Baseband fuzzing on budget pt.3

In Parts 1 and 2 we covered how to set up a private baseband RAN, build a bare-bones fuzzer, and gather all the data needed to triage the crashes it produced. In Part 3 we focus on the missing piece of the puzzle: baseband firmware — why you need to get hold of it and do at least some reverse engineering. At the end of the post we’ll walk through a few real-world examples of crash triage.