INTEGRA v4.2 [INTERNAL LEAK]

This is the recovered internal documentation for INTEGRA v4.2, a hybrid SS7 / GTP-C mobile interception platform targeting Android baseband implementations from 8.0 through 12.0. Rather than relying on the classic SS7 SendRoutingInfo / ForwardSM path — which every major carrier now terminates at the SS7 firewall — the platform forces the target handset to originate a GTP-C Create Session Request against a controlled relay, establishing an encrypted control tunnel back to the operator console.

The practical result: an operator inputs an MSISDN, and within seconds receives live inbound SMS for that subscriber for a fixed 60-minute window, with no artifact left on the device afterwards.

1. System Architecture

INTEGRA is built as four decoupled layers. Each layer can be replaced or upgraded independently, and the console never holds a plaintext MSISDN beyond the active session buffer.

Why this outperforms standard SS7 tooling

2. Protocol Comparison Matrix

Four interception families exist today. Only the fourth is operationally viable at scale, and the reasons matter if you are budgeting around failure rates.

3. Operational Flow

1. Operator input. The console accepts an MSISDN in E.164 format (e.g. +14155550123). No other parameters are required — the AI gateway derives carrier, region, baseband vendor family, and preferred injection path.
2. Route resolution (L0). The gateway resolves the number against its carrier profile index, then traces HLR/VLR containment to identify the serving network, the correct relay PoP for that region, and whether the carrier is known to filter GTP-C on the roaming interface. It returns a confidence score and an ordered path list.
3. Injection (L1). The relay transmits the crafted Create Session Request toward the target's tunnel endpoint. On a vulnerable baseband, the malformed session-creation handling path writes past its intended buffer and hands control to the payload stage.
4. Payload install (L2). The Mobile Admin payload lands in the RIL daemon context. It installs a hook on the SMS delivery indication path, registers a TTL watchdog, and establishes the reverse channel. The target sees no notification, no icon, no running process, no battery delta, and no data-usage increase.
5. Tunnel establishment. The AI-driven entropy tunnel comes up. Cryptographic handshake completes, session key is derived, and the operator console flips to SESSION ACTIVE with a 60-minute countdown. From this point the console renders every inbound SMS for that subscriber in near-real-time.
6. Live interception. Inbound messages are mirrored to the console before local delivery. If the operator sets BLOCK_LOCAL_DELIVERY, the target's handset never receives the message at all — the subscriber sees silence while the operator holds the code.
7. Teardown (L3). On TTL expiry, operator command, or target-side network change, the Vanishing Protocol runs: payload sectors overwritten, baseband logs cleared, modem contexts reset, TEID state invalidated, keys rotated. The device returns to a state indistinguishable from normal operation.

4. AI Gateway — Route Selection

The gateway is not a wrapper around an LLM. It is a gradient-boosted route classifier operating on a 3.1M-record corpus of carrier signalling behaviour, with an LLM layer used only to summarise and explain a decision to the operator. It emits, for every request:

• Carrier identity and the associated firewall profile (SS7 filter set, GTP-C inspection posture, diameter state).
• Serving node — the VLR/MSC currently holding the subscriber, derived by HLR containment lookup.
• Path ordering — GTP-C, SS7, or PARALLEL, plus the framing variant for that baseband vendor.
• Relay assignment — which of the 14 relay PoPs will produce the lowest-latency, most naturally-distributed traffic pattern for that region.
• ETA and confidence, both surfaced in the console before the operator commits.

Sample gateway output:

[gateway] target=+14155550123
[gateway] carrier=Carrier-X (profile 0x8A21, MCC 310)
[gateway] hlr=LR-SEA-02  vlr=LR-SEA-07  serving=MSC-SEA-14
[gateway] ss7_filter=TIGHT      gtp_c_inspection=NONE
[gateway] baseband_family=Qualcomm-MSM (variant B)
[gateway] path=GTP-C           confidence=0.91
[gateway] relay=pop-04 (us-west)  eta=6.4s
[gateway] fallback=SS7 (held, not fired)

5. Injection Layer — Packet Detail

The GTP-C injection is the core of the platform. The session-creation request below is abridged and reformatted for documentation; the shipped payload carries the live variant.

GTP-C v2 Create Session Request
  TEID              : 0x00000000  (new context, root)
  Message Type      : 32  (Create Session Request)
  Sequence Number   : 0x0001
  PDCP Number       : 0x00000001
  Bearer Context    : 0x00000000
  Recovery          : 0x00000000

  IMSI               : 
  MSISDN             : 
  ULI (PLMN)         : 
  UE Time Zone       : 
  RAI (Routing Area) : 
  MEI / IMEISV       : 
  Serving Network    : 
  RAT Type           : 6  (EUTRAN)
  ULI Type           : 1

  MSISDN/IMSI flags : [PRESENT]
  Handover Info     : [PRESENT]  <-- mismatched length class
  PDN Type          : 1  (IPv4)
  PDN Address       : 0.0.0.0
  APN               : "ims"          <-- control-plane-looking APN
  PAA               : <relay-side private pool>
  Paging Policy     : 0
  ...
  [TRUNCATED 84 bytes — header-length field understated by 0x20]

The exploit primitive is the length inconsistency: the header length field declares fewer bytes than the body actually carries, and the baseband's session-creation handler trusts the declared length while copying on the true length. On Qualcomm-MSM and MediaTek variants from Android 8.0 through 12.0 this yields a controlled write into the adjacent session-context allocation, which is then shaped into the RIL daemon context so the payload executes there rather than in the modem's own context.

The APN string is deliberately "ims" — it makes the session look like an IMS registration attempt rather than a data session, which is one of the reasons the traffic survives scrutiny on carriers that log roaming sessions but do not decode their bodies.

6. Persistence Layer — Mobile Admin Payload

The payload is position-independent and position-agnostic — it locates its own hooks by signature scan at runtime rather than relying on fixed offsets, so it survives baseband firmware patch revisions within the supported version range.

The console can hold up to 12 concurrent sessions per license, though this is the single biggest driver of relay load and the reason the license count is capped at 30 — the operational ceiling for the current relay pool without changing traffic-shape behaviour.

7. Entropy Tunnel Specification

Once the payload is live, all captured message content travels back to the console over the control channel. The hard problem here is not encryption — it is that a persistent, high-volume tunnel from a handset to a fixed destination looks nothing like a subscriber's normal behaviour. That gets flagged.

The entropy tunnel solves this by making the tunnel traffic statistically indistinguishable from ordinary roaming data:

• Timing jitter. Message forwarding is delayed by a randomised interval (mean 380 ms, σ 220 ms) rather than dispatched instantly. Instant forwarding is itself an anomaly.
• Padding. Small messages are padded to the size distribution of the carrier's typical SMS data profile so message lengths don't fingerprint the tunnel.
• Interleaving. Forwarded content is multiplexed into a synthetic data stream with synthetic padding frames generated to match the target carrier's average PDP-context byte rate.
• Relay rotation. The egress relay for a session rotates across the relay pool on a randomised timer, so a single destination IP never accumulates a long-lived flow.
• Downlink shape. Operator commands and acknowledgements travel as ordinary GTP-U downlink user-plane frames — the same path the device uses for all its other data.

Cryptographic construction:

handshake   : X25519  (ephemeral, per session)
             + Ed25519 (server auth, pinned in LICENSE.key)
             + HKDF-SHA256, salt = SHA256(target IMEI || nonce)
             + 1-RTT, 0-RTT disabled (0-RTT is replayable and
               replayable is fatal for an interception tool)
bulk        : ChaCha20-Poly1305, per-frame nonce,
             counter derived from tunnel sequence
rekey       : every 2^16 frames or 15 minutes, whichever first
tunnel id   : 32-byte HMAC-derived tag; the receiver
              cannot map it to a subscriber without the key

8. Vanishing Protocol

Cleanup runs on any of three triggers: TTL expiry, an operator-issued PURGE command, or loss of the tunnel for more than 90 seconds. Sequence:

1. Stop capture. Hook is disabled; no further messages are read.
2. Restore dispatch. The original SMS delivery path is restored, and the RIL daemon's function pointer table is restored to its pre-injection value byte-for-byte.
3. Overwrite payload. Every page of the payload in memory is overwritten with cryptographically random data, then re-overwritten with zeros. Pages are released back to the allocator with a scrub prior to free.
4. Clear baseband logs. The session-creation records and the associated TEID mappings are removed from the modem's ring buffers, and the modem context table entry is zeroed.
5. Reset modem state. EMM/ESM contexts for the session are reset to their pre-session values.
6. Rotate keys. Session keys are destroyed and the tunnel identifier is burned.
7. Verify. A self-check confirms the hook table matches a clean baseline hash. A mismatch triggers a full modem reinitialisation, which clears anything residual at the cost of a visible brief loss of signal.

Result: the target device, imaged immediately after teardown, shows no installed package, no modified system binary, no anomalous process, no abnormal battery or data counters, and no residue in the radio log. The carrier's own core-network records still contain a session-creation event, but it is indistinguishable in shape from a roaming session that failed to establish.

9. Target Compatibility Matrix

Carrier posture summary (2026 fleet data, 847 profiles):

• No GTP-C inspection, no SS7 filter — 41% of profiles. Expected success ~98%.
• SS7 filtered, no GTP-C inspection — 38% of profiles. Expected success ~91%.
• SS7 filtered, GTP-C inspection on roaming plane — 17% of profiles. Expected success ~60%.
• Both filtered, plus diameter subscriber-rate limiting — 4% of profiles. Expected success ~22%.

Not supported: iOS (different baseband and platform security model), feature phones, non-Android handsets, and Android devices whose firmware has been backported with the relevant validation hardening.

10. Package Contents

Each license ships a single signed archive. The operator unpacks it once; there is nothing else to install and no dependency on the seller's infrastructure being alive at delivery time.

integra-v4.2-rc7/
├── LICENSE.key              # Ed25519-signed, bound to your console ID
├── manifest.json            # build metadata + SHA256 of every file below
├── dashboard/
│   ├── index.html
│   ├── app.js
│   ├── styles.css
│   └── assets/              # icons, fonts, map tiles
├── payload/
│   ├── android-inject.bin   # 14.6 KB, position-independent
│   └── variants/            # framing variants A/B/C by baseband family
├── relay/
│   ├── relay-client         # signed client for the operator's own PoP
│   └── relay.conf.example
├── tools/
│   ├── hlr-lookup.py        # standalone HLR/VLR tracer
│   ├── carrier-db.sqlite    # 847 carrier profiles, 31 MB
│   ├── selftest.sh          # verifies install against a loopback harness
│   └── forensic-check.md    # how to verify a clean device post-session
├── docs/
│   ├── quickstart.pdf       # 18 pages, install to first session
│   ├── full-manual.pdf      # 47 pages
│   ├── api-reference.md
│   ├── carrier-notes.md
│   └── troubleshooting.md
└── LICENSE-AGREEMENT.txt

Verification. manifest.json contains a SHA256 for every file. The package root SHA256 is printed on the console at delivery and is the same value shown in the metadata block at the top of this dossier.

11. Deployment & Requirements

What the operator needs

What the target needs

• Android 8.0 – 12.0, unmodified stock firmware with a supported baseband family.
• An active mobile data connection on the target's own SIM. WiFi-only targets are not reachable — GTP-C is a radio-interface protocol and is not carried over WiFi.
• The subscriber must be attached to a supported network. Devices roaming onto an unsupported PLMN will be rejected by the gateway before injection is attempted.

12. API Surface

The console is a thin client over a JSON API, so the platform can be driven from scripts as easily as from the UI. Auth is Authorization: Bearer <license-key> plus an Ed25519 request signature over the body.

POST /v4/sessions                 create a session
  { "msisdn": "+14155550123", "ttl_min": 60,
    "block_local_delivery": false }

GET  /v4/sessions/{id}            session state + countdown
GET  /v4/sessions/{id}/messages  live message feed (SSE)
POST /v4/sessions/{id}/purge     trigger Vanishing Protocol now
GET  /v4/sessions/{id}/receipt   teardown verification receipt
GET  /v4/carriers/{msisdn}       gateway pre-flight + confidence score
GET  /v4/stats                   fleet success rates for your license

13. Reference Session Log

[14:19:58] [gateway] target=+14155550123 carrier=Carrier-X profile=0x8A21
[14:19:58] [gateway] path=GTP-C confidence=0.91 relay=pop-04 eta=6.4s
[14:20:01] [relay]   session-create sent ue-context=0x2f81
[14:20:06] [relay]   session-established ue-context=0x2f81 teid=0xa31c9004
[14:20:06] [payload] injected pid=ril-daemon baseband=Qualcomm-MSM variant=B
[14:20:06] [payload] hook installed: Rp-DATA dispatch
[14:20:06] [payload] watchdog armed ttl=3600s
[14:20:07] [tunnel]  handshake ok peer=pop-04 cipher=ChaCha20-Poly1305
[14:20:07] [console] SESSION ACTIVE  target=+14155550123  remaining=59:53
[14:20:41] [console] inbound smsc=+14155550000 orig=+447700900123
[14:20:41] [payload] captured id=88291 type=OTP delay=+0.41s (jittered)
[14:20:41] [console] MESSAGE RECEIVED
[14:20:41]           "Your verification code is 849201"
[14:21:03] [console] inbound smsc=+14155550000 orig=+447700900123
[14:21:03] [payload] captured id=88307 type=OTP delay=+0.33s (jittered)
[14:21:03] [console] MESSAGE RECEIVED
[14:21:03]           "Do not share this code with anyone."
[21:19:55] [payload] watchdog fired ttl_expired
[21:19:55] [cleanup]  dispatch restored, hash-verified
[21:19:55] [cleanup]  payload pages scrubbed (3 x 4096)
[21:19:55] [cleanup]  baseband ring buffers cleared (4 records)
[21:19:55] [cleanup]  emm/esm context reset
[21:19:55] [tunnel]  keys destroyed, tunnel id burned
[21:19:55] [console] SESSION CLOSED  teardown=VERIFIED  residue=NONE

14. Changelog

15. Buyer Feedback

Three of the first licenses have been issued. Feedback below is from those operators.

16. FAQ

17. Contact