Some time ago, only the HTC Dream was supported,then the support for the Nexus One was added. however theses two devices have a qualcomm SOC(system on a chip). A SOC(system on a chip) is a chip that contain the CPU and other things, in our case it contains:

  • The CPU
  • The modem
  • The "sound card" that is in reality a DSP
  • the GPS
  • some other things not mentioned here because they are less important for this article

Here The modem is the radio that communicates with the GSM towers, it has its own CPU and communicates with the main CPU trough a fake serial link over shared memory. Its firmware is proprietary and very difficult to replace(it's not impossible to replace, however the work is hard and no one started to work on it for this particular modem).

The Qualcomms System on a chip, while beeing very easy to support with android, have some privacy flaws:

  • The GPS is attached to the modem
  • The "sound card" (DSP) is also attached to the modem
  • The main CPU ram is shared between the modem and the main CPU, that means that the modem could access/replace what's in the main CPU ram.

However The nexus S is much better privacy wise(if we succeed to free it), the hardware is built differently and doesn't have the problems described before: The nexus S modem (called X-GOLD 616) and CPU (Cortex A8 in the S5PC110 SoC) are separated(on a different chip),and the Nexus S is architectured this way:

  • The modem and the CPU still communicate over shared memory, however that shared memory is a 16K memory on the SOC(system on a chip), and it's separated from the modem ram or the CPU ram.
  • The CODEC(sound card) is controlled by the main CPU: it's connected trough both the main CPU(for the PCM) and the modem(for feeding and receiving the sound durinng a call), but the control of it is done by the main CPU.
  • The GPS is connected trough a serial port of the main CPU, however its protocol is unknown at this stage
  • The Modem has no access to the NAND(like a hard disk),the main CPU has to read the modem firmware from the NAND and send it to the modem's bootloader, trough a serial port.

 buy research paper