Baseband Exploitation
Stop just finding crashes. Learn how to exploit the baseband from scratch.
We are incredibly excited to present this Fuzzsociety deep-dive: Real-Life Case Study: Samsung Exynos Baseband.
In this intensive module, we pull back the curtain on how modern mobile modems function and fail under the hood. You won’t just study the theory—you will use FirmWire and AFL++ to reproduce CVE-2020-25279 on a Samsung Galaxy S10, chaining a heap overflow into full PC control.
Here is exactly what you will build and learn:
Phase 1: Mobile Architecture & Shannon OS
Understand Application Processor (AP) vs. Connection Processor (CP) isolation.Explore the ARM Cortex-R7 architecture, MPU setup, and coprocessors.Analyze the Shannon real-time operating system (RTOS) and GSM/LTE telecommunication protocols.
Phase 2: Emulation & Fuzzing with FirmWire
Set up QEMU+Avatar² based FirmWire for Samsung Exynos modems.Implement AFL++ harnesses and hypercall hooks for both GSM Call Control (gsm_cc) and LTE RRC.Lab: Take snapshots and fuzz the baseband to generate the CVE-2020-25279 crash using a mutated GSM Call Setup message.
Phase 3: Heap Exploitation Internals
Master crash minimization with afl-tmin to isolate the root cause.Reverse engineer the proprietary Shannon PAL allocator (non-dlmalloc) and its out-of-band metadata.Lab: Defeat the PAL_MEM_GUARD_CORRUPTION mitigation by perfectly repainting the heap redzone with constant-fill bytes.
Phase 4: Achieving Code Execution
Weaponize the allocator’s accounting logic to forge a chunk header.Turn the forged header into an arbitrary subtract-what-where primitive during pal_MemFree.Lab: Groom the heap using live L3 messages, overwrite a PAL vtable pointer, and achieve arbitrary code execution via r15 (PC control).
Who is this for?
Vulnerability researchers and exploit developers looking to master baseband exploitation, emulator-based fuzzing, and advanced ARM Cortex-R memory corruption techniques.