"Operator, can you hear me?" A Faithful Line into the UNISOC Baseband

Technical Summary: "Operator, can you hear me?" A Faithful Line into the UNISOC Baseband

Problem Statement

Cellular baseband processors are always-on, radio-reachable computers embedded in a vast ecosystem of devices, from smartphones to automotive systems. Their most security-critical logic resides deep within complex protocol state machines (e.g., 5G RRC, NAS, EAP-AKA′), which only activate after specific sequences of messages drive the stack into an accepting state.

Systematically analyzing this logic requires running the firmware faithfully into these deep states. However, existing re-hosting approaches (e.g., FirmWire, BaseBridge, Loris) fail to achieve this because they rely on approximating the execution environment. By abstracting critical System-on-Chip (SoC) details or isolating single tasks, these methods either under-approximate the context (dropping functionality the firmware depends on) or over-approximate it (failing to scale). A baseband is not a standalone processor; it continuously interacts with co-processors (L2, DSP), cryptographic engines, SIMs, and Application Processors (AP). Reconstructing the firmware without the state and behavior of these peers inevitably prevents the firmware from reaching relevant protocol surfaces.

Methodology: The unislop Approach

The authors propose unislop, a five-step method for gaining full, faithful execution of a UNISOC baseband. The core innovation is peer- and interconnect-driven re-hosting, which models surrounding components concretely rather than approximating them, executing them in lockstep with the baseband on a shared clock.

The methodology proceeds as follows:

1. Unlocking the Baseband:

   • The team gained code execution on the UNISOC UDX710 (found in Quectel RM500U-CNV modules) by reverse-engineering the platform.
   • They bypassed Quectel's firmware-integrity protection by patching the Linux kernel module responsible for verification, allowing the loading of modified baseband images.
   • They established a foothold on the Application Processor (AP) to orchestrate the baseband subsystem.

2. Instrumentation and Introspection:

   • Static Analysis: They analyzed the firmware to identify call sites for instrumentation.
   • Dynamic Probing: They injected shellcode probes and trampolines into the Cortex-R8 firmware to dump memory, print values, and modify variables at runtime.
   • Trace Recovery: They reverse-engineered Quectel's diagnostic tooling (Logel) to decode tracepoint identifiers from binary logs, enabling high-level visibility into the running stack.
   • Memory Reclamation: By patching initialization tables, they reclaimed over 2 MB of memory for instrumentation code and tracing data.
   • Interactive Debug: An interactive debug task was added to the ThreadX RTOS to allow runtime experiments (memory peek/poke, packet injection) without rebuilding the image.

3. Reconstructing the Peripheral Environment:

   • Using the instrumented device and a controlled 5G testbed (SDR, srsRAN, open5gs), the authors observed the runtime behavior of all SoC peers.
   • They characterized the communication patterns (solicited vs. unsolicited) and interfaces (DMA, ring buffers, IRQ, MMIO, APDU) of the Application Processor, NRPHY co-processor, SIM, Crypto Engine, and NVRAM.
   • Crucially, they modeled the SIM as a synchronous peer (blocking APDU exchange) and the Crypto Engine as a hardware-accelerated MMIO interface, rather than abstracting them away.

4. Deterministic Re-Hosting:

   • The team built a QEMU machine for the Cortex-R8 subsystem, constrained to interact only through the SoC interconnects.
   • Determinism: They implemented a virtual clock based on the guest's instruction count (icount mode), ensuring that timer-driven protocol behaviors (e.g., guard timers) fire at the exact same virtual time regardless of host jitter.
   • Co-emulation Architecture: An orchestrator drives the emulator and peers on a strict "advance/yield" credit protocol. Asynchronous peers (AP, NRPHY) inject events at tick boundaries, while synchronous peers (SIM, SEC) block until the tick completes. This ensures a single thread of control, enabling safe copy-on-write snapshots at any point in execution.

5. Automated Model Construction:

   • The authors describe an agent-based approach to derive peer models by proposing hypotheses, implementing them, and A/B testing against the real device under identical stimuli.

Key Contributions

1. First Systematic Analysis of UNISOC: The paper presents the first security analysis of a UNISOC baseband, including the bypass of Quectel's firmware-integrity protection and the instrumentation of the UDX710 platform.
2. Peer- and Interconnect-Driven Re-hosting: The authors introduce a design principle for deterministic baseband emulation that reconstructs every SoC component the firmware depends on from real-device introspection. They define fidelity operationally: an emulation is faithful if its interaction with surrounding components matches the real device at the inter-SoC peripheral interfaces.
3. Validation on UDX710: The method is validated on the UNISOC UDX710, demonstrating the first emulated baseband capable of exercising the entire 5G handshake, establishing a full IPv4 PDU session, and carrying genuine ingress and egress IP traffic.

Results and Fidelity Demonstration

The authors empirically validate the fidelity of unislop through two primary experiments:

• State-Machine Correlation: By injecting probes into the NAS state-change function, they compared the re-host against the real device. Both environments, starting from the same state, reported identical NAS 5GMM control-plane state transitions (e.g., MAIN [200:5->=1]) at the exact same points in the procedure (post-SIB1, post-authentication).
• Traffic Validation: The re-host successfully established a full PDU session. Using an interconnect dump module, the authors verified that:
  • Control Plane: Over-the-air RRC and NAS payloads matched the real device (excluding non-deterministic cryptographic nonces).
  • Data Plane: IP packets injected at the NRPHY ring traversed the full stack (MAC, RLC, PDCP) to the AP and vice versa, with byte-identical matches observed in the PCAP capture.

Significance and Claims

The paper claims that unislop solves the long-standing problem of high-fidelity baseband emulation by shifting from approximation to concrete reconstruction of the execution environment.

• Scalability: The authors note that the recovered components (SIM, Crypto, NVRAM) are shared across UNISOC's baseband lineup. Static comparisons of firmware images (e.g., UMS9620 vs. UDX710) show identical binary structures and partition layouts, suggesting the design extends to other UNISOC targets with minimal adaptation.
• Security Analysis: By enabling the execution of deep protocol state machines and the injection of arbitrary payloads at interconnect boundaries (NRPHY, AP), the method opens the door to systematic fuzzing and security analysis of cellular protocols that were previously out of reach.
• Limitations: The current implementation targets 5G NR only. Support for LTE, 3G, and GSM is limited by the lack of a corresponding radio testbed and the need to model different PHY co-processors, though the authors assert the methodology applies directly once those testbeds are available.

The paper concludes that faithful emulation is achievable not by approximating the firmware in isolation, but by faithfully reconstructing the "surrounding state" that the firmware acts upon, driven by the same clock cycles as the real silicon.