Cellular Tower Analysis

Relevant source files

The following files were used as context for generating this wiki page:

• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/CellularListScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/details/CellularDetailsScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/HeatmapData.kt
• app/src/main/kotlin/com/shadowcheck/mobile/utils/ExportUtils.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/MapScreen.kt

Cellular Tower Analysis within the ShadowCheck Mobile project encompasses the discovery, logging, and spatial analysis of mobile network infrastructure. The system utilizes Android's telephony APIs to capture detailed technical parameters of nearby cell towers, including identifiers like Cell ID, LAC/TAC, and signal metrics. This data is leveraged for real-time monitoring, historical sighting tracking, and geographic visualization to assist in network security and surveillance detection.

The architecture relies on a background service for continuous data collection and a local Room database for persistent storage. Collected data is exposed through various UI components, including filtered lists, detailed technical views, and interactive map overlays. Key functionalities include signal quality assessment, temporal heatmap generation, and multi-format data export (CSV, KML, GeoJSON).

Sources: README.md, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/CellularListScreen.kt

Data Collection and Processing

The system captures cellular data through the CompleteScannerService, which interacts with the TelephonyManager. It processes different cell types, specifically GSM and LTE, extracting specific identifiers and signal strengths. A 30-second deduplication logic is applied to prevent database bloat from redundant sightings of the same tower in a short interval.

Collection Workflow

The following diagram illustrates the lifecycle of a cellular scan from detection to database insertion.

Cellular Tower Data Model

The system tracks the following attributes for every detected tower:

Field	Description	Type
cellId	Unique identifier for the cell (CID for GSM, CI for LTE)	Int
lac	Location Area Code or Tracking Area Code (TAC)	Int
mcc	Mobile Country Code	Int
mnc	Mobile Network Code	Int
psc	Physical Cell Identity (PCI) for LTE / Primary Scrambling Code	Int
signalStrength	Signal level (0-4 or dBm depending on context)	Int
networkType	Technology type (e.g., LTE, GSM, NR)	String
latitude/longitude	Geographic coordinates of the sighting	Double
timestamp	Time of the most recent detection	Long

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt:225-263, app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/details/CellularDetailsScreen.kt:65-85

Spatial and Temporal Analysis

ShadowCheck Mobile provides advanced visualization tools to analyze cellular tower distribution and activity patterns.

Heatmap Generation

The HeatmapGenerator aggregates tower data into a grid-based structure (approximately 111 meters per cell) to calculate signal density and tower concentration.

fun generateCellularHeatmap(
    towers: List<com.shadowcheck.mobile.data.CellularTower>,
    gridSize: Double = 0.001 // ~111 meters
): HeatmapLayer {
    val points = towers
        .filter { it.latitude != 0.0 && it.longitude != 0.0 }
        .groupBy { 
            Pair((it.latitude / gridSize).toInt(), (it.longitude / gridSize).toInt())
        }
        .map { (grid, tows) ->
            HeatmapPoint(
                latitude = tows.map { it.latitude }.average(),
                longitude = tows.map { it.longitude }.average(),
                intensity = (tows.size / 3f).coerceIn(0f, 1f),
                signalStrength = tows.map { it.signalStrength }.average().toInt(),
                networkCount = tows.size
            )
        }
    // ... returns HeatmapLayer
}

Sources: app/src/main/kotlin/com/shadowcheck/mobile/domain/model/HeatmapData.kt:76-103

Temporal Heatmap

The HeatmapScreen allows users to visualize cellular activity across different times of the week, helping identify when certain towers are most active or detectable. Activity is grouped by Day of Week (0-6) and Hour of Day (0-23).
Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/HeatmapScreen.kt:56-65

User Interface and Interaction

The UI is structured into three primary levels: list overview, technical details, and map visualization.

Signal Quality Mapping

The application translates raw signal metrics into human-readable quality ratings:

• Excellent: Signal Strength >= -70 dBm
• Good: Signal Strength >= -85 dBm
• Fair: Signal Strength >= -100 dBm
• Weak: Signal Strength >= -110 dBm
• Very Weak: Signal Strength < -110 dBm

Sources: app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/details/CellularDetailsScreen.kt:111-119

Map Visualization

The MapScreen aggregates markers for all detected towers. It calculates the average center point of all markers to provide an initial view and provides filtering by "Cellular" type to isolate tower infrastructure from WiFi or Bluetooth devices.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/MapScreen.kt:66-77

Data Export and Integration

For external analysis, the ExportUtils module supports exporting cellular tower data in three primary formats.

Format	Content Description	Use Case
CSV	Flat list of ID, Operator, Signal, Lat, Lon, and Timestamp.	Spreadsheet analysis / Excel.
KML	Placemarks grouped in a "Cell Towers" folder.	Google Earth / GIS software.
GeoJSON	Feature collection with point geometries and properties.	Web-based mapping and Leaflet/Mapbox.

Sources: app/src/main/kotlin/com/shadowcheck/mobile/utils/ExportUtils.kt:31-88

Summary

Cellular Tower Analysis in ShadowCheck Mobile provides a robust framework for monitoring cellular environments. By combining real-time scanning through the CompleteScannerService with persistent storage and specialized analytical views (Heatmaps and Maps), the system enables users to identify network infrastructure, track movement via sightings, and export data for further SIGINT (Signals Intelligence) research.