INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · QCSUPER
QCSuper — Qualcomm Radio Frame Capture
Research Overview
TL;DR — QCSuper communicates with Qualcomm-based phones and modems via the proprietary Diag protocol, enabling capture of raw radio frames across GSM, GPRS/EDGE, UMTS, and LTE layers. Frames are wrapped in GSMTAP headers and exported as PCAP files for full Wireshark analysis. Supports NAS message decryption (--decrypt-nas), SIB reassembly, and IP traffic inclusion.
QCSuper exploits the Qualcomm Diag protocol — a proprietary diagnostic interface exposed by most Snapdragon-based Android modems via the /dev/diag character device — to extract raw layer-1 radio frames before the modem's RTOS stack processes or discards them. Captured frames are encapsulated in GSMTAP headers, preserving per-frame metadata including ARFCN, band indicator, RSSI, and frame timing, then exported as Wireshark-compatible PCAP files covering GSM, GPRS/EDGE, UMTS, and 4G LTE signaling layers.
The --decrypt-nas flag applies NAS session keys captured during the EPS Security Mode Command exchange to reveal plaintext Location Update, Authentication Response, and Attach Accept messages. SIB reassembly mode collects fragmented System Information Blocks from commercial eNBs, enabling auditors to parse SIB1/SIB2/SIB3 parameters — MCC/MNC/TAC, reselection thresholds, neighbor cell lists — and cross-reference them against known-good configurations to detect rogue cell impersonation signatures.
When analyzing the RF environment that produces these frames, pair QCSuper with hardware profiled in the SDR Capabilities Intelligence database, or extend passive signaling coverage using GR-GSM for GSM-layer BCCH monitoring.
Key Research Applications
- >Capturing NAS Attach and Security Mode Command sequences to detect IMSI exposure before EPS AKA key exchange
- >Monitoring SIB2/SIB3 broadcast parameters from commercial eNBs to identify reselection thresholds indicative of rogue cell activity
- >Decrypting NAS payloads using captured session keys to audit whether NAS ciphering is enforced across handover boundaries
- >Correlating Layer-1 RSSI measurements with upper-layer signaling to characterize the RF environment of OTA attack scenarios
Technical Specifications
Operational Mode
Level 1 certification required. Targeting Mobile Equipments infrastructure layers.
Compatibility
Standard Linux environment with kernel-level protocol stacks.
Secure Audit Threat Vectors
Mobile baseband processors are one of the highest-value, least-audited attack surfaces in modern smartphones. The cellular modem runs a closed-source RTOS with direct access to radio hardware and the ability to handle calls, SMS, and subscriber identity data without Android OS-layer mediation. Memory corruption vulnerabilities in baseband RRC or NAS message parsers can be triggered over-the-air by a malicious base station — achieving full modem compromise without user interaction.
QCSuper enables auditors to observe the exact signaling frames a commercial base station delivers to a target device, identifying suspicious SIB parameter combinations characteristic of rogue eNB activity: unusual TAC values, aggressive reselection thresholds, and absent integrity protection. NAS message decryption reveals whether Security Mode Command negotiation enforces both integrity protection and ciphering — a known weakness allowing NAS-layer eavesdropping on 4G LTE networks. IMSI exposure during 4G Attach procedures is detectable in plaintext NAS traces when EPS AKA is not consistently enforced.
For firmware-level testing of how the modem processes signaling frames, see FirmWire.
Frequently Asked Questions
What is QCSuper?
QCSuper is an open-source telecom security utility in the Mobile Equipments category. QCSuper communicates with Qualcomm-based phones and modems via the proprietary Diag protocol, enabling capture of raw radio frames across GSM, GPRS/EDGE, UMTS, and LTE layers. Frames are wrapped in GSMTAP headers and exported as PCAP files for full Wireshark analysis. Supports NAS message decryption (--decrypt-nas), SIB reassembly, and IP traffic inclusion.
Which category does QCSuper belong to?
QCSuper is categorized under Mobile Equipments in the TelcoSec Tools console. This category covers tools used for auditing mobile modem firmware, baseband processor diagnostics, and device-level cellular protocol stacks.
Which Android devices are compatible with QCSuper's Diag protocol capture?
QCSuper is compatible with Android devices using Qualcomm Snapdragon modems that expose the /dev/diag interface, covering the majority of mid-to-high-end Snapdragon smartphones. Root access or ADB shell with granted Diag interface permissions is typically required. Xiaomi devices, Google Pixels with factory image, and most development-unlocked devices have the broadest compatibility. Specific OEMs restrict Diag access in shipping firmware.
Does QCSuper support 5G NR frame capture from Snapdragon X-series modems?
QCSuper's core support targets 2G GSM, 3G UMTS, and 4G LTE via the Qualcomm Diag protocol. Newer Snapdragon X55 and X65 modems with NSA 5G NR support may expose partial NR diagnostic frames through the Diag interface on community-contributed branches. Full standalone 5G NR SA capture support is hardware- and firmware-dependent and not guaranteed across device models or Snapdragon generations.
ADVANCED_TRAININGMobile Equipments Security PathRecommended for: QCSuper
Master QCSuper Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about QCSuper? Send it directly to the research team.