Source-linked AI summary
ARIstoteles -- Dissecting Apple's Baseband Interface
Tobias Kröll, Stephan Kleber, Frank Kargl, Matthias Hollick, Jiska Classen
TL;DR
Undocumented iOS wireless interfaces, especially ARI, leave a comparatively under-researched remote attack surface. The paper reverse-engineers ARI with Ghidra scripts, generates ARIstoteles, compares it with static-trace dissection, and fuzzes the interface, finding 42 unique crashes. The authors release the tool to support further wireless security research while noting limitations from state-dependent fuzzing and ARI's fragmented fields.
Problem
Undocumented iOS wireless components and ARI have received limited public security research despite their remote attack surface.
Method
The authors reverse-engineer ARI parsing libraries with Ghidra scripts, generate the ARIstoteles Wireshark dissector, compare it with static-trace dissection, and fuzz ARI through CommCenter.
Results
42 unique crashes were identified in CommCenter and ARI-related parsing libraries, affecting 12 daemons communicating with CommCenter via XPC.
Takeaways & Limitations
ARIstoteles provides a research tool for debugging baseband interactions and supporting further wireless security research.
Takeaways & Limitations
Static traffic analysis struggles with ARI's bit-fragmented, non-continuous fields, while fuzzing coverage varies with protocol and process state.
Abstract
from arXiv · showhide
Wireless chips and interfaces expose a substantial remote attack surface. As of today, most cellular baseband security research is performed on the Android ecosystem, leaving a huge gap on Apple devices. With iOS jailbreaks, last-generation wireless chips become fairly accessible for performance and security research. Yet, iPhones were never intended to be used as a research platform, and chips and interfaces are undocumented. One protocol to interface with such chips is Apple Remote Invocation (ARI), which interacts with the central phone component CommCenter and multiple user-space daemons, thereby posing a Remote Code Execution (RCE) attack surface. We are the first to reverse-engineer and fuzz-test the ARI interface on iOS. Our Ghidra scripts automatically generate a Wireshark dissector, called ARIstoteles, by parsing closed-source iOS libraries for this undocumented protocol. Moreover, we compare the quality of the dissector to fully-automated approaches based on static trace analysis. Finally, we fuzz the ARI interface based on our reverse-engineering results. The fuzzing results indicate that ARI does not only lack public security research but also has not been well-tested by Apple. By releasing ARIstoteles open-source, we also aim to facilitate similar research in the future.
1 Introduction
The paper addresses limited public security research on undocumented iOS wireless components by reverse-engineering ARI and fuzzing its interface. It introduces ARIstoteles, a Ghidra-generated Wireshark dissector, and reports 42 unique crashes in CommCenter and ARI-related parsing libraries.
- Motivation: iOS wireless components have received less public security testing than Android components, despite their substantial remote attack surface.The authors focus on undocumented cellular components and iOS baseband interfaces.
- Approach: The authors reverse-engineer iOS ARI parsing libraries and use Ghidra scripts to extract protocol information for dissector generation.The extracted knowledge supports increasingly fine-grained ARI analysis and fuzzing.
- Contributions: The work publicly reverse-engineers and documents ARI, producing the Wireshark dissector ARIstoteles.The contribution targets an Apple-internal protocol lacking public documentation.
- Contributions: The Ghidra-based approach is compared with fully automated dissector generation from static protocol traces.The paper presents this comparison as part of its evaluation of ARI dissection methods.
- Results: 42 unique crashes were identified in CommCenter and ARI-related parsing libraries during fuzzing.The crashes also affected 12 daemons communicating with CommCenter via XPC; Apple began patching them in iOS 14.2 and added patches in iOS 14.6.
2 Background and Related Work
iOS baseband processing divides work among the baseband chip, kernel, CommCenter, and sandboxed user-space daemons, while ARI-related shared libraries expose key parsing and injection points. Compared with Android, iOS has received less extensive baseband research.
- Baseband Security Architecture: Baseband packets pass through the chip, kernel, CommCenter, and sandboxed user-space daemons, where much protocol parsing occurs.The kernel is kept minimal because it runs with high privileges.
- Baseband Security Architecture: Baseband chips are optimized for performance rather than security and may expose ARI or QMI management interfaces depending on chip type.The threat model assumes either baseband code execution or unabstracted attacker-controlled data reaching CommCenter.
- Related Work: iOS baseband components have been less extensively researched than Android components, although earlier work demonstrated code execution through an SMS parsing issue in CommCenter.The cited historical issue occurred on one of the earliest iOS releases.
- Research Access: Apple debug profiles permit observation of the baseband–CommCenter interface, while jailbroken devices permit custom QMI and ARI payload injection.The authors instead hook CommCenter libraries responsible for parsing baseband messages.
- iOS Shared Libraries: libARIServer.dylib is the last protocol-aware library before kernel drivers and performs only a few final checks, including sequence-number checks.Its position makes it suitable for injecting arbitrary payloads through AriHostRt::SendRaw and AriHostRt::InboundMsgCB.
- iOS Shared Libraries: libARI.dylib performs most parsing and message abstraction and contains message-group names and definitions for most TLV types.These contents make it useful for automatically generating a Wireshark dissector.
3 Apple Remote Invocation Protocol
ARI is an undocumented Apple-internal management protocol with a historically grown packet structure. Its fixed header and versioned TLVs carry lightweight control information, but fragmented fields and complex formatting make the protocol difficult to analyze.
- Protocol Documentation: ARI is an Apple-internal protocol without public documentation, so understanding its structure is necessary for following the paper's reverse-engineering process.The paper provides technical details of how the protocol information was obtained later.
- Protocol Scope: ARI carries management commands and lightweight information such as SMS, location, and time, but not network traffic or call audio.Each packet has a fixed-length header containing group and type identifiers.
- Header Format: The ARI header uses group and type identifiers to describe packet purpose and further actions.Examples of group purposes include SMS processing, calling, SIM access, and diagnostics.
- Header Format: The header's historically grown format places fields such as the sequence number in unused bits across three non-consecutive bytes.This layout makes the header difficult to understand.
- TLV Format: ARI TLVs contain a type, length, value, and version number, but this structure alone does not capture protocol semantics.The historically grown packet format makes further security research challenging.
4 Fully-Automated Protocol Dissection
The authors evaluate traffic-only heuristics for segmenting ARI headers and classifying message types. These methods achieve strong message-group classification, but ARI’s bit-level and non-contiguous fields limit fully automated dissection.
- Message classification: Almost 95% of messages belong to nine groups, with net_cell the most frequent group at 312 occurrences.The analyzed trace was reduced to 1,000 messages, producing 20 groups.
- Header segmentation: Heuristics-based segmentation correctly identifies nearly all ARI header boundaries except for one magic-byte exception.The algorithm operates at byte level and cannot recognize non-continuous segments.
- Limitations: Bit-level and non-continuous segments make statistical static traffic analysis particularly difficult for ARI.Split segments are hard to identify and grouping them can increase false boundaries.
- Message classification: Nemetyl identifies 32 clusters, of which 30 contain messages from exactly one group.Only two clusters contain messages from multiple groups, indicating highly accurate group classification.
- Assessment: Static traffic analysis has high potential for message-type identification but requires ARI-specific adaptations because of its unusual packet structure.The authors therefore continue with manual reverse-engineering and automate the findings using Ghidra scripts.
5 Automated Reverse-Engineering
The authors reverse-engineer ARI’s compiled type and message definitions from iOS libraries with Ghidra scripts. The resulting extraction supports automated dissector generation, version tracking, and readable parsing of embedded formats such as SMS.
- Group and TLV Definitions: ARI parsing begins with magic-byte and length checks, then assigns message groups through the ARIMSGDEF_GROUPS lookup structure.On iOS 14.5, the array contains 63 pointers to group definitions.
- Group and TLV Definitions: Each message definition stores a group number, message-type identifier, mandatory and optional TLV lists, and a human-readable type name.These structures are represented in the net_cell group example.
- Group and TLV Definitions: Each TLV definition contains an index, type identifier, encoding pointer, and name.The script extracts these entries by following pointers from the exported ARIMSGDEF_GROUPS symbol.
- Automated extraction: The scripts extract protocol structures from closed-source libraries without source code by applying reverse-engineered layouts to decompiler output.Null entries terminate the extracted group and TLV lists.
- String definitions: Of 290 asString methods, 240 use lookup-table or if-not variants that Ghidra can extract automatically, while switch-case variants require manual extraction.Emulating these methods could miss inputs because their input ranges are undefined.
- Dissector output: The resulting dissector makes embedded formats such as SMS more readable after manually adding their dissectors.Figure 8 depicts ARIstoteles dissecting an SMS.
- Version tracking: Automated dissector generation reduces reverse-engineering overhead during initial creation and across iOS updates.The scripts also track ARI changes across iOS versions and identify when new protocol features appear.
6 Fuzzing
The authors develop physical-device fuzzing strategies for ARI by injecting protocol-aware payloads into CommCenter and compare mutation and coverage approaches. Generation-based fuzzing preserves protocol structure, runs faster, and finds crashes, including issues affecting multiple daemons, though crash replay and root-cause analysis remain difficult.
- Fuzzing setup: The fuzzer injects ARI messages into CommCenter through libARIServer.dylib, using the InboundMsgCB target function and optional runtime instrumentation.The setup can run in-process on the physical device, while external injection keeps packet and crash logs outside the target.
- Fuzzing strategy: Coverage-based fuzzing is slowed by instrumentation and produces inconsistent feedback because ARI processing depends on protocol state, external configuration, and user interaction.Repeated packets can yield different coverage, such as later parts of a multipart SMS behaving differently depending on prior state.
- Fuzzing strategy: Protocol-aware generation preserves structural information while mutating payloads, and the external generator reaches around 400 fuzz cases per second.The approach replays a corpus, mutates selected messages, and logs sequences because some crashes depend on packet order.
- Fuzzing results: CommCenter crashes require roughly 20–30 s to restart, and large-corpus reinitialization can take several minutes, reducing fuzzing speed.The crashing payload is removed and coverage is recollected before restarting the fuzzer.
- Fuzzing results: The authors compare five fuzzers and find corpus-based structural mutation best overall, combining comparable speed with high bug density while avoiding coverage overhead.Coverage-collecting approaches were slower and their inconsistent feedback did not compensate for the slowdown.
- Crash evaluation: The campaign identified a security-critical misd parsing issue affecting Qualcomm and Intel iPhones, although it was not reproducible by replaying the same packets.The issue was present in iOS 13.7 and fixed in iOS 14.2; Apple did not assign a CVE because it was discovered in parallel.
- Crash evaluation: Understanding ARI payloads accelerates crash analysis, but CommCenter lacks exported symbols and inaccurate decompilation complicates root-cause identification.A CellMonitor crash could be localized to processGsmCellInfo and inspected by converting the packet into a Wireshark dump, although exploitability beyond denial of service remained unproven.
7 Conclusion
The authors argue that undocumented wireless interfaces such as ARI create substantial security risk when insufficiently tested. They release ARIstoteles as an ongoing research tool and as a foundation for broader cellular experimentation.
- Security impact: The fuzzing results lead the authors to assume that Apple had not performed fuzz testing on ARI despite its reachability through wireless components.They call for improved wireless interface security and internal fuzzing campaigns in future releases.
- Future research: ARIstoteles remains useful after iOS parsing issues are fixed by enabling live debugging of baseband interactions and insight into network operation and SIM interaction.The authors position the open-source release as a first step toward low-level cellular experimentation comparable to existing Bluetooth and Wi-Fi projects.
Availability
The project releases ARIstoteles, its Ghidra extraction scripts, and runtime packet-recording and injection scripts through a public repository.
- Release contents: The repository contains ARIstoteles source code and Ghidra extraction scripts for the project.It is available at https://github.com/seemoo-lab/aristoteles.
- Release contents: The repository also includes scripts to record ARI packets during runtime and inject packets, including replayable crashing packets and sequences found by the fuzzers.