Get CellID, MCC, MNC, LAC, and Network in iOS 5.1

Question

I need to retrieve CellID, MCC, MNC, LAC and Network (GSM, 3G) of the current Serving Cell Tower in iOS 5.1 (iPhone 4S). I know this information is available because I can see it in FieldTest Mode (accessible after calling ****3001#12345#****). I suppose it to be accessible via Private/Undocumented iOS Frameworks.

In the question iphone, check values of cellId / Lac the author indicates I can get radio Informations cellId, Lac, MNC, MCC on iOS, but no information on how to do this is provided.

Can anybody tell me how to get this info?

for MNC and MCC: http://stackoverflow.com/questions/678485/how-can-i-get-the-mcc-and-mnc-on-an-iphone — Rok Jarc, Nov 15 '12 at 14:37
I have tried this to get MCC and MNC, but I get the following runtime error: `-[CTTelephonyNetworkInfo suscriberCellularProvider]: unrecognized selector sent to instance 0x226550` Reason? — poorDeveloper, Nov 15 '12 at 15:08
Did you include CoreTelephony.framework in your project and import it's headers? — Rok Jarc, Nov 15 '12 at 15:22
Yes I did. I added the lines `#import ` and `#import ` and I compiled after including `CoreTelephony.framework` — poorDeveloper, Nov 15 '12 at 15:29
I see: you're trying to use a class as an object. You have to create an instance of `CTTelephonyNetworkInfo` - just like the accepted answer to linked question above. — Rok Jarc, Nov 15 '12 at 16:00
I got it! It was just a typo error... I was calling `suscriberCellularProvider` instead of `subscriberCellularProvider` Now it works for MNC and MCC... Now I need CellID and LAC, what I suppose to be difficult... — poorDeveloper, Nov 16 '12 at 08:56
[Stumbler](http://code.google.com/p/iphone-wireless/) - which is great for WiFi - also has a module called CellStumbler. I didn't test it but it looks this would be the place to start. This project uses private API. And I think you can't get CellID or LAC on iPhone without private API. Definetly not in case when positioing is turned off. — Rok Jarc, Nov 16 '12 at 10:31
Well.. I knew Stumbler... For Wifi it still works on iOS5.1 (after considering the minimal changes indicated here: http://blog.guvenergokce.com/iphone-wireless-scanner-ios5/170/). However, CellStumbler (which makes extensive use of private APIs) does not work on iOS5.1. The old private APIs have perhaps been modified, which is the reason of my question... @nico24 told that he was able to get the CellID and LAC info I need (his question was made on Aug20, 2012 so I suppose he was using iOS5) so perhaps he knows the way to do it by using the new private APIs... — poorDeveloper, Nov 16 '12 at 11:43
I see. I left him (nico24) a note (since you need 50rep to do it) - hope he sees it and helps you with this - it's really an interesting topic. — Rok Jarc, Nov 16 '12 at 11:55
After all this time of googling and research, I cannot find the solution... I have been trying dissasembling FieldTest with IDA Pro, loading private GMM and CoreTelephony frameworks, etc., but nothing... GMM framework has anything to manage LAC and CellID, but I don't know how to initialize the values I need... @rokjarc, I didn't receive any response from (nico24), anyway, thanks for your support, it is very appreciated! — poorDeveloper, Nov 21 '12 at 14:27
@rokjarc Are you able to get Cell Id and LAC? If so can you suggest me how to proceed. — Dee, Mar 14 '13 at 08:21
@Dee: i don't know how to get this information on iOS devices. User nico24 is supposed to know how to do this it seems he is not active on SO anymore. — Rok Jarc, Mar 14 '13 at 10:58

creker · Answer 1 · 2015-06-25T13:16:56.870

I know three ways on how you can do it on iOS 5.x - 7.x. All of them use private APIs from CoreTelephony.framework. Supports both GSM and UMTS.

1) Using cell monitor

struct CTResult
{
    int flag;
    int a;
};

extern CFStringRef const kCTCellMonitorCellType;
extern CFStringRef const kCTCellMonitorCellTypeServing;
extern CFStringRef const kCTCellMonitorCellTypeNeighbor;
extern CFStringRef const kCTCellMonitorCellId;
extern CFStringRef const kCTCellMonitorLAC;
extern CFStringRef const kCTCellMonitorMCC;
extern CFStringRef const kCTCellMonitorMNC;
extern CFStringRef const kCTCellMonitorUpdateNotification;

id _CTServerConnectionCreate(CFAllocatorRef, void*, int*);
void _CTServerConnectionAddToRunLoop(id, CFRunLoopRef, CFStringRef);

#ifdef __LP64__

void _CTServerConnectionRegisterForNotification(id, CFStringRef);
void _CTServerConnectionCellMonitorStart(id);
void _CTServerConnectionCellMonitorStop(id);
void _CTServerConnectionCellMonitorCopyCellInfo(id, void*, CFArrayRef*);

#else

void _CTServerConnectionRegisterForNotification(struct CTResult*, id, CFStringRef);
#define _CTServerConnectionRegisterForNotification(connection, notification) { struct CTResult res; _CTServerConnectionRegisterForNotification(&res, connection, notification); }

void _CTServerConnectionCellMonitorStart(struct CTResult*, id);
#define _CTServerConnectionCellMonitorStart(connection) { struct CTResult res; _CTServerConnectionCellMonitorStart(&res, connection); }

void _CTServerConnectionCellMonitorStop(struct CTResult*, id);
#define _CTServerConnectionCellMonitorStop(connection) { struct CTResult res; _CTServerConnectionCellMonitorStop(&res, connection); }

void _CTServerConnectionCellMonitorCopyCellInfo(struct CTResult*, id, void*, CFArrayRef*);
#define _CTServerConnectionCellMonitorCopyCellInfo(connection, tmp, cells) { struct CTResult res; _CTServerConnectionCellMonitorCopyCellInfo(&res, connection, tmp, cells); }

#endif

...

id CTConnection = _CTServerConnectionCreate(NULL, CellMonitorCallback, NULL);
_CTServerConnectionAddToRunLoop(CTConnection, CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
_CTServerConnectionRegisterForNotification(CTConnection, kCTCellMonitorUpdateNotification);
_CTServerConnectionCellMonitorStart(CTConnection);

int CellMonitorCallback(id connection, CFStringRef string, CFDictionaryRef dictionary, void *data)
{
    int tmp = 0;
    CFArrayRef cells = NULL;
    _CTServerConnectionCellMonitorCopyCellInfo(connection, (void*)&tmp, &cells);
    if (cells == NULL)
    {
        return 0;
    }

    for (NSDictionary* cell in (NSArray*)cells)
    {
        int LAC, CID, MCC, MNC;

        if ([cell[(NSString*)kCTCellMonitorCellType] isEqualToString:(NSString*)kCTCellMonitorCellTypeServing])
        {
            LAC = [cell[(NSString*)kCTCellMonitorLAC] intValue];
            CID = [cell[(NSString*)kCTCellMonitorCellId] intValue];
            MCC = [cell[(NSString*)kCTCellMonitorMCC] intValue];
            MNC = [cell[(NSString*)kCTCellMonitorMNC] intValue];
        }
        else if ([cell[(NSString*)kCTCellMonitorCellType] isEqualToString:(NSString*)kCTCellMonitorCellTypeNeighbor])
        {
        }
    }

    CFRelease(cells);

    return 0;
}

2) Using CTTelephonyCenter

kCTRegistrationCellChangedNotification is sent every time current serving cell tower is changed.

extern CFStringRef const kCTRegistrationCellChangedNotification;
extern CFStringRef const kCTRegistrationGsmLac;
extern CFStringRef const kCTRegistrationLac;
extern CFStringRef const kCTRegistrationGsmCellId;
extern CFStringRef const kCTRegistrationCellId;

CFStringRef CTSIMSupportCopyMobileSubscriberCountryCode(CFAllocatorRef);
CFStringRef CTSIMSupportCopyMobileSubscriberNetworkCode(CFAllocatorRef);

id CTTelephonyCenterGetDefault();
void CTTelephonyCenterAddObserver(id, void, CFNotificationCallback, CFStringRef, void, CFNotificationSuspensionBehavior);

...

CTTelephonyCenterAddObserver(CTTelephonyCenterGetDefault(), NULL, callback, NULL, NULL, CFNotificationSuspensionBehaviorHold);

void callback(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
    NSString* notification = (NSString*)name;
    NSDictionary *cellInfo = (NSDictionary*)userInfo;

    if ([notification isEqualToString:(NSString*)kCTRegistrationCellChangedNotification])
    {
        int LAC, CID, MCC, MNC;

        if (cellInfo[(NSString*)kCTRegistrationGsmLac])
        {
            LAC = [cellInfo[(NSString*)kCTRegistrationGsmLac] intValue];
        }
        else if (data[(NSString*)kCTRegistrationLac])
        {
            LAC = [cellInfo[(NSString*)kCTRegistrationLac] intValue];
        }

        if (cellInfo[(NSString*)kCTRegistrationGsmCellId])
        {
            CID = [cellInfo[(NSString*)kCTRegistrationGsmCellId] intValue];
        }
        else if (cellInfo[(NSString*)kCTRegistrationCellId])
        {
            CID = [cellInfo[(NSString*)kCTRegistrationCellId] intValue];
        }

        MCC = [[(NSString*)CTSIMSupportCopyMobileSubscriberCountryCode(NULL) autorelease] intValue];
        MNC = [[(NSString*)CTSIMSupportCopyMobileSubscriberNetworkCode(NULL) autorelease] intValue];
    }
}

3) This returns current serving cell tower

struct CTResult
{
    int flag;
    int a;
};

id _CTServerConnectionCreate(CFAllocatorRef, void*, int*);

#ifdef __LP64__

void _CTServerConnectionGetLocationAreaCode(id, int*);
void _CTServerConnectionGetCellID(id, int*);

#else

void _CTServerConnectionGetLocationAreaCode(struct CTResult*, id, int*);
#define _CTServerConnectionGetLocationAreaCode(connection, LAC) { struct CTResult res; _CTServerConnectionGetLocationAreaCode(&res, connection, LAC); }

void _CTServerConnectionGetCellID(struct CTResult*, id, int*);
#define _CTServerConnectionGetCellID(connection, CID) { struct CTResult res; _CTServerConnectionGetCellID(&res, connection, CID); }

#endif

...

int CID, LAC, MCC, MNC;

id CTConnection = _CTServerConnectionCreate(NULL, NULL, NULL);
_CTServerConnectionGetCellID(CTConnection, &CID);
_CTServerConnectionGetLocationAreaCode(CTConnection, &LAC);
MCC = [[(NSString*)CTSIMSupportCopyMobileSubscriberCountryCode(NULL) autorelease] intValue];
MNC = [[(NSString*)CTSIMSupportCopyMobileSubscriberNetworkCode(NULL) autorelease] intValue];

UPDATE

On ARM64 (iPhone 5S) there is an issue with all CoreTelephony functions that accept struct CTResult argument. Apparently, 64-bit version of CoreTelephony exports these functions without struct CTResult argument. Because of that you will get an error on ARM64 if you call these functions like you did in the past - arguments will be wrong. I updated function declarations so that they work on both 32-bit and 64-bit ARM architectures. I tested it and it works on both iPhone 4S and iPhone 5S.

This only applies to ARM64. If you build your project for 32-bit ARM architecture then there is no such issue. Your application will use 32-bit version of CoreTelephony which expects struct CTResult argument.

8.3 UPDATE

As of iOS 8.3 all of the above solutions require entitlement to work

<key>com.apple.CommCenter.fine-grained</key>
<array>
    <string>spi</string>
</array>

Not only cell monitor is protected but it seems like all of the CoreTelephony notifications now require that entitlement to work. For example, kCTMessageReceivedNotification also affected.

How did u manage it to work?! Do i have to import the private classes?! — davidOhara, Feb 24 '14 at 11:03
Those are private APIs so you need to declare all function yourself. I provided all declarations you need in the answer. For me, cell monitor is the best way of all three. Gives you much more information. — creker, Feb 24 '14 at 11:09
let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/48256/discussion-between-chrizstone-and-creker) — davidOhara, Feb 24 '14 at 11:53
That works perfect for GSM, but it crashes when in 3G or 4G...You have a Solution? — davidOhara, Feb 24 '14 at 16:06
I tested it for both GSM and UMTS. No crashes. Don't know about LTE. — creker, Feb 24 '14 at 18:08
Yes, my fault! It crashes on iPhone 5s...Has nothing to do with 3G or 2G...I tested on both 5s and 5...On 5s it crashes when register the _CTServerConnectionRegisterForNotification(&res, CTConnection, kCTCellMonitorUpdateNotification); — davidOhara, Feb 24 '14 at 18:31
That works perfect...Thx for your work...But i think in 3G the Cell ID is some how Encrypted.... — davidOhara, Feb 25 '14 at 10:24
I have tried this and works perfectly,Thanks! The thing is: I get the same cellid for kCTCellMonitorCellTypeServing and kCTCellMonitorCellTypeNeighbor, does anyone know hot to solve this? Please help — manuvendev, Jul 18 '14 at 11:44
I have problems implementing this code. Don't know what goes in the .h file and what goes in the .m Could you upload the separated classes or maybe upload a project to see the implementation? — MontiRabbit, Nov 19 '14 at 13:23
@creker- when using first method. i am getting use of undeclared "CellMonitorCallback" — Vivek Sehrawat, Nov 25 '14 at 12:51
@kml_ckr, posted the solution. Now it requires jailbreak to work — creker, Jun 25 '15 at 13:18

score 2 · Answer 2 · edited May 23 '17 at 10:31

2

suscriberCellularProvider is an object method (vs class method).

You can take a look how to use it here: Determine iPhone user's country

I think CTCarrier has MCC and MNC.

You can check network type using the code from this question: How to check if iPhone supports CDMA or GSM

And look this question for CellID: CTServerConnectionGetCellID routine core telephony

edited May 23 '17 at 10:31

Community

1
1

answered Nov 15 '12 at 16:03

Victor Ronin

22,758
18
92
184

score 0 · Answer 3 · answered Oct 19 '15 at 03:30

The code below is how to insert to che entitlement to meke the code work on ios 8.3. As of iOS 8.3 all of the above solutions require entitlement to work

<key>com.apple.CommCenter.fine-grained</key>
<array>
    <string>spi</string>
</array>

Indeed, tha above code mentioned is said that can be run to get the lac and cell on ios 8.3 and above. But I really don't know how to insert the above on a jailbroken phone. Could anyone give any detail information.

Get CellID, MCC, MNC, LAC, and Network in iOS 5.1

3 Answers3

Linked

Related