circuits across sixteen classes, verifiable at schematic level under a tiered harness.
  arXiv  Detail & Related papers  (2026-09-01T14:22:37Z)
• Reactive Peripheral Modeling for Faithful Firmware Rehosting [46.071436745445]
  Reactive Peripheral Modeling ( RPM) is an abstraction that models hardware peripherals as reactive and stateful systems.<n>We implement RPM in Bluezz for BLE firmware rehosting and fuzzing, and show that reactive modeling is necessary to reach deep protocol states.<n>Bluezz achieves an average basic-block coverage more than 2.6 times that of prior state-of-the-art rehosting approaches.
  arXiv  Detail & Related papers  (2026-08-30T11:54:37Z)
• From Rocq to Metal: A Pipeline for Formally Verified Microcontroller Firmware [0.0]
  In this article, we show how formally verified firmware is achievable today.<n>We built Encore!, a bare-metal Continuation Passing Style virtual machine (VM) that runs Rocq-extracted Scheme on microcontrollers.<n>We also show how to structure firmware as a pure state-transition function, making its core fully provable in Rocq.
  arXiv  Detail & Related papers  (2026-05-31T21:14:54Z)
• Profiling-Driven Adaptive Distributed Transformer Inference on Embedded Edge Deployment [60.442064966340524]
  We present a prototype study on NVIDIA Jetson Orin Nano devices connected over WiFi.<n>Key finding is that the dominant bottleneck is not just network bandwidth but also the CPU- GPU staging during communication.<n>Experiments show that this strategy reduces latency by 65%-77% and energy consumption by 34%-52% relative to full-tensor exchange.
  arXiv  Detail & Related papers  (2026-05-25T10:39:28Z)
• QuCtrl-BELL: A Compiler-Driven Sub-Microsecond Feedback Control Stack for Scalable Trapped-Ion Quantum Experiments [1.9674381684480702]
  QuCtrl-BELL is a compiler-driven software stack for trapped-ion quantum control.<n>A Python-embedded domain-specific language (CFG) is lowered through a six-stage transpilation pipeline.<n>A cross-board synchronization protocol supports feedback loops with latency below 700ns without host intervention.
  arXiv  Detail & Related papers  (2026-05-21T12:59:24Z)
• Boosting Device Utilization in Control Flow Auditing [47.36491265793223]
  Control Flow (CFAud) is a mechanism wherein a remote verifier (Vrf) is guaranteed to received evidence about the control flow path taken on a prover (Prv) MCU, even when Prv software is compromised.<n>Current CFAud requires a busy-wait'' phase where root-of-anchored root-of-RoT in Prv retains execution to ensure delivery of flow evidence to Vrf.<n>CARAMEL is a hardware RoT co-design that enables Prv to resume while control flow evidence is transmitted to Vrf.
  arXiv  Detail & Related papers  (2026-03-02T18:26:17Z)
• BaseMirror: Automatic Reverse Engineering of Baseband Commands from Android's Radio Interface Layer [34.9710368289623]
  This paper introduces a novel approach to unveil security issues in basebands from a unique perspective. We have designed and developed BaseMirror, a static binary analysis tool to automatically reverse engineer baseband commands from vendor-specific RIL binaries. Our methodology has been applied to 28 vendor RIL libraries, encompassing a wide range of Samsung Exynos smartphone models on the market.
  arXiv  Detail & Related papers  (2024-08-31T15:14:56Z)
• Swarm-Net: Firmware Attestation in IoT Swarms using Graph Neural Networks and Volatile Memory [10.970843729732703]
  The Internet of Things (IoT) is a network of billions of interconnected, primarily low-end embedded devices. Despite large-scale deployment, studies have highlighted critical security concerns in IoT networks. Malicious activity on one node in a swarm can propagate to larger network sections. We present Swarm-Net, a novel swarm attestation technique that exploits the inherent, interconnected, graph-like structure of IoT networks.
  arXiv  Detail & Related papers  (2024-08-11T03:19:29Z)
• DeviceRadar: Online IoT Device Fingerprinting in ISPs using Programmable Switches [37.41464693677561]
  Device fingerprinting can be used by Internet Service Providers (ISPs) to identify vulnerable IoT devices for early prevention of threats. This paper proposes DeviceRadar, an online IoT device fingerprinting framework that achieves accurate, real-time processing in ISPs using programmable switches.
  arXiv  Detail & Related papers  (2024-04-19T09:31:11Z)
• SISSA: Real-time Monitoring of Hardware Functional Safety and Cybersecurity with In-vehicle SOME/IP Ethernet Traffic [49.549771439609046]
  We propose SISSA, a SOME/IP communication traffic-based approach for modeling and analyzing in-vehicle functional safety and cyber security. Specifically, SISSA models hardware failures with the Weibull distribution and addresses five potential attacks on SOME/IP communication. Extensive experimental results show the effectiveness and efficiency of SISSA.
  arXiv  Detail & Related papers  (2024-02-21T03:31:40Z)
• Federated Linear Bandit Learning via Over-the-Air Computation [42.69435493503121]
  We investigate federated contextual linear bandit learning within a wireless system that comprises a server and multiple devices. The primary objective is to minimize cumulative regret across all devices within a finite time horizon. We propose a customized linear bandits scheme, where each device transmits an analog signal, and the server receives a superposition of these signals distorted by channel noise.
  arXiv  Detail & Related papers  (2023-08-25T10:47:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.