Qualcomm Firmware - For their eyes only
Contents
Intro
I was perusing for some more modern Qualcomm modem firmware to test out some of my tooling recently and I came across something quite interesting. I've had good results in the past with Oneplus devices, they have a quite active community that archives OTAs, and they are generally compatible with existing tools. So I took a look at the Oneplus 15, where I found a nice collection of firmware OTAs here (as long as you ignore the obvious rancid slop). You can unpack the downloaded ZIP with this tool like so (this is for the version CPH2747_16_0_9_400_ex01):
PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python python3 extract_android_ota_payload/extract_android_ota_payload.py 681afc0bfcdd4cafaa1225cbd0e13ce3.zip
Which gives you many .img files for each partition on the device. The modem image can be mounted directly and the actual modem firmware files are in the usual place of image/modem.bXX and image/modem.mdt. These can be merged with the usual tools. But from here things go south fast, as an example here's a comparison between the strings of a Oneplus 7 Pro and a Oneplus 15 modem:
# cd op7p
# strings -n20 modem_all.img | wc -l
59111
# cd ../op15
# strings -n20 modem_all.img | wc -l
104
Erm. That's not good.
Let's take a look at the entropy of these firmware blobs, starting with the Oneplus 7 Pro:
And here's what we have for the Oneplus 15:
It looks like at the very least Oneplus have started encrypting their modem images. This appears to include the Oneplus 15 and the Oneplus 13, but not the Oneplus 12 and earlier (as of CPH2581_16.0.8.300_ex01).
This is a real shame, because as far as I can tell this now limits the ability to research how these modems work, and find as well as report security issues within them, to a very small subset. A subset who have the ability to compromise these devices to extract the firmware from them. Furthermore, it disincentives actually reporting any issues they do find, as it could result it them being locked out of future devices.
I do hope Oneplus and/or Qualcomm change their mind on this one. Remember, security by obscurity is a myth.