[RADIO] Cellular Radio Communication -\/ Modem | IMEI \/- Related Security Discussion

Search This thread
By:
Advanced…
noidodroid

noidodroid

Senior Member
Apr 1, 2019
402
116
Innernetz
www.noidodroid.com
Samsung Galaxy S4
AT&T Samsung Galaxy Note I717
[RADIO] Cellular Radio Communication -\/ Modem | IMEI \/- Related Security Discussion!

I hope this Thread Section is A-Ok for the following. @MikeChanning i see this is one of which you are in control of. If not suitable please move it to where you see it is best fit for its final resting place. If you see this and i am sure i have the correct Mike from XDA..... Hey there guy.. =] been a while since we have spoke about the good ol days of the 90's and 00's internet. We will have to have another chat when time permits. Curious to hear more stories about my ex marketing associates and other mutual walks of underground life we ran around with.

Alright now to what I wanted to get a good discussion going on...

This whole discussion you are about to get into is spawned from my extended thirst for knowledge and related comment from @tecknight i just so happened to see moments ago. It is something that could use more educated discussion here as for one it's important to watch what you include in your EDL dumps or file pulls you provide to others. Secondly the more you know the better... The easier it is to *repair* loss of International Mobile Equipment Identity of your device without blowing a gasket!


tecknight said:
I will need all partitions except for:
fsg
modemst1
modemst2

Which contain unique information tied to your phone (IMEI, serial,etc)
I would recommend that you zip the partition images into an archive and upload them to Google drive on some other file sharing service, then PM the URL to me.
Click to expand...
Click to collapse

I too used to think that these partitions carried valuable information however after dealing with Android second operating system aka the RIL and reading various informative articles I have found out that only 2 of those are actually ones to really worry about except for [fsg] and some other partitions.

From what I understand and I have seen modem ST1 and modem st2 do you contain sensitive data however are encrypted and unreadable until you erase them and they get restored on the next reboot which I'm sure you already know. Now [modem] is just an ext4 partition containing nothing but radio firmware binaries themselves. As for [fsg] partition it's still doesn't contain all the NV items for instance and you won't find any IMEI there. Now [/dev/block/boot/device/by-name] directory however does have some interesting information according to articles and more I have recently read. Apparently according to the author of one part of where some of your information is coming from is the [tunning] partition which contained some references to NV items as well but totally different than the ones in [fsg]. Including [/nv/num/550 and [/nvm/context1/550]. When looking at the familiar patterns read from partitions [nvdiag_client -r -p /nvm/num/550] they showed up there more just as well.

This information is coming from a new 2019 Nokia model phone from what I'm Gathering but the bulk of it is common and applies to most all Qualcomm. Defile looked into was a raw binary on an EMMC partition but had some interesting regular structure despite having no file system it appeared as one. This my friends would be the second operating system on Android the RIL. This is where all the complicated work goes on when it comes to programming anything radio related. I am very limited and have unlock numerous phones in my time. Really the most experience I have is with CDMA going back to early days of last decade. So this is all still interesting information I am glad to have came across and share to everyone here. Ok.. Back to this strange amazing structure it appears to contain name-contents and also some o d d ustar references. to some when seeing this you might realize where you have seen them before.. Think and try applying tar xf ... ? With me?

[fsg] and [tunning] partitions are just TAR archives with logic structured EFS items critical for the handsets radiomodule functionality. They are apparently also TOTALLY unencrypted unlike modemst1 and modemst2 partitions that get restored from these. .... So now down to the obvious reason you would do this.. to repair and more by modifying their TAR contents and erasing the modesmst1 and modemst2 partitions that, again, get restored from these you can either repair or run game on the EFS and for example have complete total File System control in a "custom rom" and could create whats been done already but not so advanced as the ideas I have in my mind which would be randomization of these very important sacred identifier numbers 14 numbers long with a luhn check digit. The author i gathered some of this information from has already created a very small self spawning shell script running in busybox of a certain rooted Custom ROM. I don't want to lead this down the negative road and get this convo banned with those of us choosing to discuss how everything works warned/banned so i will end this here.

However if mods do not mind us discussing this in detail simply as protection measures to be watched and or protected by means of hardening security in this area that would be great and I could show an example of a simple small script that does would do the imei repair or worse with ease in a matter of seconds ...

I see positive and negative out of this and already have a load of PoC's that will work. This which people more dedicated than myself these days to research leading to action in the pentesting field might find interesting not to mention including all HATS, cellular manafacturers, ROM programmers, companies both large and small and so many more...

I would love those more experienced in this disucssion to chime in with their comments and correct me / update me if and where I am off and of course make it easier for XDA members to understand what gives so many trouble and renders devices useless unless fixed.. -=]


.
.
.


/me inserts Lamar Burks photo and whispers "this has been a reading rainbow moment" ha ha..

q=]
-noidodroid
 
  • Like
Reactions: siggey and basem_ym
T

thorax.x

New member
Feb 7, 2020
1
1
I would be interested to know more specific information about the topics you would like to discuss. I can see you have given thoughtful consideration to forum choice and posting guidelines, however the original message is just a little TOO circumspect and vague for me to follow. I am particularly interested to hear about your observations of the RIL and file system in this recent Nokia release, and where you see the vulnerabilities lie. If you could maybe also give some hypothetical scenarios as to how exploitations of your observations might look IRL (yes... IRL, not RIL, lol!). I am at a stage where I'm still learning about the enormous amount of unseen stuff on Android (filesystems, partitions, libraries, APIs, the nuts and bolts of the OS, all the mysterious looking stuff, and of course, the radio interface layer and all its constituents - which, I believe, are STILL relatively insecure - which I think it's also the point of your discussion...).

So... Yes... If you could perhaps give a more concise account of your observations, and perhaps a few starter questions, hopefully those with more knowledge than us might deign to lower themselves to our sordid little level, and get a little dirt on their polished fingernails sharing that sweet sweet knowledge...
 
  • Like
Reactions: alipendier
C

camm44

Member
Jun 10, 2017
34
1
With the correct information about this could u technically get any phone from the past working on any carrier or cdma /gsm and then lte (or is that hardware capabilities ) . I'm off topic slightly but not really
 
noidodroid

noidodroid

Senior Member
Apr 1, 2019
402
116
Innernetz
www.noidodroid.com
Samsung Galaxy S4
AT&T Samsung Galaxy Note I717
thorax.x said:
I would be interested to know more specific information about the topics you would like to discuss. I can see you have given thoughtful consideration to forum choice and posting guidelines, however the original message is just a little TOO circumspect and vague for me to follow. I am particularly interested to hear about your observations of the RIL and file system in this recent Nokia release, and where you see the vulnerabilities lie. If you could maybe also give some hypothetical scenarios as to how exploitations of your observations might look IRL (yes... IRL, not RIL, lol!). I am at a stage where I'm still learning about the enormous amount of unseen stuff on Android (filesystems, partitions, libraries, APIs, the nuts and bolts of the OS, all the mysterious looking stuff, and of course, the radio interface layer and all its constituents - which, I believe, are STILL relatively insecure - which I think it's also the point of your discussion...).

So... Yes... If you could perhaps give a more concise account of your observations, and perhaps a few starter questions, hopefully those with more knowledge than us might deign to lower themselves to our sordid little level, and get a little dirt on their polished fingernails sharing that sweet sweet knowledge...
Click to expand...
Click to collapse

Thanks for replying. Basically what I am trying to get discussion on here is where critical modem related files and RIL files (imei, esn, etc) reside within the files listed and whether or not one can trully gain enough information from said files to find that information. I already know the answer and also wanted to make it a point to others on what not to include in your EDL / Firmware dumps as it could be used by the wrong hands. I also had a bunch of other information more detailed but it looks like its been edited out by someone... Maybe a bit TOO detailed. ha

I will come up with some more direct questions sometime when i get a few minutes free.
 
noidodroid

noidodroid

Senior Member
Apr 1, 2019
402
116
Innernetz
www.noidodroid.com
Samsung Galaxy S4
AT&T Samsung Galaxy Note I717
camm44 said:
With the correct information about this could u technically get any phone from the past working on any carrier or cdma /gsm and then lte (or is that hardware capabilities ) . I'm off topic slightly but not really
Click to expand...
Click to collapse


Technically yes and no. If the idea i mentioned will write out through serial to RIL and all security is saved or updated then yes but the other methods would be a soft IME! spoof so to speak and the other advanced methods well i cant discuss these as yeah they really could be something new not ever explored. Simply ideas for exploring to help security improve NOT to defraud or do anything illegal... -=]
 
A

alipendier

Senior Member
Aug 2, 2007
79
0
OP topic is not clear...

:good:

thorax.x said:
I would be interested to know more specific information about the topics you would like to discuss. I can see you have given thoughtful consideration to forum choice and posting guidelines, however the original message is just a little TOO circumspect and vague for me to follow. I am particularly interested to hear about your observations of the RIL and file system in this recent Nokia release, and where you see the vulnerabilities lie. If you could maybe also give some hypothetical scenarios as to how exploitations of your observations might look IRL (yes... IRL, not RIL, lol!). I am at a stage where I'm still learning about the enormous amount of unseen stuff on Android (filesystems, partitions, libraries, APIs, the nuts and bolts of the OS, all the mysterious looking stuff, and of course, the radio interface layer and all its constituents - which, I believe, are STILL relatively insecure - which I think it's also the point of your discussion...).

So... Yes... If you could perhaps give a more concise account of your observations, and perhaps a few starter questions, hopefully those with more knowledge than us might deign to lower themselves to our sordid little level, and get a little dirt on their polished fingernails sharing that sweet sweet knowledge...
Click to expand...
Click to collapse

The nature of the discussion here is very unclear to say the least, does the OP have information to share with the community or it is looking for information? Seems like others are interested in the VERY BROAD topic but does not even know where to start a real discussion here. If the OP has valuable info please start by sharing that first and then the community can build on that, thanks :cool:
 
D

DirtyAngelicaSecured

Senior Member
Mar 30, 2020
96
13
Paris
Excellent thread. One of the reasons I no longer use SIM cards is to avoid IMSI catcher detection by bad players. However, even when my Pixel wasn't rooted, a simple PlayStore App showed me local cell towers and they easily detected by IMEI number. I don't even know if Airplane mode does anything. Airplane mode prevents mobile data and telephony Apps from working, but does it prevent leakage of IMEI?
 
noidodroid

noidodroid

Senior Member
Apr 1, 2019
402
116
Innernetz
www.noidodroid.com
Samsung Galaxy S4
AT&T Samsung Galaxy Note I717
alipendier said:
:good:



The nature of the discussion here is very unclear to say the least, does the OP have information to share with the community or it is looking for information? Seems like others are interested in the VERY BROAD topic but does not even know where to start a real discussion here. If the OP has valuable info please start by sharing that first and then the community can build on that, thanks :cool:
Click to expand...
Click to collapse


DirtyAngelicaSecured said:
Excellent thread. One of the reasons I no longer use SIM cards is to avoid IMSI catcher detection by bad players. However, even when my Pixel wasn't rooted, a simple PlayStore App showed me local cell towers and they easily detected by IMEI number. I don't even know if Airplane mode does anything. Airplane mode prevents mobile data and telephony Apps from working, but does it prevent leakage of IMEI?
Click to expand...
Click to collapse

Thanks for replying guys. Basically I wanted more discussion on what crucial modem related details such as your IMEI for example reside within modemst1, modemst2, and FSG. This is with the Android operating system and is not only limited to the Nokia that I mentioned. Pretty much should be the same for Qualcomm phones but others I am not so certain. It would be interesting to know across all types of chipsets what we should protect and what is really not a big of a concern as we have always thought. There are already some discussions fear that are great that deal with unlocking T-Mobile and some other carriers but I don't really want to get into that kind of discussion as moderators will can our posts quick. These are some of my ideas in addition to the things I mentioned in the lengthy OP. Would be great to see what we really do need to be careful about and this is also can be a primer for how to repair our lost numbers if need be. Encourage any chat related to the RIL underbelly, modem files, sensitive related files and do hope some of you with greater knowledge then I and others will chime in.

RE: IMSI CATCHERS - I don't worry so much about these. I have monitored Towers for years everywhere I went as a hobby. If you are some kind of person caught in a large group of people such as a rally these are the type of places you really want to be sure to secure your phone. You can buy some material and make a ESD jamming protectant bag to conceal your phone. I just actually bought a roll for the heck of it so I could line my wallets and also a safe box and safe pouch. Again saying I don't worry kind of I guess you could say would be an understatement but I did all of this for sport as I like to put it. Perhaps one day I really will have to use it. Walking to almost any T-Mobile store for example with a booster and you've already connected to an imsi. :)
 
V

vodoque

New member
Nov 28, 2012
3
2
Downgrade modem

Hello guys, I currently have an S10e and I have the imei at 0 and that is why I am investigating since the binary 6 is very new and they have not yet launched the exploid to violate this security ... But the issue of radios, modems, ril and baseband have always interested me







noidodroid said:
Thanks for replying guys. Basically I wanted more discussion on what crucial modem related details such as your IMEI for example reside within modemst1, modemst2, and FSG. This is with the Android operating system and is not only limited to the Nokia that I mentioned. Pretty much should be the same for Qualcomm phones but others I am not so certain. It would be interesting to know across all types of chipsets what we should protect and what is really not a big of a concern as we have always thought. There are already some discussions fear that are great that deal with unlocking T-Mobile and some other carriers but I don't really want to get into that kind of discussion as moderators will can our posts quick. These are some of my ideas in addition to the things I mentioned in the lengthy OP. Would be great to see what we really do need to be careful about and this is also can be a primer for how to repair our lost numbers if need be. Encourage any chat related to the RIL underbelly, modem files, sensitive related files and do hope some of you with greater knowledge then I and others will chime in.

RE: IMSI CATCHERS - I don't worry so much about these. I have monitored Towers for years everywhere I went as a hobby. If you are some kind of person caught in a large group of people such as a rally these are the type of places you really want to be sure to secure your phone. You can buy some material and make a ESD jamming protectant bag to conceal your phone. I just actually bought a roll for the heck of it so I could line my wallets and also a safe box and safe pouch. Again saying I don't worry kind of I guess you could say would be an understatement but I did all of this for sport as I like to put it. Perhaps one day I really will have to use it. Walking to almost any T-Mobile store for example with a booster and you've already connected to an imsi. :)
Click to expand...
Click to collapse
 
  • Like
Reactions: noidodroid and alipendier
noidodroid

noidodroid

Senior Member
Apr 1, 2019
402
116
Innernetz
www.noidodroid.com
Samsung Galaxy S4
AT&T Samsung Galaxy Note I717
vodoque said:
Hello guys, I currently have an S10e and I have the imei at 0 and that is why I am investigating since the binary 6 is very new and they have not yet launched the exploid to violate this security ... But the issue of radios, modems, ril and baseband have always interested me
Click to expand...
Click to collapse

Keep this "But the issue of radios, modems, ril and baseband have always interested me" kind of talk here and move the s10e talk to their forums. Much cleaner this way. Plus better answers for you. =]
 
3

37berat37

Member
Mar 10, 2015
38
1
Xiaomi Mi Note 10 Lite
Hi,

1-Firstly I want to ask something :) are you chronovir. ? if you are the one :) can you give me your mail adress I want to contact with you :)

2-When I started to research the android phone in my hand and to examine its partition, I realized that there is no source on the internet.The phone I am currently using is xiaomi mi note 10 lite.Information is usually removed because the illegal part is used some people for bad purposes.No one know anyting about what quallcom partitions do in phone. In the sources I have found now, in addition to modemst1, modemst2 and fsg, some of them also say fsc partition also related to imei.In my phone there is no tunning partition maybe in my phone name is fsc. in my phone there is quallcom chipset.I can backup my nvdata via qualcomm qpst software and it takes backup filename extension qcn or xqcn type.In my phone, when I tried to change imei numbers just beacuse out of curiosity (not illegal purposes) first I delete modemst1, modemst2 and fsg partition after that I edit qcn file and change both imei. after flashed phone detect to imei change and reboot phone in recovery mode and show nv data is corrupted writing . the only fix is the wipe data and after that when my phone open there is no signal or change.If I change only imei2 and delete imei1 . There is no security phone works correctly but only sim2 have signal sim1 cant work anymore.I think inside to rom there is protection. When I searched to rom. I find 2 things. in build.prop there is one sting name is ro.miui.restrict_imei=1 I think this one related to protection but in the internet noting found.Also I find another file but I dont want to say in this forum because of the illegal usage.I dont like apple because of the reason is apple is black box.Do you know.I pull my phone modemst1,modemst2,fsg partition in .img format.I want to edit in my pc but I cant find any method.

2-if you have any android phone can you look at the bk51 and bk52 partition.I suspect those partition but I cannot understand what happened because my knowledge is limited.
Sorry my bad english :(

I am sharing my phone partition name and list:
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 abl -> /dev/block/sde36
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 ablbak -> /dev/block/sde37
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 aop -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 aopbak -> /dev/block/sde17
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 apdp -> /dev/block/sde8
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk01 -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk02 -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk03 -> /dev/block/sda6
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk04 -> /dev/block/sda7
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk05 -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk06 -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk07 -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk08 -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk09 -> /dev/block/sda22
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk31 -> /dev/block/sdd1
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk32 -> /dev/block/sdd3
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk33 -> /dev/block/sdd5
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk41 -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk43 -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk44 -> /dev/block/sde30
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk45 -> /dev/block/sde40
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bk47 -> /dev/block/sde50
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk51 -> /dev/block/sdf3
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 bk52 -> /dev/block/sdf4
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 bluetooth -> /dev/block/sde27
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 boot -> /dev/block/sde49
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cache -> /dev/block/sda29
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 catecontentfv -> /dev/block/sde29
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 catefv -> /dev/block/sde19
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cateloader -> /dev/block/sde32
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 cdt -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cmnlib -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cmnlib64 -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cmnlib64bak -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cmnlibbak -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 core_nhlos -> /dev/block/sde51
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 cust -> /dev/block/sda31
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 dbg -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 ddr -> /dev/block/sdd4
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 devcfg -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 devcfgbak -> /dev/block/sde15
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 devinfo -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 dip -> /dev/block/sde28
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 dsp -> /dev/block/sde48
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 dtbo -> /dev/block/sde45
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 exaid -> /dev/block/sda30
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 frp -> /dev/block/sda9
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 fsc -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 fsg -> /dev/block/sdf1
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 gsort -> /dev/block/sde44
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 hyp -> /dev/block/sde42
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 hypbak -> /dev/block/sde43
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 ifaa -> /dev/block/sde46
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 imagefv -> /dev/block/sda27
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 keymaster -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 keymasterbak -> /dev/block/sde26
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 keystore -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 limits -> /dev/block/sde4
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 logdump -> /dev/block/sda24
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 logfs -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 logo -> /dev/block/sde47
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 metadata -> /dev/block/sda19
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 minidump -> /dev/block/sda25
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 misc -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 modem -> /dev/block/sde52
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 modemst1 -> /dev/block/sdf5
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 modemst2 -> /dev/block/sdf6
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 msadp -> /dev/block/sde9
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 multiimgoem -> /dev/block/sde1
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 multiimgqti -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 oem_misc1 -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 oops -> /dev/block/sda16
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 persist -> /dev/block/sdf7
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 persistbak -> /dev/block/sdf8
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 qupfw -> /dev/block/sde6
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 qupfwbak -> /dev/block/sde7
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 rawdump -> /dev/block/sda26
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 recovery -> /dev/block/sda28
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sda -> /dev/block/sda
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sdb -> /dev/block/sdb
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sdc -> /dev/block/sdc
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sdd -> /dev/block/sdd
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sde -> /dev/block/sde
lrwxrwxrwx 1 root root 14 1970-03-22 19:02 sdf -> /dev/block/sdf
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 secdata -> /dev/block/sde3
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 splash -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 spunvm -> /dev/block/sde41
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 ssd -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 storsec -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 super -> /dev/block/sda23
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 switch -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 toolsfv -> /dev/block/sde35
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 tz -> /dev/block/sde38
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 tzbak -> /dev/block/sde39
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 uefisecapp -> /dev/block/sde33
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 uefisecappbak -> /dev/block/sde34
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 uefivarstore -> /dev/block/sde18
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 userdata -> /dev/block/sda32
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 vbmeta -> /dev/block/sde10
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 vbmeta_system -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 vbmeta_vendor -> /dev/block/sde13
lrwxrwxrwx 1 root root 16 1970-03-22 19:02 vm-data -> /dev/block/sda12
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 xbl -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 xbl_config -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 xbl_configbak -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-03-22 19:02 xblbak -> /dev/block/sdc2
 
You must log in or register to reply here.

Similar threads

BSDgeek_Jake
  • Poll
MoaAB: Mother of All AD-BLOCKING > BLOCKS ADware Malware Spyware Bloatware Ransomware
Replies
5K
Views
2M
J
jonatansuarez
Snoop05
[OFFICIAL][TOOL][WINDOWS] ADB, Fastboot and Drivers - 15 seconds ADB Installer v1.4.3
Replies
2K
Views
7M
abdulkareem786
abdulkareem786
fivefour
OUTDATED - [MOD] CrossBreeder - Lag-/Entropy+/DNS+/Tether+/Ads-/Censors-/.bit support!!
Replies
7K
Views
2M
fivefour
fivefour
Exit_Only
  • Locked
* MOD * 08/14/13 * Direct Injection v3.2.6_r4 * Entropy * Cpu Tuner * Ram Boost
Replies
7K
Views
786K
diestarbucks
diestarbucks
Chainfire
  • Locked
[CENTRAL] CF-Auto-Root
Replies
2K
Views
3M
Chainfire
Chainfire

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 2
    noidodroid
    noidodroid
    [RADIO] Cellular Radio Communication -\/ Modem | IMEI \/- Related Security Discussion!

    I hope this Thread Section is A-Ok for the following. @MikeChanning i see this is one of which you are in control of. If not suitable please move it to where you see it is best fit for its final resting place. If you see this and i am sure i have the correct Mike from XDA..... Hey there guy.. =] been a while since we have spoke about the good ol days of the 90's and 00's internet. We will have to have another chat when time permits. Curious to hear more stories about my ex marketing associates and other mutual walks of underground life we ran around with.

    Alright now to what I wanted to get a good discussion going on...

    This whole discussion you are about to get into is spawned from my extended thirst for knowledge and related comment from @tecknight i just so happened to see moments ago. It is something that could use more educated discussion here as for one it's important to watch what you include in your EDL dumps or file pulls you provide to others. Secondly the more you know the better... The easier it is to *repair* loss of International Mobile Equipment Identity of your device without blowing a gasket!


    tecknight said:
    I will need all partitions except for:
    fsg
    modemst1
    modemst2

    Which contain unique information tied to your phone (IMEI, serial,etc)
    I would recommend that you zip the partition images into an archive and upload them to Google drive on some other file sharing service, then PM the URL to me.
    Click to expand...
    Click to collapse

    I too used to think that these partitions carried valuable information however after dealing with Android second operating system aka the RIL and reading various informative articles I have found out that only 2 of those are actually ones to really worry about except for [fsg] and some other partitions.

    From what I understand and I have seen modem ST1 and modem st2 do you contain sensitive data however are encrypted and unreadable until you erase them and they get restored on the next reboot which I'm sure you already know. Now [modem] is just an ext4 partition containing nothing but radio firmware binaries themselves. As for [fsg] partition it's still doesn't contain all the NV items for instance and you won't find any IMEI there. Now [/dev/block/boot/device/by-name] directory however does have some interesting information according to articles and more I have recently read. Apparently according to the author of one part of where some of your information is coming from is the [tunning] partition which contained some references to NV items as well but totally different than the ones in [fsg]. Including [/nv/num/550 and [/nvm/context1/550]. When looking at the familiar patterns read from partitions [nvdiag_client -r -p /nvm/num/550] they showed up there more just as well.

    This information is coming from a new 2019 Nokia model phone from what I'm Gathering but the bulk of it is common and applies to most all Qualcomm. Defile looked into was a raw binary on an EMMC partition but had some interesting regular structure despite having no file system it appeared as one. This my friends would be the second operating system on Android the RIL. This is where all the complicated work goes on when it comes to programming anything radio related. I am very limited and have unlock numerous phones in my time. Really the most experience I have is with CDMA going back to early days of last decade. So this is all still interesting information I am glad to have came across and share to everyone here. Ok.. Back to this strange amazing structure it appears to contain name-contents and also some o d d ustar references. to some when seeing this you might realize where you have seen them before.. Think and try applying tar xf ... ? With me?

    [fsg] and [tunning] partitions are just TAR archives with logic structured EFS items critical for the handsets radiomodule functionality. They are apparently also TOTALLY unencrypted unlike modemst1 and modemst2 partitions that get restored from these. .... So now down to the obvious reason you would do this.. to repair and more by modifying their TAR contents and erasing the modesmst1 and modemst2 partitions that, again, get restored from these you can either repair or run game on the EFS and for example have complete total File System control in a "custom rom" and could create whats been done already but not so advanced as the ideas I have in my mind which would be randomization of these very important sacred identifier numbers 14 numbers long with a luhn check digit. The author i gathered some of this information from has already created a very small self spawning shell script running in busybox of a certain rooted Custom ROM. I don't want to lead this down the negative road and get this convo banned with those of us choosing to discuss how everything works warned/banned so i will end this here.

    However if mods do not mind us discussing this in detail simply as protection measures to be watched and or protected by means of hardening security in this area that would be great and I could show an example of a simple small script that does would do the imei repair or worse with ease in a matter of seconds ...

    I see positive and negative out of this and already have a load of PoC's that will work. This which people more dedicated than myself these days to research leading to action in the pentesting field might find interesting not to mention including all HATS, cellular manafacturers, ROM programmers, companies both large and small and so many more...

    I would love those more experienced in this disucssion to chime in with their comments and correct me / update me if and where I am off and of course make it easier for XDA members to understand what gives so many trouble and renders devices useless unless fixed.. -=]


    .
    .
    .


    /me inserts Lamar Burks photo and whispers "this has been a reading rainbow moment" ha ha..

    q=]
    -noidodroid
    View
    2
    V
    vodoque
    Downgrade modem

    Hello guys, I currently have an S10e and I have the imei at 0 and that is why I am investigating since the binary 6 is very new and they have not yet launched the exploid to violate this security ... But the issue of radios, modems, ril and baseband have always interested me







    noidodroid said:
    Thanks for replying guys. Basically I wanted more discussion on what crucial modem related details such as your IMEI for example reside within modemst1, modemst2, and FSG. This is with the Android operating system and is not only limited to the Nokia that I mentioned. Pretty much should be the same for Qualcomm phones but others I am not so certain. It would be interesting to know across all types of chipsets what we should protect and what is really not a big of a concern as we have always thought. There are already some discussions fear that are great that deal with unlocking T-Mobile and some other carriers but I don't really want to get into that kind of discussion as moderators will can our posts quick. These are some of my ideas in addition to the things I mentioned in the lengthy OP. Would be great to see what we really do need to be careful about and this is also can be a primer for how to repair our lost numbers if need be. Encourage any chat related to the RIL underbelly, modem files, sensitive related files and do hope some of you with greater knowledge then I and others will chime in.

    RE: IMSI CATCHERS - I don't worry so much about these. I have monitored Towers for years everywhere I went as a hobby. If you are some kind of person caught in a large group of people such as a rally these are the type of places you really want to be sure to secure your phone. You can buy some material and make a ESD jamming protectant bag to conceal your phone. I just actually bought a roll for the heck of it so I could line my wallets and also a safe box and safe pouch. Again saying I don't worry kind of I guess you could say would be an understatement but I did all of this for sport as I like to put it. Perhaps one day I really will have to use it. Walking to almost any T-Mobile store for example with a booster and you've already connected to an imsi. :)
    Click to expand...
    Click to collapse
    View
    1
    noidodroid
    noidodroid
    RESERVED ..

    (off to count sheep for a while - ZZZzz..)
    View
    1
    T
    thorax.x
    I would be interested to know more specific information about the topics you would like to discuss. I can see you have given thoughtful consideration to forum choice and posting guidelines, however the original message is just a little TOO circumspect and vague for me to follow. I am particularly interested to hear about your observations of the RIL and file system in this recent Nokia release, and where you see the vulnerabilities lie. If you could maybe also give some hypothetical scenarios as to how exploitations of your observations might look IRL (yes... IRL, not RIL, lol!). I am at a stage where I'm still learning about the enormous amount of unseen stuff on Android (filesystems, partitions, libraries, APIs, the nuts and bolts of the OS, all the mysterious looking stuff, and of course, the radio interface layer and all its constituents - which, I believe, are STILL relatively insecure - which I think it's also the point of your discussion...).

    So... Yes... If you could perhaps give a more concise account of your observations, and perhaps a few starter questions, hopefully those with more knowledge than us might deign to lower themselves to our sordid little level, and get a little dirt on their polished fingernails sharing that sweet sweet knowledge...
    View

New posts