Problem with decoding.

Jaka Hudoklin jakahudoklin at gmail.com
Wed Feb 15 21:21:04 UTC 2012


Also KC for above data bursts is 986709C7CBA122FB. Thanks again!

On Wed, Feb 15, 2012 at 3:19 PM, Jaka Hudoklin <jakahudoklin at gmail.com>wrote:

> Hello.
>
> I'm trying to figure out what am i doing wrong for days, and i can't. I'm
> doing GSM security research for my university.
>
> I sniffed A5/1 encrypted bursts of my mobile phone with known KC. The
> example of burst output is below(C-cyphertext, P-plaintext, F- decoded
> data):
>
>> C 2310735
>> 111000010011011101110001010111110100001010101111110001110100011010011011101100101100010010011011010100101111100111
>> P 2310735
>> 100000000001110111010100000000000001000011011101000000001000000000010101110100000100000010000101010111010101000010
>> C 2310736
>> 101110101001101010010111111111101010111001111001001110011000011111011001010010010111110010010000111000111011100011
>> P 2310736
>> 101011111111010101010001100000101010111111010101000100001010111110111101110100010010100010111011111101010001001010
>> C 2310737
>> 100011010101111101001111011110111010100001010010100010010110000010111110001011010010100111101000011110010100100101
>> P 2310737
>> 000100010111010100010000101000010100011101010000000010100001000101110101010000000000100001000111010101000000001010
>> C 2310738
>> 100011100100110101110100001001001111110110110000001101100110001101100011011000011011111111011100101110100000101111
>> P 2310738
>> 010100001000101011101101010101010100001010111111110101110100000010101010101011010101010100001000101010101101110101
>> F 1 22 9 6 32 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b
>> C 2310752
>> 110011010101101010011000000101011010111000001111110111011101011010111101110101000101101001110001000000100000101011
>> P 2310752
>> 111000101001100101011000011010100001110010100101111101010011000111000111011100110001111110111100000111110100000101
>> C 2310753
>> 011010111101000101101001001111001001100001101010001011110111011000010101100001000100101010100110110100001000110111
>> P 2310753
>> 000011111011011101100101100000101011111000100110110001010110010011101111111011000000110010011110001011011000010010
>> C 2310754
>> 011011000011001100000110001110000011010100000101100000011111101100101000011001001010100001011100001011111011001011
>> P 2310754
>> 100000010010110101010001101110110100000110011101010111100010100000001001010101011001001001100010101101110100101010
>> C 2310755
>> 001001010111101010011010100110100011101001010101010010001011111101001000000111101101001011001111001001010001010011
>> P 2310755
>> 111001001001100011101001100100110100100000110010100110011101010000101010010010101011010001011000000001001100101111
>> F 5 3 3 3 2d 6 1e 7 1e 92 f3 14 0 3b 97 88 2b 2b 2b 2b 2b 2b 2b
>
>
> As you can see frames are decoded correctly and they are correctly
> displayed in wireshark.
>
> If i put XOR-ed value betwene cyprtext and plaintext-> keystream to
> kraken, i don't get any usefull results only the ones that do not produce
> correct KC. i calculate frame count correctly, because i test it with data
> from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000803.html.
> Kraken works correctly for me since i can get correct kc with keystream
> from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000688.html
> .
>
> The ouput bursts in example above are written using following lines of
> code:
>         for (i=0; i<57; i++)
>                 fprintf( app_state.fh, "%d", bt[i] );
>         for (i=59; i<116; i++)
>                 fprintf( app_state.fh, "%d", bt[i] );
> where bt is generated using:
>         osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
>         osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0);
>
> Can you help me identify why can't i correctly crack bursts?
>
> Thanks!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/baseband-devel/attachments/20120215/158da1a7/attachment.html>


More information about the baseband-devel mailing list