Anyone know if a similar process is possible to see what the baseband controller handling data transfer to the tower is doing? The method in this article works as well as the host os can redirect traffic. The baseband chip is often completely separate as I understand it. Likely would require a fake tower implementation, but maybe there are more creative solutions.