Hack the Planet
Your mission, anon, should you choose to accept it is to find the connection between your iPhone or Android and the modem chips. Convert the raw data to pcaps and other format for proprietary comms.
Bonus round: capture all comms between radio and modem, and decode any encrypted packets using keys embedded in modem (Qualcomm, others)
Get your electron microscopes ready, anons!
Carrier proprietary comms won’t be sent over WiFi. Phones are smart enough to differentiate. While state level actors may insert their silent malware over WiFi they are inclined to rather use side channels. This implicates the radio between your mobile carrier antennas and the radio in your phone, a side channel if you will, encrypted using hard coded keys buried deep in the modem chips in your phone.