The Problem
iPhone users have no built‑in visibility into baseband activity, making it hard to detect rogue cellular base stations or malicious firmware that can intercept calls, SMS, or data. Security researchers need a way to capture low‑level QMI/ARI packets from the modem, parse them, and present the findings in a usable UI.
What This Does
Packet capture – The CapturePacketsTweak directory contains an iOS tweak (CPTClient.swift, CPTCollector.swift) that hooks the baseband and writes raw QMI/ARI packets to a shared container. The Makefile builds the tweak for jail‑broken devices. Native parsing – CellGuardAppRust provides a Rust library (src/lib.rs, src/csvparser.rs) compiled as a static framework via Cargo.toml. It parses the binary payloads into CSV/JSON structures used by the UI. iOS front‑end – CellGuardAppSwift is a full‑featured Swift UI app (see CellGuardAppSwift/CellGuard/AppDelegate.swift, CellGuardAppSwift/CellGuard/Cells/Verification/VerificationPipeline.swift). It reads the CSV exports, visualises cell towers on a map, and flags suspicious patterns (e.g., duplicate IMSIs, abnormal signal strengths).
The Python helper in AnalyzeCells (analyzecells2.py) can post‑process exported datasets for research‑grade statistics.
How To Use It
Setup
Rust library – From the repository root: cd CellGuardAppRust cargo build --release # produces libcellguard.a
The library is referenced from the Swift project via the bridging header BridgingHeader.h. iOS tweak – Build the jailbreak tweak (requires the iOS SDK and Theos): cd CapturePacketsTweak make package # creates a .deb for installation on a jail‑broken device iOS app – Open CellGuardAppSwift/CellGuard.xcodeproj in Xcode (≥14). Select a development team, resolve Swift Package Manager dependencies (none external), and build for a physical iPhone. The app automatically loads the Rust framework from the built products folder. Data analysis – To run the Python post‑processor: cd AnalyzeCells uv pip install -r uv.lock # or pip install -r uv.lock if uv not used python -m analyzecells2.py <exportedcsv>
Configuration
The tweak reads a plist (CapturePacketsTweak/CapturePackets.plist) that defines the shared container name. The Swift app expects the CSV files generated by the Rust parser to reside in the app’s Documents directory (CellGuardAppSwift/CellGuard/Core Data/Import & Export). No additional env‑vars are required.
Running it
Install the built tweak on a jail‑broken iPhone (dpkg -i <package>.deb). Launch the CellGuard iOS app; it will detect the shared container, import any newly captured packet logs, and display a live map with flagged cells.
Real‑World Use
A security team evaluating a corporate iPhone fleet could deploy the tweak on a test device, capture a week’s worth of baseband traffic, and then run analyze_cells2.py to generate a risk report. The Swift UI can be used by analysts to drill down on any anomalous cell IDs, cross‑referencing with the public Apple Cell Location Database for verification.
Code Health & Issues
Medium – No LICENSE file – repository root lacks a license, creating legal ambiguity for redistribution. Low – Limited test coverage – only two test files are present; no unit tests for the Rust parser or Swift UI components. Medium – Platform lock‑in – the tweak requires a jail‑broken iPhone; the repo provides no fallback for non‑jailbroken devices. Low – CI only for CI/CD – .gitlab-ci.yml exists but does not enforce linting or security scans for Swift code. Medium – Dependency hygiene – Cargo.toml pins several crates without version ranges; updates may break the build. No audit of Python dependencies (uv.lock) is shown.
Overall, the codebase is organized and the entry points are clear, but the lack of licensing, sparse testing, and reliance on a jail‑broken environment limit production adoption.
The Bottom Line
CellGuard delivers a complete pipeline—from low‑level baseband capture to a polished iOS UI—for detecting rogue cellular infrastructure. It is technically solid for research and controlled‑environment testing, but teams must address licensing, expand automated testing, and consider the jailbreak requirement before wider deployment.