Emulating Samsung's Baseband for Security Testing

This talk explains how to reverse engineer Samsung’s Shannon baseband firmware and build an emulator for reproducible vulnerability research. It demonstrates AFL-based fuzzing and validates emulator findings over the air.

Syllabus

Introduction
About me
Agenda
What is a Baseband
Why Basebands
Samsung Baseband
Baseband Emulator
How did we get here
Crashes
Root
Debugging
Scaling
Reverse Engineering
Boot modes
Samsung kernel
Memory structure
Block diagram
Next step
Choosing a framework
Boot UART
UART debugging
Snapshots
The Problem
PiPanda
PAL
The Banner
Fuzzing
Triforce AFL
Target AFL Tasks
GSM Session Management
Fuzz Single
Demo
Rediscovery
Call of Death
Experimental Setup
Calling Demo
Logcat
Wrap Up
Future Work
Release Schedule
Thank You
Questions