Qualcomm AGPS request
May 19, 2023 - Reading time: 2 minutes

I have captured AGPS request to see what exactly is sent to Qualcomm when fetching AGPS database.

What it looks like, it is hitting CloudFront cache (access logs are available for Qualcomm) and the phone provides various information in User-Agent header:

  • Make of the phone: ZTE
  • Model of the phone: ZTE#A2017X
  • Code name of the phone: ailsa_ii
  • Some serial number?: l17983421956941646632
  • Made up phone number? (no SIM card present): +1141306236
  • Some other parameters that I don't know what they are

This is plain HTTP (unencrypted) request, no SIM card in the phone:

GET /xtra3grc.bin HTTP/1.1
Host: xtrapath1.izatcloud.net 
Accept: */*, application/vnd.wap.mms-message, application/vnd.wap.sic
x-wap-profile: http://www.openmobilealliance.org/tech/profiles/UAPROF/ccppschema-20021212#
User-Agent: A/9/ZTE/ZTE#A2017X/ailsa_ii/unknown/QCX3/l17983421956941646632/-/+1141306236/-/ZTE/143/64/-/3.0/1/M/0

Response headers:

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 27645
Connection: keep-alive
Date: Fri, 19 May 2023 10:11:45 GMT
Last-Modified: Fri, 19 May 2023 10:08:41 GMT
ETag: "420f174d934ba38469035c07ae899827"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=900
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 ff7cafeac35b91a7af23c56e3b9691e8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUB56-P1
X-Amz-Cf-Id: 3dDZPPtHhoy9o2DhmML7Z3nTi6NtMOva1-XFx8oaREDV74GdOP7fYQ==
Age: 2

Following is the response body.

Navigation

Mastodon