8 ms·
You may actually be very interested in the work here: https://xnux.eu/devices/feature/modem-pp.html https://xnux.eu/devices/feature/modem-pp.html https://xnux
by kop316 6y ago
You may actually be very interested in the work here:
https://xnux.eu/devices/feature/modem-pp.html https://xnux.eu/devices/feature/modem-pp.html
https://xnux.eu/devices/feature/modem-pp-reveng.html https://xnux.eu/devices/feature/modem-pp-reveng.html
They were able to get root access within the modem. Depending on how the IMEI value is stored, it may actually be feasible here.
- numpad0 6y agoNot sure if it’s possible from running Android on app CPU, but people with copies of QXDM all knows how to do it from PC
- kop316 6y agoRespectfully, I think you misunderstand the page. The Quectel EG25-G is the modem only, the main CPU on the Pinephone is an Allwinner A64 ARM Quad core Cortex-A53. The modem itself has its own linux kernel, app space, etc.
- numpad0 6y agoOh I expected Qualcomm MDMs to run some proprietary RTOS with some NVRAM write protection, but if Linux is already in control then certainly an on-the-fly IMEI switch without resets or QPST/QXDM sounds more feasible.
- XMPPwocky 6y agoThey do. These types of Qualcomm modems run QuRT, a proprietary RTOS, on the Hexagon processor which handles the baseband and the LTE stack. There is also a shitty little core that runs "psuedo-Android" - you have adb and things like that, but it's mostly a more traditional embedded Linux environment- and handles certain AT commands (they actually go to the baseband first, but get IPCed over to Linux for handling after parsing if they match a registered command). With root on psuedo-Android, you can probably get code exec on Hexagon - especially for the cheaper modems, they have an older version of the Hexagon architecture and to work under this architecture things like ASLR are relatively rare. But it's more work - there's no obvious "execute arbitrary shellcode" IPC message, you need to do more RE/VR.