Scripts, plugins, and information for working with Samsung's Shannon baseband.
Scripts, tools, and information to help reverse engineer Samsung's EXYNOS cellular baseband platform, codenamed Shannon. These tools were released for the talk "Emulating Samsung's Shannon Baseband for Security Testing" at Black Hat USA'2020, August 5th.
reversing/ghidra/ShannonLoader
A Ghidra extension for loading modem.bin
binaries from nearly all known modems to date. All firmware images from https://github.com/grant-h/ShannonFirmware are loaded during CI tests for the loader to ensure its compatibility.
reversing/ghidra/scripts
Ghidra post-loading Python scripts that help annotate Shannon modem images. This includes recovering debug strings and auto-naming functions. Use after loading with ShannonLoader.
reversing/modem
Raw modem.bin
extraction script into sub parts and others as they are developed.
reversing/btl
Scripts and info to parse Back Trace Log (BTL) files. These are included during modem crashes / dumps or via the "CP RAM Logging" functionality. These are compressed log files from the actual running modem.
firmware/
Information on firmware acquistion and some extracted data dumps.
Here's a quick tutorial to start reversing this firmware with GHIDRA.
modem.bin
file. Make sure to unlz4 the binary if it is compressed.ShannonLoader.zip
release that is in the latest release tagmodem.bin
file. You should see that this file's loader is automatically selected as "Samsung Shannon Modem Binary". If you do not see this, make sure that you have loaded the right file and installed the extension properly. Open GHIDRA debug console (bottom right on splash screen) to double check if there are any errors.ShannonTraceEntry.py
python script from Script Manager under the "Shannon" category. Make sure to either place scripts into your user home directory at ~/ghidra_scripts
(Linux) or add the path to them in the manager. This script will identify all trace debugging information before analysis and avoid diassembling data.log_printf
function, leading to broken disassembly throughout the binary. If you do not uncheck this, you will need to restart your import from scratch.ShannonRename.py
. This will help you navigate the binary, but remember that the names are heuristically determined, so quality may vary. Functions with the same guessed name will have a numeric prefix appended.If you want a quick look around, we exported a GHIDRA project for a 2017 modem image.
The repository's license is MIT. NOTE: The top-level license covers only files that explicitly contain SPDX markings, not the entire repository. For other files, they may not be licensable (e.g. binary dumps, firmware) or may contain other permissive licenses.