Replicant

The paper referenced in #2082 talks about variables in the adv-env.img file inside the PARAM partition.

On the Galaxy SIII, the PARAM partition contains at least a tar archive which contains a file named adv-env.img.

In Table 1 (SBOOT environment variables, stored in adv-env.img.) there is:

Index	Name	Example setting
1	SWITCH_SEL	3
...	...	...
10	CP_DEBUG_LEVEL	22015
...	...	...
12	DIAG_MODE	0
...	...	...

DIAG_MODE looks familiar as the xgoldmon README states:

To enable the logging mode ("diag mode") on the S2, S3 and Note2:

CP is most probably the modem (cellular processor), but what we need for that can probably be enabled with AT+TRACE=1 instead.

The next step would be to locate where in the adv-env.img is DIAG_MODE, as we don't want to have the device stuck in Thor mode / Odin Mode.

Once Xgoldmon does work we might look into how to implement that in Replicant to make it compatible with other applications using the diag mode of the modem to infer with point based system if there are any IMSI catchers or other strange stuff going on. For instance gsmmap seem to use the modem diag mode too on "Samsung S2 and S3 devices".