"Operator, can you hear me?" A Faithful Line into the UNISOC Baseband

2026-08-07

AI Summary

Existing approaches struggle to faithfully emulate the complex control-plane logic of UNISOC baseband processors with high fidelity. This work proposes Unislop, a novel methodology that reconstructs an interface-level verifiable and high-fidelity execution environment by precisely modeling the baseband processor alongside its co-processors, SIM card, and application processor under a shared clock, thereby overcoming the limitations of traditional approximate emulation. By integrating firmware reverse engineering, dynamic instrumentation, and hardware behavior modeling, Unislop enables, for the first time, in-depth analysis of control-plane protocol state machines. The approach successfully reproduces complete PDU session establishment and bidirectional real IP traffic on the UDX710 platform, establishing a scalable security analysis framework applicable across the same chipset family.

Abstract

Baseband processors are reachable over the radio at all times. Their most security-relevant logic runs deep inside protocol state machines: the control-plane handlers that gate registration, authentication, and session setup. Analyzing that logic systematically requires introspecting the firmware as it runs, which makes re-hosting the baseband necessary. Existing re-hosting work approximates the execution environment and under-approximates the SoC complexity of the baseband processor together with its surrounding components, bringing this state practically out of reach. We instead model each surrounding component, co-processors, SIM, application processor, from what a real device does, and step them in lockstep with the baseband on one shared clock. That makes faithfulness checkable at component interfaces, rather than assumed. We call this method Unislop and demonstrate it on the UNISOC UDX710, a platform in an estimated 10-15% of cellular modems and in automotive systems, not systematically analyzed before. Starting from a Quectel RM500U-CNV module, we gain code execution, defeat its firmware-integrity check, instrument the baseband, and recover its peripheral environment from the running device. The resulting re-host reaches the same control-plane states as the real device, establishes a full PDU session, and carries real IP traffic on both ingress and egress. The recovered components are shared across UNISOC's baseband lineup, so with additional reverse-engineering effort the same design extends to further targets.

Problem

• baseband processor
• re-hosting
• control-plane
• firmware analysis
• UNISOC

Innovation

• baseband re-hosting
• faithful emulation
• UNISOC
• control-plane analysis
• firmware introspection