As far as I know cells in range is something the modem knows. What it decides to report the Android space depends on implementation of the vendor and the kind of network you use(UMTS/GSM/HSPA..). Most vendors have closed sourced modem which runs in some kind of arm/dsp/rt secondary processor.
The communication with the modem is done using RPC in chipset specific manner which eventually connects to RIL layer and android apis. I dont think there is easy way to hack beyond messing up with the android/ril layer which is also kind of limited. Hacking the kernel is also useless.
Maybe newer devices have more information coming through and this can be what you are looking for..