“操作员，您能听到我吗？”通往UNISOC基带的可靠线路
"Operator, can you hear me?" A Faithful Line into the UNISOC Baseband
浏览论文内容
中文总结 AI 辅助
本文提出名为Unislop的可靠基带重新托管方法，针对未系统分析的UNISOC UDX710平台实现了代码执行、固件完整性检查突破等，达成了与真实设备一致的控制平面状态及IP流量承载。
中文摘要 AI 辅助
基带处理器始终可通过无线电访问，其与安全最相关的逻辑运行在协议状态机深处，即控制平面处理程序，负责控制注册、认证和会话建立。系统分析该逻辑需要在固件运行时对其进行内省，这使得基带的重新托管成为必要。现有重新托管工作近似模拟执行环境，且对基带处理器及其周围组件的SoC复杂性估计不足，导致该状态实际上难以触及。我们则根据真实设备的行为对每个周围组件（协处理器、SIM、应用处理器）进行建模，并让它们与基带在同一共享时钟上同步运行，这使得可在组件接口处验证可靠性，而非假设可靠性。我们将此方法命名为Unislop，并在UNISOC UDX710上进行演示，该平台据估计占蜂窝调制解调器的10%-15%，且应用于汽车系统，此前未被系统分析过。从Quectel RM500U-CNV模块出发，我们获得了代码执行权限，突破了其固件完整性检查，对基带进行了检测，并从运行设备中恢复了其外围环境。生成的重新托管系统达到了与真实设备相同的控制平面状态，建立了完整的PDU会话，并在入站和出站方向承载真实IP流量。恢复的组件在UNISOC的基带系列中通用，因此通过额外的逆向工程工作，相同设计可扩展至更多目标。
英文摘要
Baseband processors are reachable over the radio at all times. Their most security-relevant logic runs deep inside protocol state machines: the control-plane handlers that gate registration, authentication, and session setup. Analyzing that logic systematically requires introspecting the firmware as it runs, which makes re-hosting the baseband necessary. Existing re-hosting work approximates the execution environment and under-approximates the SoC complexity of the baseband processor together with its surrounding components, bringing this state practically out of reach. We instead model each surrounding component, co-processors, SIM, application processor, from what a real device does, and step them in lockstep with the baseband on one shared clock. That makes faithfulness checkable at component interfaces, rather than assumed. We call this method Unislop and demonstrate it on the UNISOC UDX710, a platform in an estimated 10-15% of cellular modems and in automotive systems, not systematically analyzed before. Starting from a Quectel RM500U-CNV module, we gain code execution, defeat its firmware-integrity check, instrument the baseband, and recover its peripheral environment from the running device. The resulting re-host reaches the same control-plane states as the real device, establishes a full PDU session, and carries real IP traffic on both ingress and egress. The recovered components are shared across UNISOC's baseband lineup, so with additional reverse-engineering effort the same design extends to further targets.
