INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · FIRMWIRE
FirmWire — Baseband Firmware Emulation
Research Overview
TL;DR — FirmWire is a full-system baseband firmware analysis platform presented at NDSS '22, supporting Samsung Shannon (Exynos) and MediaTek chipsets. It reconstructs the modem's peripheral memory layout and RTOS execution environment inside QEMU using avatar2-powered hardware stubs, enabling AFL++ fuzzing campaigns against RRC, NAS, CC, and MM protocol parsers without physical hardware. The platform provides transparent GDB debugging of firmware tasks, crash deduplication, and root-cause analysis. FirmWire has been used in responsible disclosure submissions to Samsung Mobile Security and MediaTek PSIRT.
FirmWire reconstructs the execution environment of closed-source baseband firmware by modeling peripheral memory layouts, MMIO register banks, and RTOS task scheduler context inside a QEMU-based full-system emulation. The PatternDB subsystem performs automated identification of memory-mapped I/O regions and interrupt controller addresses from firmware binary patterns — eliminating the need for hardware schematics or proprietary vendor documentation. Avatar2-powered peripheral stubs intercept firmware register accesses, returning plausible values that keep the RTOS boot sequence advancing until the modem image reaches a stable, fuzzable state.
AFL++ campaigns target RRC, NAS, CC, and MM protocol message parsers by injecting malformed radio frames through emulated modem-host shared memory interfaces, surfacing memory safety bugs invisible to static analysis. The GDB debugging bridge exposes breakpoints and watchpoints inside live Samsung Shannon Exynos or MediaTek Dimensity modem tasks, enabling precise root-cause analysis of crash artifacts without the vendor's proprietary bring-up toolchain.
Crash deduplication and minimization pipelines reduce fuzzing output to unique code-path-distinct bugs suitable for CVE submission. For real-world frame capture to generate fuzzing corpus inputs, use physical modem diagnostics via QCSuper.
Key Research Applications
- >Running AFL++ fuzzing campaigns against emulated RRC SIB1/SIB2 parsers to discover OTA-reachable memory corruption vulnerabilities
- >Comparing crash fingerprints between sequential Shannon firmware versions to evaluate patch completeness for disclosed CVEs
- >Instrumenting NAS authentication failure code paths to trace credential exposure in baseband task scheduler context
- >Reproducing publicly disclosed baseband CVEs in an emulated environment to develop and validate proof-of-concept exploit primitives
Technical Specifications
Operational Mode
Level 1 certification required. Targeting Security infrastructure layers.
Compatibility
Standard Linux environment with kernel-level protocol stacks.
Secure Audit Threat Vectors
Baseband firmware vulnerabilities represent a unique threat category: the modem attack surface is directly reachable over-the-air by any base station within radio range, requiring no user interaction, application installation, or OS-level access. Historical baseband CVEs have demonstrated RCE via malformed RRC SIB messages, heap overflows in SMS PDU decoders, and state machine confusion in MM/CC protocol handlers — affecting Qualcomm, Samsung, and MediaTek chipsets that cover the majority of global Android deployments.
FirmWire enables systematic discovery of this class of vulnerability by running AFL++ fuzzing campaigns against emulated firmware protocol parsers at speeds impractical with hardware-in-the-loop. Multiple parallel emulation instances run simultaneously on commodity server hardware, dramatically accelerating crash triage. The GDB integration enables step-by-step debugging of crash reproduction cases, supporting full root-cause analysis including corruption type, overwrite target, and initial exploitability assessment.
Crash clusters from FirmWire campaigns have formed the basis of responsible disclosure reports submitted to Samsung Mobile Security and MediaTek PSIRT. For capturing real OTA frames to use as fuzzing corpus inputs, see QCSuper.
Frequently Asked Questions
What is FirmWire?
FirmWire is an open-source telecom security utility in the Security category. FirmWire is a full-system baseband firmware analysis platform presented at NDSS '22, supporting Samsung Shannon (Exynos) and MediaTek chipsets. It reconstructs the modem's peripheral memory layout and RTOS execution environment inside QEMU using avatar2-powered hardware stubs, enabling AFL++ fuzzing campaigns against RRC, NAS, CC, and MM protocol parsers without physical hardware. The platform provides transparent GDB debugging of firmware tasks, crash deduplication, and root-cause analysis. FirmWire has been used in responsible disclosure submissions to Samsung Mobile Security and MediaTek PSIRT.
Which category does FirmWire belong to?
FirmWire is categorized under Security in the TelcoSec Tools console. This category covers tools used for auditing telecom security architecture including DNS, signaling protocols, and firmware vulnerability research.
Which baseband chipsets does FirmWire support for emulation?
FirmWire provides first-class emulation support for Samsung Shannon baseband firmware (used in Samsung Galaxy Exynos models) and selected MediaTek Dimensity chipsets. The Shannon Exynos target is the most thoroughly documented, with the full boot sequence, peripheral stub implementations, and AFL++ harness configurations maintained in the main repository. Community-contributed PatternDB entries extend support to additional chipset variants.
Is physical baseband hardware required to use FirmWire for security research?
No. FirmWire's primary design goal is eliminating the hardware requirement for baseband vulnerability research. Firmware images extracted from OTA update packages or device flash dumps are loaded directly into the QEMU emulation environment on a standard x86 Linux workstation. Multiple emulated instances can run in parallel for high-throughput fuzzing campaigns — which would be impractical with physical devices at scale.
ADVANCED_TRAININGSecurity Security PathRecommended for: FirmWire
Master FirmWire Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about FirmWire? Send it directly to the research team.