Cellular Baseband Emulation & Fuzzing with FirmWire

BasebandQEMU / AFL++

Overview & Audit Objective

FirmWire allows researchers to run uncompressed vendor baseband firmware binaries (Samsung Shannon and MediaTek) in an instrumented QEMU emulator. This playbook guides operators through extracting modem firmware images, booting the virtualized baseband RTOS, attaching GDB debuggers, and fuzzing GSM/LTE/5G protocol handlers with AFL++.

Execution Steps

  1. 1
    Prepare Baseband Firmware Image:

    Extract modem image (e.g. modem.bin) from device OTA or vendor TAR archive:

    Terminal — Extract Image
    mkdir -p /tmp/firmware && cd /tmp/firmware
tar -xf firmware.tar.md5 modem.bin 2>/dev/null || true
  2. 2
    Launch FirmWire Baseband Emulator:

    Boot the virtualized modem OS with interactive logging and GDB server enabled on port 1234:

    Terminal — Boot Shannon Baseband
    cd /opt/telcosec/firmwire
python3 -m firmwire.firmwire --gdb /tmp/firmware/modem.bin
  3. 3
    Inject Cellular Signalling Frames:

    Transmit crafted RRC or NAS protocol packets directly into the baseband virtual transceiver:

    Terminal — Inject RRC Frame
    python3 firmwire/scripts/inject_frame.py --pcap test_rrc.pcap
  4. 4
    Attach Debugger & Triage Crashes:

    Inspect CPU registers and stack traces when memory corruptions or panics occur:

    Terminal — GDB Multiarch
    gdb-multiarch -ex "target remote localhost:1234"

Evidence & Artifact Archiving

Export baseband crash dumps, execution traces, and reproduction PCAPs:

Terminal — Bundle Evidence
telcosec bundle-evidence firmwire-crash-triage