What's at the Bottom of the Sea, One Baseband? - Diving into the C1

The talk looks at Apple's C1 baseband, which appears in the iPhone 16e and is the first baseband Apple designed entirely in-house. The speaker compares its architecture with the Qualcomm and Intel designs covered at the previous year's event. On the hardware side, the chip is a custom system-on-chip wired to power management, a sub-6 GHz radio chain, satellite navigation hardware and several memory types, with a debug interface that is inactive on production boards.

Much of the firmware analysis focuses on how the image is packaged and loaded. A custom file format with a segment header must be parsed before the code can be mapped into a flat 32-bit address space. The boot path runs through iBoot and an L4-style microkernel, which starts a root task that sets up three compartments. One of these handles untrusted over-the-air data with limited hardware access. Apple applies pointer authentication and address space layout randomisation on the ARM64 cores, and failed assertions force a controlled crash instead of letting the firmware continue in an unsafe state. The speaker notes that only one public CVE has been disclosed so far and that Apple raised its bounties for baseband components.

The talk closes with a tool for monitoring carrier profiles, which configure features such as 5G standalone and RCS, across iOS versions and baseband models. Practical limits remain: no jailbreak exists for these devices, and dynamic analysis requires emulation or rehosting, which the research team is working toward alongside fuzzing. A loader for Binary Ninja is planned for release.