Exploitation of a Modern Smartphone Baseband

In this talk, we will explore the baseband of a modern smartphone, discussing the design and the security countermeasures that are implemented. We will then move on and explain how to find memory corruption bugs and exploit them. As a case study, we will explain in details our 2017 Mobile Pwn2Own entry, where we gained RCE (Remote Code Execution) with a 0-day on the baseband of a smartphone, which was among the target of the competition. We exploited successfully the phone remotely over the air without any user interaction and won $100,000 for this competition target.

Transcript

1. 
    
    
    
       
   
2. 
    #!$#
   
   #
   ! !$ "
   #
   
   '$#
   !
   
   & &
   
   "
   #$(
   ' #
   #
   $&
   " %!
   #
   ' # ' ##  " 
   #
   " $""
3. 
    )0&)56
   2*
   !)1')17
   
   )'85-7<
   %&
   *250)5/<
   .12:1
   %6
   ))1!)%0 %5'2
   5%66-
   0%5'2+5%66 • <
   0%-1
   *2'86
   12:
   -6
   ,<3)59-625
   &%6)&%1(
   *-50:%5)
   87
   620)7-0)6
   
   +2
   &%'.
   72
   - 1(52-( 0%'
   %1(
   6%1(&2;)6
   )7' • 3:1 2:1
   
   %'
   
   $
   !)%0
   2&-/)
   3:1 2:1
   
   -
   7)%0
   3:1 2:1
   
   "#%5)
   )6'%3)
   7)%0
   2&-/)
   3:1 2:1
   
   -
   #--
   
   &%6)&%1(
   7)%0 !-%1<-
   $-) • !
   3/%<)5
   '%37%-1
   2*
   !
   !)%0
   )))
   %1(
     • ,%03-21
   2*
   !
   !
   
   %6
   0)0&)5
   2*
   7)%0
   236 • :1 :1
   
   ":%5)
   )6'%3)
   7)%0
   2&-/)
   :1 :1
   
   &%6)&%1(
   7)%0 84-1+
   -8 • !
   3/%<)5
   0)0&)5
   2*
   !)%0
   )))
   %1(
     • 2&-/)
   :1 :1
   
   &%6)&%1(
   7)%0
4.  
    
   
     
    &'0#
   0
   #!1.'05
   #/#.!&#./ #2#.)
   0'*#/
   -3+,3+
   3'++#./ #
   .#
   /#"
   '+
   &+%&'
   &'+ 1.
   ),%
   '/
   &00-/ (##+) 0#+!#+0!,*#+ 3'00#.
   (##+) #/#.!& .# •  /#!1.'05 .,3/#. +" ,4 #.+#) '+",3/ '+14 ! • , ')# /#!1.'05 , ')# .,3/#. , ')# /+" ,4 , ')# (#.+#)  +".,'" ' • /# +"
   +"
   $'.*3.# • '.01)'60',+ .# 5-#.   • . .#/#.!& #/)
    • -- /#!1.'05
5.   
    
     
    
   
   
    !
    
   
   
    
     
   
       
    !
   
   
   
    
   
    
   
   !
   
     
    
    
   
   
   
   !
   
    
   !
   
   
   
   
   
   
    
   
   
    
    
   
   
    
   
   
   
   
   
   
   
    
   
     
        
   
    
   
   
   
   
   
   
   
   
   
   
   
    
   
   
    
6.  
     2
   .")+%
   4- 4-
   
   4%
   13##%11&3++6
   %5/+.)2%$
   2(%
   3!4%)
   "!1%"!-$
   1.
   .30
   1(.4#!1%
   !-$
   !-!+61)1
   4)++
   "%
   .-
   2(!2
   "!1%"!-$ 2(%0
   4.0*1
   .-
   "!1%"!-$1 • .,1%#30)1
   7 0%!*)-'
   !-$
   !,13-'
   (!--.-
   !1%"!-$ • ,!2
   !,!
   7 
   !+*
   4)2(
   (!--.-
   !,13-'
   (!--.-
   !1%"!-$ • .,1%#30)1
    (%0%1
   )&%
   )-
   2(%
   +$
   .'
   %2
   -2%+
   !1%"!-$ • 36
   7 0.,
   
   2.
   -&)-)26
   -2%+
   !1%"!-$ • 3)030)
   02%-12%)-
   .0&,!-
   7 (%
   !1%"!-$
   !1)#1
   
   !1%"!-$ • !+&()+)//
   %)-,!--
   7 !1%"!-$
   22!#*1
   !-$
   .2(%0
   4.0*
   3!+#.,,
   !1%"!-$ • (%0%
   !0%
   !+1.
   .2(%0
   0%1.30#%1
   .,)22%$
   &.0
   1/!#%
   #.-120!)-21
   1.006
7. 
    
     
    
   %')&
   *%)+( '&
   !*
   &'+
   
   *!&$
   
   /,+!&
   &
   
   &0%') -)$
   '+ )
   ()'**')*
   !&-'$-
   !&
   + 
   )!'
   ) • *&
   ()'**') • !!
   &
   $,+''+
   '  
   *&
   &$*
   + 
   )!'
   '%%,&!+!'&
   .!+
   %&0
   +0(*
   '
   &+.')#*
   
   
   
   +  '*
   )!'
   '%('&&+*
   &
   
   ++#
   )%'+$0 ',)
   ++(* ''$()'"+1)'$'*('+'%  '-) !)/($'!+!&)''%*.!!  +%$
8. 
    
     
     
    
   
   '*$(
   .%*'
   
   $
   &&(
    $'%  
   ($
   '*$(
   
    .
   %##*$ )
   , ) •  •   • '
   #%'. •   • / &')
   (.()#(
   
   .%*
   )
   
   .%*
   '*$
   %
   %$
   )
   ($
   $%)
   )
    
   ($(
   "(
    $
   $
   )'#(
   %
   # ) ) %$(
   %#&'
   )%
   )
    $
   *,
   ,
   $%) 
   ).
   "!
   %
   
   $
   +$
   ()!
   %%! (
   #! $
   )
   '#%)
   -&"% )) %$
   ( '  (
   "!
   %
   # ) ) %$(
   (
   , (&'
   ),$
   ""
   #$*)*''( %*'
   
   ))&(,,,+")%# $)'%*) %$(#')&%$ ' ))*'
9. 
    
   
      #
   "
   "%!
   %#"  ""
   $!"#
   
   ""
   $#
   ##
   "$!  #
   
   
   ' #
   !#(
   &#$#
   $"!
   #!#
   ##(
   !
   
   "#"  
   
   ##"
    !
   #
   
   !
   
     #
   #
   %
   $#$!!
   "#
   %
   ""
   #
   #
   "
   
   (
   #
   "(
   $#
   #   '#(
10. 
       ")*%
    "
    &!""%
    
    $&
     #$"( !&%
    &!%
    &"
    %
    "&)$
    !
    "% *
    ")
    $%$$%
    &"
    " '!&
    )&
    %!%
    !
    %&'#
    
    %
    &&"!% *
    $
    "$  
     
    + ")($
    "#!%"'$
     # !&&"!%
    !
    "!*
    "($
     
    "
    &
    %!
    $"
    %&%
    
    )
    %
    &$
    )*
    &%
    )
    &'$!
    !&"
    
    #$"
    "$
    '%
11.  
    
    
     
    
       
    "  #
     
    
    
     
    
    
     
    
    
     
    
    
    !
    
    
     
    
     
    
    
    
    
    
     
      
     
    
    
     
     
    
     
    
       
    
     
    
     
    
    
    
    
    
    
    
12. 
    %"
    # '#
    %
    '
    
    
    
    #
    ) %
    
    $
    #$
    $
     '
    '$
    
    # 
    
    $
     $($
    
    %"
    $' "
    #
    *
    )
    
    
     
    $  )
    #$"#
     "
    #
    & 
    $
    
    #
    $
    $'
     
    ! #
    
    
    #$#
    *
    $
    '#
    
     !$
    $  )
    
     
    
    "$
    !"$
    
    $
    ' " " )
    
    
    ) %
     '
    '$
    $
    #
    )')
    #
    ) %
    %#
    $
13. 
       '#'
    &
    '!!-
    !
    $,'
    &)###
    
    &"+&
    $#
    
    '%&(
    
    #'
    -$)&
    '"&(%$# -
    &
    '"!&
    ($
    '$"
    $
    *'
    (-
    &)#
    
    !
    "
    %&(#
    -'("'
    +(
    !$(
    $
    (' '
    
    &'%$#'!
    $&
    '$"
    !-&
    $&
    $"%$##( 
    $"%!,(-
    '
    )
    $)
    #
    (
    #
    
    -
     #
    (
    '%($#'
    $
    -&
    
     
    
     
    +
    $#''('
    $
    )#&'
    $
    %'
    #
    $*&'
    $#!-
    
    !-&
    $
    
    &$
    #(+$& 
14. 
     
     
    !
    
    
    
    !
    $ ! !
    "
    %!  & "
    
    
    ! 
      
    
    
    
    !#
    $
    "
    
    
    
    
    !! 
    "
    !
    !
    ! 
    !
    ! 
    #
    ""
    
     
    " "$
    
    
    !
    !#
    ! 
     
    !
    
    !
    
     
    $"
    
    
    
    !
    !
    
    $"
    
    "! "
      
     
    
     
    
    
    
    
     
     
       
    
15.  
    
     
        
     
    
     
     
    
       
       
       
      
    
     
    
    
16. 
        
     !
    !
    $
    
    !
    
    
    !
    !
    "
    
    
    !
    $
    
    # 
    !
    !
    
    %!
    &
    "!
    #
    !
     
    $
    "
    
    !
    "$
    $ 
    
    
    !
    
    ' (
    
    !
    !
     & ! 
    
    
    
    !
    !
    !
     
    !
    
     " !
    %"!
    #!
    
    !"
     
    !
    
    !
    !
     
    & 
    
     &
    !&
    !
    
    
    !
    
    " !!
    $
    
    !!
    !
    # 
    
    !
17.  
        & %
     !
    #
    '#*
    "&
    
    %
    
    "#!$$
     
    & 
    "#'!&$
    %
     %!
    +$,
    
    #& %
    $
    !
    %
    $  *
    !(
    %
    $
    $
    !
    (#
    '#$! $ !('#
    (
    !& 
    !&%
    %% • 
    %
    $ 
    #$$
    %
    (
    !&%"&%
    
    $!
    ##!#$
    %!
    %
    ""%!
    #!$$!#
     #!
     
    !
    %
    !
    %
    $*$% • %
    $
    "!$$
    %!
    #
    %
    $ 
    !#*
    #!
    %
    #!
    # 
    &" 
    %
    "*$
    !#*
    #!
    )
    $
    "
    &$
    
    !%
    %!
    &$%
    !&#
    )"!%
18.   
        ("'%+
    &
    !!
    %#&"!%
    $"
     
    $
    !&"$+
    &"
    '!$%&!
    &
    %+%& % 
    "'!
    "!
    & '
    
    "
    
    ($%"!
    "
    #$&
    "
    &%
    %!
    %"'$
    " %
    )%
    ($+
    #'
    !
    &
    $($%
    !!$!
    #$"%% $
    %
    %"
    
    *%&!
    #$"&
    "!
    &
    
    "$ &
    &&#%&'" "$&"!!(&""
19. 
     
      
    
     
20. 
     
    
    
    
    
    
    !
    
    
    
    
    
    
    
    
    
     
    
    
    
    
     
    
      
     
    
    
    
     
    
    
    
    !
    
     
    
    
    
     
    
    
     
    
21. 
         )&
    "$!
    %+#$+#
    
    *)!#&!(-
    +'
    #
    (
    
    %&(
    $
    (
    '# #
    (!
    (
    +'
    #
    (
    
    ,
    
    &#'%$&(
    -&
    ''
    #
    
    )#($#
    &'%$#'!
    $&
    
    "'''
    '"%!
    *&'$#
    $
    (
    )
    $)!
     )(
    +(
    (
    
    '
    ""%-'
22. 
     %
    
    
    '!(
    %
    
    
     
     
    
    
    !
    
      
    & %"
      
    &
     &
    "
    !
    &
    &
    
    
    
    %
    
    $
    
      
    !
    &
    
    
    !
    !
    & 
    
    
    !
     !%
    !%
    %
     !
    !
    
    
     
    %
    %
    !
    #
     
    
    
    
    
    %
23. 
         
    
     
      
    
     
    
      
    
    
    
    
       
    
    
    
    
    
     
    
     
    
    
    
    
    
    
    
    
    
    
    
     
    
    
    
     
     
    
    
     
     
    
24.   
     
      
     
     
25. 
    
    
    
      !"$&'!&+
    &$
    %
    !"
    #'
    "#!
    %"'$
    %"&)$
    &&
    ")%
    +"'
    &"
    $'!
    
    #$"#$
     
    *
    !&)"$
    )&
    
      • $
    $
    !+
    #$"&%
    &"
    %&'#
    '$
    !&)"$% • #! • #!  • #!$ !&$ • , • #!
    )&
    &%&
    &"
    %!
    $&$$+
    #+"
    "!
    "
    &
    % %
    &"
    %'##"$&
     
    * " ) ( &" '  !) #!  • 
     
    '#
    )&
    
    $!&
    %"'&"!
26. 
    
    
    
      
    (!)
    
    ! 
     
     
    $
     "%
    
    
    
     "
    
    
    
    
    
    
    
    
    !  
    
    
      
    ! 
    
     "
    !
     
    # 
    "
      
    
    
    
     
    
    
     ! " &  '
     !
27. 
    
    
    
      
    #!
    "
    
    ""
    %"
    
     '
    
    
     
    "
    
    ""
    !""'
    $
    " "
    "  
    
    $
    "
    !"# 
    "
    #"! 
    "
    
    
    "
    
    %
    
    #!"
    "
    "% 
     " !
    !#
    !
    
     "
    "
    
    
    
    "
    "
    
    %
    
    ""
    
    !
    
    !
    "&"
    !!!
     
    "
     
28.  
    
    
      & "' " " "'  #  ''#" "# !&& &&!     $ "'*' &
    ("' • "#% • 
    )'
    )"#)& * "&'  %"'
    #$'#" " " % #%& $ (
    "
    !"#% • 
    
    &" "
    %)% • 
     
    *
    &" "
    ("'
29.  
    
    
      &
    ("' • "#% • 
    )'
    )"#)& * "&'  %"'
    #$'#" " " % #%& $ (
    "
    !"#% • 
    
    &" "
    %)% • 
     
    *
    &" "
    ("' & "' " " "'  #  ''#" "# !&& &&!     $ "'*' 
     
30. 
       
         ! #" ! #"  "     %! & ! !  !         !     " ! "
    !  #"  $ ! !' " " "  #  "" ! !! " ! #"
31. 
    
         •     ! ## ! #!   " # #  " $# " 
    ! "" •   " & # #"!% #! • $# # #! $ !! # • #"  $!#! •  & #  • ! # " $# # $ !
32. 
             05/& 51)2#&' (5/%4+0/#-+49 0(
    4*'  5/+4 • 1)2#&' 0%%523 7*'/ 3'-(%*'%, (#+-3 • 05/& (+2.7#2' 1#%,#)' "!! • '%06'2 4*' (02.#4 • 4
    +3 $#3'& 0/ 8!02,3
    (02
    07'2 #)+%5. 8   -0$ &&2  $94'3 -0$ +:'  94'3 -0$ #4# -0$ &&2  94'3 -0$ +:'  94'3 -0$ #4#   $94'3 -0%,+:'  $94'3 '23+0/   $94'3
33. 
                •     •      •     
        
34. 
                             " "     !      
       !  !      
35. 
    
36.  
     
         
    % #
    &
    "$
    
    
    !
     
    %
     
    !" !#
    &!
    "" #"
       
    
    $"#
    
    
    #
    
     
    ## #
    ""
    
37.  
     
         
    !!
    !!"!
    
     
     "
     !
    %
    #!"
    
    !"
    #
      &
    "
    
    "
    $# 
    #" • ! $
    "
       
     • "
     !!
       
    
38.  
    
      
       
    
    
         
     
    
    
    
    
    
39.  
    
      
       
    ##
    %
        
     $
    "#$
    
    %
    '& #
    & %! • 
    
    %&#
    ! $$%$
    !
     
    !#%
       $
    • %
    $!&
     %
    %$
    
    
    $$
    %#!&
    "#!"#(
    $%
       $
40.  
    
      
       ##
    #"'
    !
      
     •    
    
    %#$
    
    & •   
    
    %#$
    
    &
41. 
       
      
    &%"
     
    #)
    # "$#
    $
    #%
    !"$"#
    
    $
    ""
    $ 
    $
    %"
    &" '
    !!#
    "$
    " $
    ##
    $"&
     "
    $
    "#$
    !"$
    
    $
    (! $$  • (! $
    
    ##
    #$
    &" '
    %#$
    
    
    $
    # •
     $
    ") #
    $
    $"%
42.  
    
    
      
    
      
     
    
    
     
     
     • 
    
    
    
    
      
    
    
    
    
    
    
    
      • 
    
    
    
      
    
    
     
    
    
    
    
     
     
      
     
     
     
    
      
     
    
    
    
     
    
43.  
    
    
      
    
      
    
     
    
     
    
    
     
     
    
    
    
    
      • 
    
    
    !
    
    
     
    
    
    
    
     
    
    
    
    
     
    
    
    
    
    
    
    
     ! 
     
    
    
    
     
     
    
    
     !
    
    
    
     
     
    
    
    !
    
     
    
44.  
    
    
      
    
      
    %
     !!
    
    
    
    
    !!
    !
    
    "! • $
    "
    !!
    $
    "
     • 
    "
    !!
    !" "
    %"
    "
    $# 
    #"
    #"
    #
    "
    
    !" • 
    "
    !! •  "
    "
    !!
    "
      • 
    "
    !!
    #"
     
      • 
    "
    !!
     "
    %"
    "
    $# 
    #"
    
    #
    
    !"
45.   
    
      
    
    
    
    
    
     
    
     
     
    
      
    
    
    
    
     
     
      
    
    
     
46.   
    
      !
    
    
    
    ! 
    %
     
    "!
    &  
    "!
    &  !
    #$
    
    
    
    
    
    
     
    
    #
    
    "
    !!
    
    
    
47.   
    
      !'
    
    %%
    "#!
    
    
    !#
    %%
    (* &#
    ! •  
    
     !#
    
    '
    
    $&
    %%
    
    
    
     
    
      •  $
    %
    )
    "! %
    !
    & %!
      !
    %%
    
    
    
    
      &
    
    "*!
    (!#$
    !#
    #%##*
    '$
    !
    ! 
    
     ! 
    * &#%#!#
    %
    
     
    #$%#%$
    %
     %
    !
    
    *#
    $$
    %!
    
    $$
    %
     
    *%$
48.   
    
      ! $%#&% $&")!$ !%%#'&% "!$$ !#!#%$"$##%!%(%""# "%%%!!    • %)#!     &$ • %#%! !%! *! +
    
49.  
     
     
       
    $
    
    
    
    !
     
    "!
    $
    
    $
     !!
    ! 
    !
    
    &%'
    
    
    $$ 
    !
    
    
    
      
    
    !
    
    !
    
    
    !
    #
    
    # "
    !
    
    " "
    %! !
    
    
    #$
    
    !
    !!
    
    !
     
    !
     
    $
    #
    
    
      
    !!
    !
    
    !
    
    !
    !
50. 
    
51. 
        
     
     
    
    
      
       
     
    
     
     
     
      
    
    
      
    
    
    
        
     
    
     
     
    
    
     
     
52.  
    
     
    
     
      -*#(!
    ."
    -(
    1-
    ().
    ,+/#,
    3
    ."
    )(.-.
    ,/&-
    -)
    1
    #(.
    )
    #. "#-
    #-
    ().
    
    0,3
    */&#&3
    -./#
    .)*#
    /.
    .",
    ,
    !))
    2'*&-
    )
    -#'#&,
    -(,#)- • "..*-!))!&*,)$.4,)&)!-*).)'  )0, #,2*&)#.#(!,))'-1# # ".'& /-#(!
    /(,-.,#.
    
    .)
    )0,1,#.
    
    ''),3 • "..*-)'-/,#-)'&)!*)-.-*.") &-.,-#-.(  *."
    .,0,-&
    #(
    
    /-,')
    )'*)((.
    &&)1-
    (
    ..%,
    .)
    ')# 3
    #&-
    #(
    ."
    
    #&-3-.' (
    ..%,
    (
    "#(
    
    -(
    -*
    .)
    
    
    $/-.
    &#%
    
    ()2
    -*
    (
    
    "#(
    .)
    
    ,)1-,
     #(
    )'*&.
    )(.,)&
    )
    ."
    .,!.
    0# "
    ..%
    -/, 
    #-
    -#!(# #(.
    -#(
    
    &).
    )
    #( ),'.#)(
    '/-.
    
    2"(!
    .1(
    ."
    -(
    (
    ."
    
53. 
     
    
    
    
    
    
    
    
    $
    
     
    
    
    
    
    
     
    
    !$
    #
    "
    "
    
     
    
    
      $
    
    "
    
    $
    
     
    
    $
    
    $
    
    
    !
    
     
     
    
     
    
    
    
    
    
    
    
    
     
    
    
    
      
    
    
    
    $
    
    
    
     $
    
    
    
    
    
    "
    
    
    $
    
     
    "
     
    
    
     
    
    
    $
    $
    
     $
     $
54. 
           
       
     
55.