Snooping on CommCenter
CommCenter is a wonderful part of iOS since it is the single point that is responsible for communication between iOS and the baseband. And with the baseband being responsible for controlling the telephony components I wanted to see what CommCenter was telling it.
To do this all you need to do is create a dynamic library with a few functions then shove that in between CommCenter and the baseband. Easy, eh?
Before I begin I should note that I did this using an iPhone 4 running iOS 6.1 (jailbroken) and that on newer iPhones the process is slightly different.
All code is available on GitHub.
Creating The Library
To intercept the communication between CommCenter and the baseband what you need to do is replace the implementations of
write(). You can see how to do this in the file
ccsnoop.c, but really the trick is to stick a map between your implementations and the original in a special section called
_interpose in the
All that’s necessary now is to compile the code into a dynamic library (see
ccsnoop.c for instructions).
Loading The Library
In order to have the library loaded by CommCenter we first need to alter its plist to include the
DYLD_INSERT_LIBRARIES environment variable.
<key>EnvironmentVariables</key> <dict> <key>DYLD_INSERT_LIBRARIES</key> <string>/tmp/ccsnoop.dylib</string> </dict>
The library should be located at
/tmp/ccsnoop.dylib; a complete plist can be found on GitHub.
As previously mentioned, the key here is the usage of
DYLD_INSERT_LIBRARIES which forces any specified libraries to be loaded before any libraries specified by CommCenter. When this is combined with the interposition used in the library we are able to override the default implementations of the desired functions.
With both the dynamic library and the modified plist we can then restart CommCenter and watch our log file for anything of interest. To restart CommCenter you can just run the
injectCommCenter.sh script which essentially just uses
launchctl to unload and load it.
A Note About CommCenter
Beginning in iOS 6 (or earlier, I’m not entirely sure) Apple has created two versions of CommCenter: CommCenterClassic, and CommCenter. Which is used depends on the hardware you are using. For example, an iPhone 4 will use CommCenterClassic while an iPhone 5 will use CommCenter. At this point it’s unclear to me what the difference is between the two; however, I have heard that newer devices use a different protocol to communicate with the baseband.
Until next time, happy hacking!