INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · SCAT
SCAT — Smartphone Cellular Analysis & Baseband Protocol Decode
Research Overview
TL;DR — SCAT (Smartphone Cellular Analysis Tool) by FGSECT reads diagnostic messages from Qualcomm (DIAG protocol) and Samsung (SIT/IPC protocol) baseband chipsets, decoding real-time NAS (TS 24.301/24.501) and RRC (TS 36.331/38.331) messages from production devices without firmware modification. Output is PCAP/GSMTAP-encapsulated for Wireshark analysis. Security researchers use SCAT to verify 5G-AKA authentication flow compliance, detect NAS security downgrades and SUPI/IMSI leakage events, analyse RRC SIB parsing behaviour, and build closed-loop baseband fuzzing pipelines with srsRAN-based controlled eNBs/gNBs.
SCAT interfaces with Qualcomm and Samsung baseband chipsets via their proprietary diagnostic interfaces — Qualcomm's DIAG protocol (exposed at /dev/ttyUSB0 or via USB ADB) and Samsung's SIT (Samsung IPC) protocol — to extract real-time Layer-3 protocol messages from production UE basebands without firmware modification. It decodes NAS (Non-Access Stratum, TS 24.301 for LTE, TS 24.501 for 5G NR) and RRC (TS 36.331 for LTE, TS 38.331 for NR) messages, generating Wireshark-compatible PCAP and GSMTAP-encapsulated output that provides ground-truth baseband behaviour inaccessible via air-interface capture alone.
SCAT complements QCSuper for Qualcomm chipsets by extending multi-vendor coverage to Samsung Exynos-based devices through its SIT protocol parser. Researchers use SCAT to capture and decode the full 5G NR NAS Registration procedure (TS 24.501 Section 5.5.1), including SUCI construction, Authentication Request/Response, Security Mode Command/Complete, and Registration Accept messages, verifying chipset-level compliance with 5G-AKA and SUPI concealment requirements. RRC decode output exposes MIB/SIB parsing behaviour, measConfig parameters, and handover command contents — critical for testing whether UEs enforce AS security on inbound RRC messages before processing them.
For cross-vendor baseband analysis, SCAT sessions paired with FirmWire-based firmware emulation enable comparison of over-the-air behaviour against emulated baseband responses, surfacing undocumented chipset behaviours and non-conformant protocol implementations. SCAT output feeds directly into automated NAS/RRC fuzzing pipelines where decoded message fields are mutated and replayed via srsRAN or a controlled eNB/gNB, creating a closed-loop baseband security testing workflow.
Key Research Applications
- >Capture and decode real-time LTE NAS (TS 24.301) and 5G NR NAS (TS 24.501) messages from Qualcomm and Samsung chipsets via DIAG/SIT protocol to verify SUCI construction and 5G-AKA flow compliance
- >Detect NAS-layer security downgrades and IMSI/SUPI exposure events on production UEs in live network environments, generating PCAP evidence for GSMA coordinated vulnerability disclosure submissions
- >Cross-vendor RRC decode analysis (LTE TS 36.331, NR TS 38.331) to identify non-conformant SIB parsing, measConfig handling, and handover command processing in commercial Qualcomm and Samsung basebands
- >Build closed-loop baseband fuzzing pipeline: decode baseline NAS/RRC behaviour via SCAT, mutate message fields, replay via srsRAN controlled eNB/gNB, and observe chipset responses via continued SCAT capture
Technical Specifications
Operational Mode
Level 2 certification required. Targeting Mobile Equipments infrastructure layers.
Compatibility
Standard Linux environment with kernel-level protocol stacks.
Secure Audit Threat Vectors
Production baseband chipsets implement 3GPP NAS and RRC stacks in real-time embedded firmware with limited memory-safety guarantees, and SCAT's diagnostic visibility exposes deviations from standardised behaviour that indicate exploitable parser defects. Historical Qualcomm baseband vulnerabilities (CVE-2020-3657, CVE-2023-33043) were discovered through diagnostic-layer analysis of malformed NAS message handling — precisely the workflow SCAT enables. Samsung SIT protocol decodes from Exynos chipsets have similarly uncovered out-of-bounds read conditions in SIB5/SIB6 neighbour cell list parsing where ARFCN field length is not validated against message buffer boundaries per the TS 36.331 ASN.1 schema.
SCAT's real-time NAS decode capability allows detection of silent security downgrades in live networks: researchers can observe whether an AMF sends NAS Security Mode Commands with NULL integrity (EIA0) outside emergency contexts in violation of TS 33.501 Section 6.6, or whether the UE accepts RRC connections without AS security activation per TS 36.331 Section 5.3.3. SCAT also captures IMSI and SUPI exposure events — instances where the chipset transmits unprotected identity outside the initial registration window — which are reportable under coordinated vulnerability disclosure programmes from chipset vendors and operators. These captures provide the evidentiary protocol traces required for GSMA CVD submissions.
Frequently Asked Questions
What is SCAT — Smartphone Cellular Analysis Tool?
SCAT — Smartphone Cellular Analysis Tool is an open-source telecom security utility in the Mobile Equipments category. SCAT (Smartphone Cellular Analysis Tool) by FGSECT reads diagnostic messages from Qualcomm (DIAG protocol) and Samsung (SIT/IPC protocol) baseband chipsets, decoding real-time NAS (TS 24.301/24.501) and RRC (TS 36.331/38.331) messages from production devices without firmware modification. Output is PCAP/GSMTAP-encapsulated for Wireshark analysis. Security researchers use SCAT to verify 5G-AKA authentication flow compliance, detect NAS security downgrades and SUPI/IMSI leakage events, analyse RRC SIB parsing behaviour, and build closed-loop baseband fuzzing pipelines with srsRAN-based controlled eNBs/gNBs.
Which category does SCAT — Smartphone Cellular Analysis Tool belong to?
SCAT — Smartphone Cellular Analysis Tool is categorized under Mobile Equipments in the TelcoSec Tools console. This category covers tools used for auditing mobile modem firmware, baseband processor diagnostics, and device-level cellular protocol stacks.
How does SCAT differ from QCSuper for baseband protocol analysis?
QCSuper focuses exclusively on the Qualcomm DIAG protocol on Android devices, offering deep DIAG log mask control and LTE/5G NR log packet capture optimised for the Qualcomm ecosystem. SCAT extends coverage to Samsung Exynos chipsets via the Samsung SIT/IPC protocol and provides a unified NAS/RRC decoding pipeline for both vendors. QCSuper may offer more granular DIAG item selection for Qualcomm-specific PHY and MAC log messages, while SCAT's primary strength is cross-vendor Layer-3 protocol decode for 5G NR. For comprehensive multi-chipset coverage, both tools are typically deployed in parallel.
What device access level does SCAT require?
On Android devices with Qualcomm chipsets, SCAT requires access to the DIAG serial interface — typically at /dev/diag or /dev/ttyUSB0 — which on most devices requires root access or placement in a diagnostic mode via engineering menu codes or USB PID switching. On Samsung Exynos devices, the SIT interface is accessed via a proprietary USB endpoint or socket requiring elevated access. SCAT can operate on non-rooted Samsung devices in some configurations using the Samsung-specific IPC path exposed in developer and engineering builds, though vendor-specific restrictions apply on carrier-locked handsets.
View SCAT — Smartphone Cellular Analysis Tool Source CodeRead SCAT — Smartphone Cellular Analysis Tool Tutorial
ADVANCED_TRAININGMobile Equipments Security PathRecommended for: SCAT — Smartphone Cellular Analysis Tool
Master SCAT — Smartphone Cellular Analysis Tool Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about SCAT — Smartphone Cellular Analysis Tool? Send it directly to the research team.