BaseTrace

October 27, 2025 · View on GitHub

A framework of tools for researching the interface connecting the iPhone's application processor with its baseband chipset and related functionalities.

Read more about the different baseband chips part of iPhones on The Apple Wiki.

The CellGuard iOS app for detecting rogue base station builds upon our insights gained from applying BaseTrace. The app is available in a dedicated GitHub repository.

Qualcomm Basebands

iPhones with Qualcomm basebands use the Qualcomm MSM Interface (QMI) protocol for iOS-baseband-communication. Read more about the iPhone's baseband architecture in our paper "Catch You Cause I Can".

libqmi iOS Extensions

iOS-specific protocol extension for the library libqmi used by the QMI dissector and CellGuard.

QMI Dissector

A Wireshark dissector for iPhones with Qualcomm basebands.

Works with all iPhones.

QMI Injector

A tool to establish a direct communication link with Qualcomm basebands in iPhones, enabling you to inject custom QMI packets and receive the baseband's responses.

Requires a jailbroken iPhone.

Intel & Apple Basebands

iPhones with Intel and Apple basebands use the Apple Remote Invocation (ARI) protocol for iOS-baseband-communication. Read more about the protocol in Tobias' bachelor thesis and his paper ARIstoteles.

ARI Dissector

ARIstoles is a Wireshark dissector for iPhones with Apple or Intel basebands.

Works with all iPhones.

C1 Binary Ninja Loader

iPhones with Apple basebands (C1, C1X, ...) use ARM-based firmware. Our loader for Binary Ninja enables you to decompile various binary firmware files. The directory contains the tool's installation instructions.

Apple Location Database

Apple's location database stores approximate locations for a Wi-Fi access points and cells part of the cellular network. Read more about how different open location databases compare with Apple's database in our paper "Catch You Cause I Can".

Apple Location Services

A standalone client for querying Apple's location database.